Description
Windows Management Instrumentation Command-line (WMIC) uses Windows Management Instrumentation (WMI) to enable system management from the command line.
This post explains how to install a wmic client on a Linux machine. The above installation procedure has been tested on a Ubuntu 12.04 LTS 32 bits host.
The client for Linux is not as powerful as the one for Windows because it is limited to "select" requests (i.e. not possible to request something like "process list brief") but will be helpful if you don‘t want to start your Windows virtual machine.
Installation
Pre-requisites
$ sudo aptitude install autoconf
Compilation
$ cd /data/tools/ $ wget http://www.openvas.org/download/wmi/wmi-1.3.14.tar.bz2 $ bzip2 -cd wmi-1.3.14.tar.bz2 | tar xf - $ cd wmi-1.3.14/ $ sudo make $ sudo cp Samba/source/bin/wmic /usr/local/bin/
Usage
Usage
Usage: wmic -U user%password //host "query"
Options
- -?, --help
- Show this help message
- -A, --authentication-file=FILE
- Get the credentials from a file
- --delimiter=STRING
- delimiter to use when querying multiple values, default to ‘|‘
- -d, --debuglevel=DEBUGLEVEL
- Set debug level
- --debug-stderr
- Send debug output to STDERR
- -i, --scope=SCOPE
- Use this Netbios scope
- -k, --kerberos=STRING
- Use Kerberos
- -l, --log-basename=LOGFILEBASE
- Basename for log/debug files
- --leak-report
- enable full talloc leak reporting on exit
- --leak-report-full
- enable talloc leak reporting on exit
- -m, --maxprotocol=MAXPROTOCOL
- Set max protocol level
- --namespace=STRING
- WMI namespace, default to root\cimv2
- -N, --no-pass
- Don‘t ask for a password
- -n, --netbiosname=NETBIOSNAME
- Primary netbios name
- --option=name=value
- Set smb.conf option from command line
- -O, --socket-options=SOCKETOPTIONS
- socket options to use
- --password=STRING
- Password
- -P, --machine-pass
- Use stored machine account password (implies -k)
- --realm=REALM
- Set the realm name
- -R, --name-resolve=NAME-RESOLVE-ORDER
- Use these name resolution services only
- --simple-bind-dn=STRING
- DN to use for a simple bind
- -S, --signing=on|off|required
- Set the client signing state
- -s, --configfile=CONFIGFILE
- Use alternative configuration file
- --usage
- Display brief usage message
- --use-security-mechanisms=STRING
- Restricted list of authentication mechanisms available for use with this authentication
- -U, --user=[DOMAIN\]USERNAME[%PASSWORD]
- Set the network username
- -V, --version
- Print version
- -W, --workgroup=WORKGROUP
- Set the workgroup name
Examples
Note: For a complete list of classes you can request, please refer to http://msdn.microsoft.com/en-us/library/aa394554(v=vs.85).aspx
Get system information
$ wmic -U unknown //192.168.1.12 "select * from Win32_ComputerSystem"
Password for [WORKGROUP\unknown]:
CLASS: Win32_ComputerSystem
AdminPasswordStatus|AutomaticResetBootOption|AutomaticResetCapability|BootOptionOnLimit|BootOptionOnWatchDog|BootROMSupported|
BootupState|Caption|ChassisBootupState|CreationClassName|CurrentTimeZone|DaylightInEffect|Description|Domain|DomainRole|
EnableDaylightSavingsTime|FrontPanelResetStatus|InfraredSupported|InitialLoadInfo|InstallDate|KeyboardPasswordStatus|LastLoadInfo|
Manufacturer|Model|Name|NameFormat|NetworkServerModeEnabled|NumberOfLogicalProcessors|NumberOfProcessors|OEMLogoBitmap|OEMStringArray|
PartOfDomain|PauseAfterReset|PowerManagementCapabilities|PowerManagementSupported|PowerOnPasswordStatus|PowerState|PowerSupplyState|
PrimaryOwnerContact|PrimaryOwnerName|ResetCapability|ResetCount|ResetLimit|Roles|Status|SupportContactDescription|SystemStartupDelay|
SystemStartupOptions|SystemStartupSetting|SystemType|ThermalState|TotalPhysicalMemory|UserName|WakeUpType|Workgroup
3|True|True|0|0|True|Normal boot|UNKNOWN-7C76953|3|Win32_ComputerSystem|120|True|AT/AT COMPATIBLE|WORKGROUP|0|True|3|False|NULL|(null)|
3|(null)|innotek GmbH|VirtualBox|UNKNOWN-7C76953|(null)|True|1|1|NULL|(vboxVer_4.2.12,vboxRev_84980)|False|-1|NULL|False|3|0|3|(null)|
Unknown|1|-1|-1|(LM_Workstation,LM_Server,NT,Potential_Browser)|OK|NULL|30|("Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect)|
0|X86-based PC|3|1073201152|UNKNOWN-7C76953\unknown|6|(null)
Get list of running processes
$ wmic -U unknown%oopsoops //192.168.1.12 "select caption, name, parentprocessid, processid from win32_process" CLASS: Win32_Process Caption|Handle|Name|ParentProcessId|ProcessId System Idle Process|0|System Idle Process|0|0 System|4|System|0|4 smss.exe|460|smss.exe|4|460 csrss.exe|924|csrss.exe|460|924 winlogon.exe|948|winlogon.exe|460|948 services.exe|992|services.exe|948|992 lsass.exe|1004|lsass.exe|948|1004 VBoxService.exe|1168|VBoxService.exe|992|1168 svchost.exe|1220|svchost.exe|992|1220 svchost.exe|1332|svchost.exe|992|1332 MsMpEng.exe|1576|MsMpEng.exe|992|1576 svchost.exe|1616|svchost.exe|992|1616 svchost.exe|1712|svchost.exe|992|1712 svchost.exe|1940|svchost.exe|992|1940 spoolsv.exe|244|spoolsv.exe|992|244 explorer.exe|916|explorer.exe|788|916 VBoxTray.exe|1288|VBoxTray.exe|916|1288 concentr.exe|1388|concentr.exe|916|1388 msseces.exe|1400|msseces.exe|916|1400 ctfmon.exe|1424|ctfmon.exe|916|1424 wfcrun32.exe|1472|wfcrun32.exe|1220|1472 svchost.exe|1812|svchost.exe|992|1812 dsNcService.exe|1908|dsNcService.exe|992|1908 jqs.exe|280|jqs.exe|992|280 TeamViewer_Service.exe|780|TeamViewer_Service.exe|992|780 alg.exe|3556|alg.exe|992|3556 wmiapsrv.exe|532|wmiapsrv.exe|992|532 wscntfy.exe|1640|wscntfy.exe|1616|1640 wmiprvse.exe|4000|wmiprvse.exe|1220|4000