WMI

MITRE ATT&CK™ Windows Management Instrumentation - Technique T1047

Theory

Windows Management Instrumentation (WMI) provides a standardized way for querying and managing various elements of a Windows operating system. It allow administrators to perform standard management tasks that attackers can abuse to perform code execution.

We can use WMI to execute binary, commands, msi, services, scheduled tasks or XSL file that contain javascript payload with WMIC.

Practice

Commands

Execute a local binary or a command using wmic.exe

wmic.exe process call create "C:\Windows\Temp\evil.exe"
wmic.exe process call create "cmd.exe /c calc.exe"

Or we may use powershell

#Execute a command remotely 
$Command = "powershell.exe -Command Set-Content -Path C:\text.txt -Value munrawashere";

#Powershell v1+
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList $Command

#Powershell v3+
Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = $Command }

XSL

MSI

You may want to check this page for remote WMI execution :

Remote WMI

Resources

Living Off the LandTryHackMe

Application Whitelisting Bypass with WMIC and XSL | Red Team Noteswww.ired.team