Execute Remote Commands And Get Output Using Only WMI
summary
Claim: execute arbitrary commands and retrieve stdout/stderr using only WMI by creating a custom WMI class oxygen_wmi_exec that stores command output, launching an encoded PowerShell command remotely via Win32_Process Create, waiting on the remote PID, then reading and deleting the output instance. Demo shows it works when WinRM and Admin$ are disabled. Script is ~176 lines, no external dependencies, supports file transfer ideas, but has occasional class persistence issues across reboots and is not recommended as a default production remoting method.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:47WMI approach uniqueness
- 6:33Live demo: WMI Exec
- 9:53How WMI Exec works
- 11:57Custom WMI class for output
- 16:12Command execution and results
- 21:30Tool history and release
- 22:53Production use cases
- 25:02Second hop problem
- 27:44WMI class volatility
- 28:45Q&A
related talks
45mD2T1 - Expanding Your WMI Lateral Movement Arsenal
01h 34mPowerShell remoting - Installing and troubleshooting in a...
25mInvestigating PowerShell Attacks
49mPowerShell for Security Incident Response
29mAbusing WCF Endpoint for RCE and Privilege Escalation
52mRemoting evolving - SSH
49mAdvanced Network Scripting with PowerShell
43mMalicious Payloads vs Deep Visibility: A PowerShell Story