Now that we understand how WMIOps can be used for lateral movement,
it's time to start practicing in our own lab environment.
In this demo, we're going to get started with WMIOps in a small Windows lab.
We'll start with a quick overview of the lab environment I'm using for this
course and then obtain WMIOps scripts on our exploited host.
We'll load the script into the appropriate directory to call the
commands from the PowerShell command line,
and then we'll explore the available options in the WMIOps script.
Once we have the script and confirm that we can call it on our
exploited host, we'll be ready for the other demos in this course.
Let's head over to the lab and get started.
In this course,
I have a small Windows domain with two Windows 2016 servers, two
Windows 10 workstations, and one Windows 7 workstation.
The first server is the domain controller and DNS
server for the globomantics.test domain.
The other server is running hMailServer to provide
email services for the domain.
I'll be running WMIOps from one of the Windows 10 machines,
which is acting as the exploited host for this course.
I'm running the commands directly from the Windows 10 machine to
focus this course on how to use WMIOps for a lateral movement
rather than on exploiting the host first and running commands
remotely through a shell.
To follow along in this course,
you do not need to set up a domain or this many remote workstations.
You can run all the functions against a single target either
using two Windows virtual machines or a single virtual
machine running on a Windows host.
I set up a domain for this lab because it allows me to simulate
lateral movement using an exploited host and domain credentials
with permissions on the remote hosts.
If you're not running a domain,
I'll explain the necessary modifications you need to take. Now
that we covered the lab overview, let's head over to the Windows
10 machine and get started with WMIOps.
We can download WMIOps from PowerShell using the Invoke‑WebRequest command,
followed by the URL to the archive on GitHub. Once we obtain it,
we can place it in this directory. In a penetration test,
you might host the file from the machine you use to exploit the host
and transfer it another way, but for this course,
we're just focused on getting WMIOps and activating it, so we'll
download it from the internet. Once it downloads,
we'll extract the files using Expand‑Archive.
Now we have a directory called WMIOps‑master.
Let's go ahead and navigate into that directory, and we can check the contents.
Our script is here, called WMIOps.ps1.
Let's go ahead and import that into PowerShell.
Once our script is imported,
we can get a list of available commands by entering
get‑command and then adding a few filters.
If you're unfamiliar with PowerShell, what I'm doing is using
get‑command to get a list of all the commands and then filtering it
for what I know WMIOps has for certain variables.
As an example,
the Source field and all the WMIOps results is blank, so I'm
using this to say Source contains nothing. Most,
but not all of the WMI commands end in WMI.
So I'm adding in this condition that the name ends in
WMI and using the star as a wildcard.
The remaining functions in this script begin with the word Invoke.
And once we enter that, we have our list of available WMI commands.
If you can't remember all of the filters for this,
if you at least remember the Name ‑like *WMI,
you'll get most of the functions out of the WMI app script.
It'll only leave out these few that don't have WMI on the end of them.
Now that we have our list of commands,
let's explore some of the help options. Help for each of these
functions is available using the get‑help command,
followed by the name of the function.
Let's look at the help for Get‑ActiveNICSWMI.
In order to get this,
you may have to run the Update‑Help. Let's go ahead and
do that now. I'm going to go ahead and let this run and
come back when it's finished.
And once that finishes, we'll see the information we were looking for.
Listed under the help entry for all of the WMIOps commands is a
synopsis and brief description of what it is.
In this case, they're identical. But in some,
the description is a little different and contains more information.
You'll also get the syntax for the command and have
some access to additional information.
Down here,
we can see that we can add a ‑examples to our command
and get a few command line examples.
Let's have a look at those. And for this function, we have two example commands.
These two examples show you how to run the command with current
permissions or with credentials you know. The second example is
what you need to run if you do not have permissions on your target
with your current credentials.
Since I'm simulating an exploited host with the necessary domain privileges,
I'll be using the first example. All the WMIOps scripts have the
same user and pass options to specify credentials.
So in future demos,
you just need to add these if you're not running a domain in your lab. Let's
try running this command against the Windows 7 machine.
For me, this target is at the IP address 10.0.0.30.
If you aren't familiar with command line environments or PowerShell,
the Tab key can usually help you complete a command once you
enter a little bit of it. You'll notice that mine had changed
about halfway through me typing the word Active, and that's
because I hit that Tab command.
It can come in handy if you're not sure exactly how the command is formatted.
Once we run the Get‑ActiveNICS command against our target,
it returns the IP configuration of the active interface on my Window 7 machine.
Now that we ran a successful WMIOps command, we're ready for the
rest of the course where we'll explore more of the functions and
their uses for lateral movement.
But before we get into the next demo,
let's do a quick recap of what we learned so far.
We started this demo with a quick overview of the lab environment,
and then we downloaded WMIOps from GitHub onto our exploited host.
Once we extracted the script,
we imported it into PowerShell so we could run the WMIOps functions.
We obtained a list of imported functions and then explored the
options available in the Get‑ActiveNICSWMI function.
Finally,
we ran the Get‑ActiveNICSWMI function against a remote host and
obtained the IP configuration of the active interface. Coming up,
we'll use WMIOps to execute more commands,
manipulate services, and schedule jobs on remote workstations.