Skip to content
This repository has been archived by the owner on Dec 6, 2023. It is now read-only.

--wmi requires admin to work #668

Closed
juliourena opened this issue Nov 4, 2022 · 0 comments
Closed

--wmi requires admin to work #668

juliourena opened this issue Nov 4, 2022 · 0 comments

Comments

@juliourena
Copy link
Contributor

WMI queries can be enabled to any users, there are scenarios where an admin may want to provide such privileges to a non-administrator user. For example: https://serverfault.com/questions/28520/which-permissions-rights-does-a-user-need-to-have-wmi-access-on-remote-machines

If we remove the require admin, this is the result for a user with privileges and another user without privileges:

poetry run python3 ./crackmapexec.py smb 10.129.203.121 -u robert -p 'Inlanefreight01!' --wmi "SELECT Caption,ProcessId FROM Win32_Process WHERE Caption LIKE '%sysmon%'"
SMB         10.129.203.121  445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:inlanefreight.htb) (signing:True) (SMBv1:False)
SMB         10.129.203.121  445    DC01             [+] inlanefreight.htb\robert:Inlanefreight01! 
SMB         10.129.203.121  445    DC01             Caption => Sysmon64.exe
SMB         10.129.203.121  445    DC01             ProcessId => 3220
SMB         10.129.203.121  445    DC01
poetry run python3 ./crackmapexec.py smb 10.129.203.121 -u grace -p 'Inlanefreight01!' --wmi "SELECT Caption,ProcessId FROM Win32_Process WHERE Caption LIKE '%sysmon%'"
SMB         10.129.203.121  445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:inlanefreight.htb) (signing:True) (SMBv1:False)
SMB         10.129.203.121  445    DC01             [+] inlanefreight.htb\grace:Inlanefreight01! 
SMB         10.129.203.121  445    DC01             [-] Error creating WMI connection: rpc_s_access_denied

Best regards! I'll submit a PR.

@mpgn mpgn closed this as completed in 4562cea Nov 7, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant