admin/oiweiwei-wmiq

Fork 0

mirror of https://github.com/oiweiwei/wmiq synced 2026-06-06 16:24:34 +00:00

Files

T

oiweiwei 7bb95038ac initial commit

2025-08-07 16:14:25 +02:00

12 KiB

Raw Permalink Blame History

wmiq

A command-line tool for querying Windows Management Instrumentation (WMI) remotely over the network using the DCOM protocol. Built with Go and leveraging the power of RedTeamPentesting/adauth for authentication and oiweiwei/go-msrpc for Microsoft RPC communication.

Features

Remote WMI Queries: Execute WQL (WMI Query Language) queries against remote Windows systems
Multiple Authentication Methods: Support for username/password, Kerberos, and NT hashes
Flexible Transport: Choose between TCP/IP or named pipes (SMB) transport
Output Formats: JSON and YAML output support
Performance Optimizations: Configurable page size, result limiting, and forward-only enumeration
Proxy Support: SOCKS5 proxy support for network routing
Debug Mode: Detailed debugging output for troubleshooting

Installation

From Source

git clone https://github.com/oiweiwei/wmiq.git
cd wmiq
go build -o wmiq wmiq.go

Pre-built Binary

Check the releases page for pre-compiled binaries.

Usage

Basic Syntax

wmiq [options] <target> <query>

Parameters

$ wmiq -h
Usage of wmiq:
      --aes-key hex key       Kerberos AES hex key
      --ccache file           Kerberos CCache file name (defaults to $KRB5CCNAME, currently unset)
      --dc string             Domain controller
      --debug                 Enable debug output
      --forward-only          Use forward-only enumeration
  -k, --kerberos              Use Kerberos authentication
      --limit int             Limit the number of results
      --named-pipe            Use named pipe (SMB) as transport
  -n, --namespace string      WMI namespace (resource) (default "root/cimv2")
      --no-seal               Disable sealing of DCERPC messages
  -H, --nt-hash hash          NT hash ('NT', ':NT' or 'LM:NT')
  -o, --output string         Output format (json, yaml) (default "json")
      --page int              Page size for enumeration (default 100)
  -p, --password string       Password
      --pfx file              Client certificate and private key as PFX file
      --pfx-password string   Password for PFX file
      --prototype             Return prototype
      --socks string          SOCKS5 proxy server
      --timeout duration      Timeout for the operation (default 30s)
  -u, --user user@domain      Username ('user@domain', 'domain\user', 'domain/user' or 'user')

Examples

Basic Process Query

Query running processes on a remote system:

wmiq dc01.msad.local -u username -p password "SELECT * FROM Win32_Process" -o json --limit 1

Output:

{
  "CSCreationClassName": "Win32_ComputerSystem",
  "CSName": "DC01",
  "Caption": "System Idle Process",
  "CommandLine": null,
  "CreationClassName": "Win32_Process",
  "CreationDate": "20250806185811.003650-240",
  "Description": "System Idle Process",
  "Handle": "0",
  "HandleCount": 0,
  "KernelModeTime": 38191718750,
  "Name": "System Idle Process",
  "OSCreationClassName": "Win32_OperatingSystem",
  "OSName": "Microsoft Windows Server 2019 Datacenter Evaluation|C:\\Windows|\\Device\\Harddisk0\\Partition2",
  "OtherOperationCount": 0,
  "OtherTransferCount": 0,
  "PageFaults": 8,
  "PageFileUsage": 56,
  "ParentProcessId": 0,
  "PeakPageFileUsage": 56,
  "PeakVirtualSize": 8192,
  "PeakWorkingSetSize": 12,
  "Priority": 0,
  "PrivatePageCount": 57344,
  "ProcessId": 0,
  "QuotaNonPagedPoolUsage": 1,
  "QuotaPagedPoolUsage": 0,
  "QuotaPeakNonPagedPoolUsage": 1,
  "QuotaPeakPagedPoolUsage": 0,
  "ReadOperationCount": 0,
  "ReadTransferCount": 0,
  "SessionId": 0,
  "ThreadCount": 2,
  "UserModeTime": 0,
  "VirtualSize": 8192,
  "WindowsVersion": "10.0.17763",
  "WorkingSetSize": 8192,
  "WriteOperationCount": 0,
  "WriteTransferCount": 0
}

System Information Query

Get operating system information:

wmiq 192.168.1.100 -u domain\\administrator -p password123 "SELECT * FROM Win32_OperatingSystem"

Service Query with YAML Output

List all services in YAML format:

wmiq server.domain.com -u user@domain.com -p mypassword "SELECT Name, State, StartMode FROM Win32_Service" -o yaml --limit 5

Using NT Hash Authentication

Authenticate using NT hash:

wmiq target.domain.com -u administrator -H aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76 "SELECT * FROM Win32_LogicalDisk"

Kerberos Authentication

Using Kerberos with a ccache file:

wmiq dc.domain.com -k --ccache /tmp/krb5cc_1000 "SELECT * FROM Win32_ComputerSystem"

