rapid7/metasploit-framework — pull request #2402 by Meatballs1 (2013-09-20 17:44:21+00:00)
Title: Windows Management Instrumentation Local -> Peers

This module uses WMI to run a powershell payload on peers of the localhost. It is similar to the current_user_psexec module in that it uses the current user identity and runs on an existing session.

WMI uses TCP port 135 and an ephemeral port so access may be granted where 445 is blocked for PSEXEC.

There appears to be a limit of 4096 on the WMI command so I have to split up a meterpreter session. Environment vars appear to be max 1024. I chose not to supply the payload via SMB/80 as this module is probably only useful when 445 is blocked and so a restrictive firewall is likely to be in place.

This module also allows supplied credentials, however if local administrator is used this module will fail due to the way the environment variables get stored as SYSTEM in this case.

As WMIC doesn't return anything to STDOUT we cannot currently check for success/failure of commands. We can redirect to clipboard but railgun cannot access this due to the thread context. Hopefully can persuade @oj to add some clipboard functionality to meterpreter to get around this.

Configure a client for access : ```netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes```

Have made some small changes to powershell which I was planning to integrate with @sempervictus's PR. This removes the mixture of double and single quotes making it easier to encode for the command line.