Add wmimultitool.py: WMI multitool via DCOM - #8
Merged
Conversation
…d enumeration via DCOM Consolidates multiple WMI operations into a single tool that performs all actions via DCOM without spawning processes on the target. Includes four modules: reg (StdRegProv registry ops), service (Win32_Service management), process (Win32_Process listing/termination), and enum (system enumeration for sysinfo, users, groups, shares, disks, and network adapters).
Add 7 new modules (defender, av, eventlog, net, rdp, file, share) and 5 new enum sub-actions (startup, hotfix, sessions, env, bios). All operations use DCOM/WMI only with no subprocess spawned on the target. New modules: - defender: Defender status, exclusion management (add/remove path/process/ext) - av: Security product detection via SecurityCenter2 (AV, antispyware, firewall) - eventlog: Event log list, read (filtered), and clear via Win32_NTEventLogFile - net: TCP/UDP connections and DNS cache via StandardCimv2 (netstat equivalent) - rdp: Remote Desktop enable/disable/status via TerminalServices namespace - file: File search, ls, copy, delete via CIM_DataFile (mandatory drive+path filter) - share: Network share create/delete via Win32_Share Refactored namespace routing to use NAMESPACE_MAP for clean multi-namespace support across root/default, root/cimv2, SecurityCenter2, StandardCimv2, Microsoft/Windows/Defender, and cimv2/TerminalServices.
- Win32_NTEventLogFile property is 'LogfileName' not 'LogFileName' - RDP: use ExecQuery to get TerminalServiceSetting instance for method calls instead of singleton path which may not work via DCOM
Call Win32_Process.GetOwner() on each process instance to show DOMAIN\User in the output. Requires Handle in the SELECT for WMI dynamic method dispatch to work.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
wmimultitool.pytoexamples/— a comprehensive WMI multitool that performs remote Windows operations via DCOM without spawning any process on the target. 11 modules, 40+ actions.Modules
Key design points
NAMESPACE_MAP— each module connects to the correct WMI namespacerun(remoteName, remoteHost)pattern,try/finallyDCOM cleanup-hashes,-k,-aesKey,-keytab,-target-ip,-dc-ipfile searchrequires-driveand-pathfilters (unfiltered CIM_DataFile hangs the target)Test plan
-hfor each module and sub-action)wmimultitool.py user:pass@host reg query -keyName 'HKLM\SOFTWARE\Microsoft'wmimultitool.py user:pass@host service listwmimultitool.py user:pass@host process listwmimultitool.py user:pass@host enum sysinfowmimultitool.py user:pass@host defender statuswmimultitool.py user:pass@host av listwmimultitool.py user:pass@host eventlog listwmimultitool.py user:pass@host net tcpwmimultitool.py user:pass@host rdp statuswmimultitool.py user:pass@host file search -drive C: -path '\Windows\System32\' -ext dllwmimultitool.py user:pass@host share create -name TEST -path C:\Tempwmimultitool.py -k -no-pass host enum sysinfo