Skip to content
This repository has been archived by the owner on Dec 6, 2023. It is now read-only.

--wmi requires admin to work #668

Closed
juliourena opened this issue Nov 4, 2022 · 0 comments
Closed

--wmi requires admin to work #668

juliourena opened this issue Nov 4, 2022 · 0 comments

Comments

@juliourena
Copy link
Contributor

WMI queries can be enabled to any users, there are scenarios where an admin may want to provide such privileges to a non-administrator user. For example: https://serverfault.com/questions/28520/which-permissions-rights-does-a-user-need-to-have-wmi-access-on-remote-machines

If we remove the require admin, this is the result for a user with privileges and another user without privileges:

poetry run python3 ./crackmapexec.py smb 10.129.203.121 -u robert -p 'Inlanefreight01!' --wmi "SELECT Caption,ProcessId FROM Win32_Process WHERE Caption LIKE '%sysmon%'"
SMB         10.129.203.121  445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:inlanefreight.htb) (signing:True) (SMBv1:False)
SMB         10.129.203.121  445    DC01             [+] inlanefreight.htb\robert:Inlanefreight01! 
SMB         10.129.203.121  445    DC01             Caption => Sysmon64.exe
SMB         10.129.203.121  445    DC01             ProcessId => 3220
SMB         10.129.203.121  445    DC01
poetry run python3 ./crackmapexec.py smb 10.129.203.121 -u grace -p 'Inlanefreight01!' --wmi "SELECT Caption,ProcessId FROM Win32_Process WHERE Caption LIKE '%sysmon%'"
SMB         10.129.203.121  445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:inlanefreight.htb) (signing:True) (SMBv1:False)
SMB         10.129.203.121  445    DC01             [+] inlanefreight.htb\grace:Inlanefreight01! 
SMB         10.129.203.121  445    DC01             [-] Error creating WMI connection: rpc_s_access_denied

Best regards! I'll submit a PR.

@mpgn mpgn closed this as completed in 4562cea Nov 7, 2022
# for free to subscribe to this conversation on GitHub. Already have an account? #.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant