rapid7/metasploit-framework — pull request #2889 by OJ (2014-01-16 23:21:54+00:00)
Title: Wmi query support

This adds basic WMI query support. The goal here was to provide a simple interface which allows for arbitrary queries to be run against WMI.

Nested arrays are supported for values so long as they are string types, otherwise they're ignored for now. Arrays are serialised to strings.

This relies on the ADSI PR being landed first, which should now be unblocked given the PR for the Meterpreter binaries has been submitted.

Meterpreter side of this PR: https://github.com/rapid7/meterpreter/pull/69

## Demo
Help:
```
Extapi: WMI Querying Commands
=============================

Command Description
------- -----------
wmi_query Perform a generic WMI query and return the results
```

Logged on users:
```
meterpreter > wmi_query "Select * from Win32_loggedonuser"

Select * from Win32_loggedonuser
================================

Antecedent Dependent
---------- ---------
\\.\root\cimv2:Win32_Account.Domain="WIN-S45GUQ5KGVK",Name="OJ" \\.\root\cimv2:Win32_LogonSession.LogonId="564212"
\\.\root\cimv2:Win32_Account.Domain="WIN-S45GUQ5KGVK",Name="OJ" \\.\root\cimv2:Win32_LogonSession.LogonId="564179"

Total objects: 2
```

Groups, with a subset of fields:
```
meterpreter > wmi_query "Select Domain,Name from Win32_group"

Select Domain,Name from Win32_group
===================================

Domain Name
------ ----
WIN-S45GUQ5KGVK Administrators
WIN-S45GUQ5KGVK Backup Operators
WIN-S45GUQ5KGVK Cryptographic Operators
WIN-S45GUQ5KGVK Distributed COM Users
WIN-S45GUQ5KGVK Event Log Readers
WIN-S45GUQ5KGVK Guests
WIN-S45GUQ5KGVK IIS_IUSRS
WIN-S45GUQ5KGVK Network Configuration Operators
WIN-S45GUQ5KGVK Performance Log Users
WIN-S45GUQ5KGVK Performance Monitor Users
WIN-S45GUQ5KGVK Power Users
WIN-S45GUQ5KGVK Remote Desktop Users
WIN-S45GUQ5KGVK Replicator
WIN-S45GUQ5KGVK Users

Total objects: 14
```

Bios info:
```
meterpreter > wmi_query "Select SerialNumber,Manufacturer from Win32_bios"

Select SerialNumber,Manufacturer from Win32_bios
================================================

Manufacturer SerialNumber
------------ ------------
Phoenix Technologies LTD VMware-56 4d 05 ef d5 8a 16 9a-2a 8c 19 b4 19 2e b5 82

Total objects: 1
```

Subset of accounts, with filtering:
```
meterpreter > wmi_query "Select name,domain,sid from Win32_account where domain like 'WIN%'"

Select name,domain,sid from Win32_account where domain like 'WIN%'
==================================================================

Domain Name SID
------ ---- ---
WIN-S45GUQ5KGVK Administrators S-1-5-32-544
WIN-S45GUQ5KGVK Backup Operators S-1-5-32-551
WIN-S45GUQ5KGVK Cryptographic Operators S-1-5-32-569
WIN-S45GUQ5KGVK Distributed COM Users S-1-5-32-562
WIN-S45GUQ5KGVK Event Log Readers S-1-5-32-573
WIN-S45GUQ5KGVK Guests S-1-5-32-546
WIN-S45GUQ5KGVK IIS_IUSRS S-1-5-32-568
WIN-S45GUQ5KGVK Network Configuration Operators S-1-5-32-556
WIN-S45GUQ5KGVK Performance Log Users S-1-5-32-559
WIN-S45GUQ5KGVK Performance Monitor Users S-1-5-32-558
WIN-S45GUQ5KGVK Power Users S-1-5-32-547
WIN-S45GUQ5KGVK Remote Desktop Users S-1-5-32-555
WIN-S45GUQ5KGVK Replicator S-1-5-32-552
WIN-S45GUQ5KGVK Users S-1-5-32-545
WIN-S45GUQ5KGVK Everyone S-1-1-0
WIN-S45GUQ5KGVK LOCAL S-1-2-0
WIN-S45GUQ5KGVK CREATOR OWNER S-1-3-0
WIN-S45GUQ5KGVK CREATOR GROUP S-1-3-1
WIN-S45GUQ5KGVK CREATOR OWNER SERVER S-1-3-2
WIN-S45GUQ5KGVK CREATOR GROUP SERVER S-1-3-3
WIN-S45GUQ5KGVK OWNER RIGHTS S-1-3-4
WIN-S45GUQ5KGVK DIALUP S-1-5-1
WIN-S45GUQ5KGVK NETWORK S-1-5-2
WIN-S45GUQ5KGVK BATCH S-1-5-3
WIN-S45GUQ5KGVK INTERACTIVE S-1-5-4
WIN-S45GUQ5KGVK SERVICE S-1-5-6
WIN-S45GUQ5KGVK ANONYMOUS LOGON S-1-5-7
WIN-S45GUQ5KGVK PROXY S-1-5-8
WIN-S45GUQ5KGVK SYSTEM S-1-5-18
WIN-S45GUQ5KGVK ENTERPRISE DOMAIN CONTROLLERS S-1-5-9
WIN-S45GUQ5KGVK SELF S-1-5-10
WIN-S45GUQ5KGVK Authenticated Users S-1-5-11
WIN-S45GUQ5KGVK RESTRICTED S-1-5-12
WIN-S45GUQ5KGVK TERMINAL SERVER USER S-1-5-13
WIN-S45GUQ5KGVK REMOTE INTERACTIVE LOGON S-1-5-14
WIN-S45GUQ5KGVK IUSR S-1-5-17
WIN-S45GUQ5KGVK LOCAL SERVICE S-1-5-19
WIN-S45GUQ5KGVK NETWORK SERVICE S-1-5-20
WIN-S45GUQ5KGVK BUILTIN S-1-5-32
WIN-S45GUQ5KGVK Administrator S-1-5-21-2676972102-3618304068-1989523545-500
WIN-S45GUQ5KGVK Guest S-1-5-21-2676972102-3618304068-1989523545-501
WIN-S45GUQ5KGVK OJ S-1-5-21-2676972102-3618304068-1989523545-1000

Total objects: 42
```