#WMI Toolset
As part of system administration there is always a need that arises when Viruses are deployed/found on a network. Most commonly these needs are around finding specific files on windows clients as well as which application are currently running in the task list or if a file exists on a windows client. The most common way is to get internal/desktop support guys to go and investigate the windows clients which is very timeous OR to buy some expensive software that can be executed remotely (after client installs) and then reports can be pulled from them.
The WMI Toolkit, allows administrators to get all this information from their Linux Machines. The can see which processes are running within a network as the tools within the framework allow for whole CIDR ranges to be checked. Because this is WMIC through RPC and SMB you will need valid logon credentials for each computer OR a Domain Administrator account for whole domains.
#The Toolkit currently provides these tools:
1.LRRWP - Locate Remote Running Windows Processes
This app runs to find processes that are running on windows clients.
2.RWFX - Remote Windows file exists
This tools can find a specific file on a windows client / CIDR range given the expectedx location of the file to determine if it is present (like a Virus)
3.RWHI - Remote Windows Hardware Info (Memory, Bios, Motherboard, CPU)
This tool can display the hardware info for all windows clients/ with extensive information.
4.RWHS - Remote Windows Shares
Use this tool to locate Remote windows shares and their respective properties.
This help in detecting unwanted shares on a network to Help fight against data loss or theft.
#Hints
Pipe the tools's output on stdout to a file and grep it for the process you are looking for.
eg.
host@time>LRRWP 192.168.1.0/24 domain user password > output.txt
host@time>cat output.txt | grep -i backdoor.exe
This will show you matching records found:
192.168.1.23 backdoor.exe
192.168.1.187 backdoor.exe
#Additional Info
This toolset will alow the user to query the WMIC from linux. It is important to notice that the WMIC libraries need to be installed on your distro As part of this toolset I have provided the packages that need to be installed. The provided libs are for debian.
To install the libraries run the install.sh file
(you will need root)
Regards
Jacques Coetzee