hartl3y94 / wmiops

This repo is for WMIOps, a powershell script which uses WMI for various purposes across a network.

#WMIOps

WMIOps is a powershell script that uses WMI to perform a variety of actions on hosts, local or remote, within a Windows environment. It's designed primarily for use on penetration tests or red team engagements.

This is my first PowerShell script, so I am sure there's things that could have been done better. Please submit a request for anything that could be made more efficient and I'd be happy to look at it, and learn from it :).

Developed by @christruncer

Thanks to: @mattifestation for your major work in this area (Posh and WMI), @obscuresec, @enigma0x3, @424f424f, @xorrior, and @sixdub for having already solved a lot of PowerShell problems and publishing your code to let me, and others, learn from it @harmj0y - for helping to mentor me from the beginning @evan_Pena2003 - For your help with code reviews and teaching me what to look into and learn

WMIOps Functions:

Process Functions

Invoke-ExecCommandWMI               -   Executes a user specified command on the target machine
Invoke-KillProcessWMI               -   Kills a process (via process name or ID) on the target machine
Get-RunningProcessesWMI             -   Returns all running processes from the target machine

User Operations

Find-ActiveUsersWMI                 -   Checks if a user is active at the desktop on the target machine (or if away from their machine)
Get-ProcessOwnersWMI                -   Returns all accounts which have active processes on the target system

Host Enumeration

Get-SystemDrivesWMI                 -   Lists all local and network connected drives on target system
Get-ActiveNICSWMI                   -   Lists all NICs on target system with an IP address

System Manipulation Operations

Invoke-CreateShareandExecute        -   Creates a share, copies file into it, uses WMI to invoke the script on the target system, from the local system, via UNC path
Invoke-RemoteScriptWithOutput       -   Executes a powershell script in memory on the target host via WMI and returns the output
Invoke-SchedJobManipulation         -   Allows you to list, delete, or create jobs on a system over WMI
Invoke-ServiceManipulation          -   Allows you to start, stop, create, or delete services on a targeted system over WMI
Invoke-PowerOptionsWMI              -   Force logs off all users, reboots, or shuts down targeted system

File Operations

Invoke-DirectoryListing             -   Lists files/directories within a user specfied directory over WMI
Get-FileContentsWMI                 -   Reads the contents of a user specified file on a target system and displays the contents
Find-UserSpecifiedFileWMI           -   Search for a file (wildcard supported) on a target system
Invoke-FileTransferOverWMI          -   Uploads or Downloads files to/from the target machine over WMI

Original blog post documenting release - https://www.christophertruncer.com/introducing-wmi-ops/