Hello,
I'm Matt Glass, and welcome to this course on lateral movement with WMIOps.
In this course, I'll show you how to use WMIOps to execute commands,
PowerShell scripts, and remotely access Windows
workstations using a host you already exploited.
But first, let's look at what WMIOps is and how it's used.
WMIOps is a PowerShell script that was created by Chris Truncer. This
script leverages the capabilities of Windows Management Instrumentation,
or WMI, to perform actions on Windows hosts.
WMIOps is specifically designed to perform information gathering and remote
execution actions on remote Windows hosts as part of a penetration test. You can
download the script and associated files from GitHub.
Once loaded into PowerShell, WMIOps will enable you to execute
PowerShell commands on other Windows hosts using the permissions you
obtained on the host you exploited. On the kill chain,
WMIOps falls under lateral movement only. It is not used for exploitation,
escalation, or any functions beyond lateral movement.
This is due to its requirement for permissions to execute against the system.
The attack knowledge base developed by MITRE categorizes
adversary tactics and techniques into multiple categories to
describe the adversary's behavior.
The tactics are categories that cover different phases of an attack
and allow defensive teams to model and adversary's actions and
improve the defense of their networks.
We will cover two techniques that WMIOps can be used
for. The first is remote services,
in particular, the sub‑technique for Windows admin shares.
The second technique is Windows Management Instrumentation, or WMI.
WMIOps can accomplish this by enabling adversaries who have
already exploited a Windows machine and gained sufficient
privileges to move laterally through the network.
They could use WMIOps to run PowerShell commands on other Windows
workstations and obtain information about them.
Or, if they had sufficient privileges from the exploited user,
they could use WMIOps to access Windows servers within that data center.
WMIOps allows hackers to gather information,
transfer files,
execute PowerShell commands, and remotely access other Windows
machines to laterally move through a network.