Offensive WMI

The Basics (Part 1)
# https://0xinfection.github.io/posts/wmi-basics-part-1/

Exploring Namespaces, Classes & Methods (Part 2)
# https://0xinfection.github.io/posts/wmi-classes-methods-part-2/

#wmi

Offensive WMI - Reconnaissance & Enumeration (Part 4)

This post focuses on interacting with several WMI classes to extract useful and sensitive information

https://0xinfection.github.io/posts/wmi-recon-enum/

#wmi

WMEye

A small project I wrote that uses WMI foo to remotely upload shellcode into a WMI Class and execute it by invoking MSBuild.
It uses LogFileEventConsumer Class to write the MSBuild Payload.

https://github.com/pwn1sher/WMEye

#wmi #redteam #tools

👻 The Phantom Credentials of SCCM

If an Active Directory account has ever been configured as an NAA, the credentials may persist on former clients. Not only can we query the credential blobs from WMI, we can also retrieve previously used account blobs from the CIM repository, even if the computer is no longer a client.

https://posts.specterops.io/the-phantom-credentials-of-sccm-why-the-naa-wont-die-332ac7aa1ab9

#ad #credentials #sccm #nna #wmi