Windows Management Instrumentation (WMI)
Last updated
Last updated
As you may have noticed, WMI is not part of the jump command but it is part of remote-exec. The remote-exec method uses WMI's "process call create" to execute any command we specify on the target. The most straight forward means of using this is to upload a payload to the target system and use WMI to execute it.
You can upload a file to a remote machine by cd'ing to the desired UNC path and then use the upload command.
The process is now running on WEB so now we need to connect to it.
As with WinRM, the process will be running in an elevated context of the calling user.
When a binary is executed via WMI in this way, it will be a child of WmiPrvSE.exe. We can therefore look for process create events where WmiPrvSE is the parent.
