Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Understanding Windows Management Instrumentatio...

Bharath
March 10, 2018

Understanding Windows Management Instrumentation(WMI)

Slides from "Understanding WMI" talk given at Null, Bangalore March 10th 2018.

Repo for the talk - https://github.com/yamakira/understanding-wmi

Windows Management Instrumentation (WMI) is a core component of Windows that was designed to allow administrators to perform local and remote management operations across a network. WMI has been extensively used in Windows/AD administration. WMI has gained popularity among both attackers & defenders in recent times. This talk is to understand what exactly is WMI and what's in it for an admin/attacker/defender?

The outline of the talk:

Why bother understanding WMI?
What is WMI?
WMI architecture
WMI & Powershell
WQL
Useful WMI queries
Attacker & Defender perspective of WMI
Lab setup - for practice
Moving Forward

Bharath

March 10, 2018
Tweet

More Decks by Bharath

Other Decks in Research

Transcript

  1. AGENDA AGENDA Why bother understanding WMI? What is WMI? WMI

    overview Using WMI via Powershell WQL Useful WMI queries Offensive tools using WMI Moving Forward
  2. WHY BOTHER LEARNING WMI? WHY BOTHER LEARNING WMI? WMI is

    powerful and it is present in all versions of Windows starting from Windows 2000 WMI can be leveraged for system/domain administration, offensive and defensive purposes It's fun to learn WMI
  3. APT 29 has been using WMI for infection and persistence

    https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national- committee/
  4. WMI has been used by adversaries in the recent hacks

    at Winter Olympics https://www.cymulate.com/hacking-the-2018-winter-olympics/
  5. WHAT IS WMI? WHAT IS WMI? Windows Management Instrumentation is

    a core component of Windows that can be used to manage both local and remote computers https://technet.microso .com/en-us/library/ee692772.aspx
  6. WEB-BASED ENTERPRISE MANAGEMENT WEB-BASED ENTERPRISE MANAGEMENT (WBEM) (WBEM) Data collection

    and management standards in distributed computing environment WBEM answers the "what" should this data exchange and remote management look like
  7. COMMON INFORMATION MODEL (CIM) COMMON INFORMATION MODEL (CIM) CIM is

    an open standard that defines "how" managed elements in a distributed environment are represented as a common set of objects and relationships between them Object Oriented paradigm
  8. CIM/WMI CIM/WMI Representation of anything within a computer system Namespaces

    Classes Objects Methods Properties Events Event consumers
  9. NAMESPACES NAMESPACES Collection of classes Nested namespaces can exist In

    WMI, every namespace exists under "ROOT" namespace Default namespace in WMI is "ROOT\cimv2"
  10. CLASSES CLASSES Class is a blueprint for an object Classes

    are abstract Classes define methods and properties In context of WMI, any Windows component can be a class like process, service, user and file
  11. OBJECTS OBJECTS object refers to a particular instance of a

    class In WMI context, not all classes may have objects For example, win32_fan is a WMI class that represents properties of fan device on computer. This class might not have an object instance on VirtualBox guests
  12. WMI USING POWERSHELL WMI USING POWERSHELL WMI cmdlets WMI cmdlets

    operate over DCOM protocol on TCP port 135 Get-Command -Noun wmi* https://msdn.microso .com/en-us/library/ee309379(v=vs.85).aspx
  13. CIM cmdlets CIM cmdlets are available in > PS v3

    (Above Windows 7) Operates over WS-MAN protocol over TCP 5985/5986. Can be forced to use DCOM Get-Command -Noun cmi* https://blogs.msdn.microso .com/powershell/2012/08/24/introduction-to-cim-cmdlets/
  14. WINDOWS MANAGEMENT WINDOWS MANAGEMENT INSTRUMENTATION QUERY LANGUAGE INSTRUMENTATION QUERY LANGUAGE

    (WQL) (WQL) Microso 's implementation of the CIM Query Language (CQL) subset of ANSI standard SQL SELECT * FROM WIN32_Process where Name like '%Notepad%'"
  15. GET USER ACCOUNT DETAILS USING WQL GET USER ACCOUNT DETAILS

    USING WQL gwmi -query "SELECT * FROM WIN32_useraccount WHERE Name like '
  16. LIST OF PROCESSES RUNNING ON LIST OF PROCESSES RUNNING ON

    REMOTE MACHINE REMOTE MACHINE gwmi win32_process -ComputerName <remote-hostname> -Credential
  17. LIST OF ALL USERS ON THE DOMAIN LIST OF ALL

    USERS ON THE DOMAIN gwmi win32_useraccount -ComputerName <remote-hostname> -Creden
  18. WHAT DOES WMI PROVIDE FOR WHAT DOES WMI PROVIDE FOR

    ATTACKERS? ATTACKERS? 1. Information gathering 2. Lateral movement 3. Command/Script execution 4. Storage 5. Persistence
  19. LIST ALL THE GROUPS IN DOMAIN LIST ALL THE GROUPS

    IN DOMAIN gwmi win32_group -ComputerName <remote-hostname> -Credential D
  20. FIND THE ANTI VIRUS PRODUCT NAME FIND THE ANTI VIRUS

    PRODUCT NAME gwmi -Namespace root\SecurityCenter2 -Class AntiVirusProduct |
  21. FINDING DOMAIN THAT REMOTE FINDING DOMAIN THAT REMOTE MACHINE IS

    PART OF MACHINE IS PART OF gwmi -Namespace root\directory\ldap -Class ds_computer -Comput
  22. WMI CONSUMERS WMI CONSUMERS ActiveScriptEventConsumer & CommandLineEventConsumer are very useful

    in red team engagements LogFileEventConsumer & NTEventLogConsumer are very useful for blue teams or admins
  23. WHAT'S NOT COVERED? WHAT'S NOT COVERED? WMI events in-depth WMI

    for persistence & backdoor WMI for storage
  24. SETTING UP ACTIVE DIRECTORY SETTING UP ACTIVE DIRECTORY Setting up

    AD is very easy It can be done in under 5 powershell commands https://blogs.technet.microso .com/uktechnet/2016/06/08/setting-up-active-directory-via- powershell/
  25. AUTOMATING LAB SETUP AUTOMATING LAB SETUP You can use provisioning

    so ware like vagrant, terraform to automate Active Directory lab setup A reference lab setup can be found in the following link https://github.com/StefanScherer/adfs2
  26. ACTIVE DIRECTORY(AD) ON CLOUD ACTIVE DIRECTORY(AD) ON CLOUD Active Directory

    environment can be setup painlessly(subjective) on cloud services like AWS, Azure Instructions to set up AD in the cloud: TBD
  27. ABOUT ME ABOUT ME Bharath Kumar Security Engineer @ Offensive

    Security Certified Professional(OSCP) Appsecco https://disruptivelabs.in @yamakira_