Named Pipe Transport

Use SMB named pipes instead of TCP:

wmiq target.domain.com -u user -p password --named-pipe "SELECT * FROM Win32_Process WHERE Name='explorer.exe'"

Through SOCKS5 Proxy

Route traffic through a SOCKS5 proxy:

wmiq target.internal --socks 127.0.0.1:1080 -u domain\\user -p password "SELECT * FROM Win32_NetworkAdapter"

Performance Optimization

For large result sets, use forward-only enumeration and custom page size:

wmiq server.com -u user -p pass "SELECT * FROM Win32_Process" --forward-only --page 50 --limit 100

Common WMI Classes

Here are some useful WMI classes you can query:

Win32_Process - Running processes
Win32_Service - Windows services
Win32_OperatingSystem - OS information
Win32_ComputerSystem - Computer hardware info
Win32_LogicalDisk - Disk drives and storage
Win32_NetworkAdapter - Network adapters
Win32_UserAccount - User accounts
Win32_Group - Security groups
Win32_StartupCommand - Startup programs
Win32_ScheduledJob - Scheduled tasks
Win32_Share - Network shares
Win32_EventLogFile - Event logs

WQL Query Examples

Filter by Process Name

SELECT * FROM Win32_Process WHERE Name = 'notepad.exe'

Get Specific Properties

SELECT Name, ProcessId, CommandLine FROM Win32_Process

Services with Specific State

SELECT * FROM Win32_Service WHERE State = 'Running'

Disk Space Information

SELECT DeviceID, Size, FreeSpace FROM Win32_LogicalDisk WHERE DriveType = 3

WMI Namespaces

WMI organizes classes into hierarchical namespaces. The default namespace is root/cimv2, but you can specify different namespaces using the -n or --namespace parameter.

Common WMI Namespaces

root/cimv2 (default) - Standard CIM classes for system information
- Win32_Process, Win32_Service, Win32_OperatingSystem, etc.
root/wmi - Windows-specific WMI providers
- Hardware monitoring, performance counters
root/directory/ldap - Active Directory information
- AD users, groups, organizational units
root/microsoftiisv2 - Internet Information Services (IIS)
- Web sites, application pools, virtual directories
root/ccm - System Center Configuration Manager
- SCCM client information and policies
root/securitycenter - Windows Security Center
- Antivirus, firewall, and security product information
root/subscription - Event subscriptions
- WMI event consumers and filters

Using Different Namespaces

Query Active Directory information:

wmiq dc.domain.com -u user -p pass -n "root/directory/ldap" "SELECT * FROM ds_user"

Query IIS configuration:

wmiq webserver.domain.com -u admin -p pass -n "root/microsoftiisv2" "SELECT * FROM IIsWebServer"

Query security center information:

wmiq target.com -u user -p pass -n "root/securitycenter" "SELECT * FROM AntiVirusProduct"

Query WMI performance data:

wmiq server.com -u user -p pass -n "root/wmi" "SELECT * FROM MSAcpi_ThermalZoneTemperature"

Discovering Available Classes in a Namespace

To see what classes are available in a specific namespace, you can query the meta-classes:

wmiq target.com -u user -p pass -n "root/cimv2" "SELECT * FROM meta_class WHERE __class LIKE 'Win32_%DNS'"

Authentication Methods

Username/Password

-u username -p password
-u domain\\username -p password
-u username@domain.com -p password

NT Hash

-u username -H ntlmhash
-u username -H lmhash:ntlmhash

Kerberos Authentication

Using Kerberos with a ccache file:

wmiq dc.domain.com -k --ccache /tmp/krb5cc_1000 "SELECT * FROM Win32_ComputerSystem"

Creating a Kerberos ccache file in Linux

First, obtain a Kerberos ticket using kinit:

# Authenticate with domain user and specify ccache file location
kinit -c /tmp/krb5cc_wmiq user@DOMAIN.COM

# Verify ticket was obtained
klist -c /tmp/krb5cc_wmiq

# Alternative: use default location
kinit user@DOMAIN.COM
klist

Then use wmiq with the ccache file:

# Use a specific ccache file
wmiq dc.domain.com -k --ccache /tmp/krb5cc_wmiq "SELECT * FROM Win32_Process" --limit 5

# Or use the default ccache location (wmiq will auto-detect)
wmiq dc.domain.com -k "SELECT * FROM Win32_Process" --limit 5

Example complete workflow:

# Obtain Kerberos ticket with specific ccache file
kinit -c /tmp/krb5cc_wmiq administrator@CONTOSO.COM
# Password: ********

# Verify ticket
klist -c /tmp/krb5cc_wmiq
# Ticket cache: FILE:/tmp/krb5cc_wmiq
# Default principal: administrator@CONTOSO.COM

# Query WMI using Kerberos authentication
wmiq dc01.contoso.com -k --ccache /tmp/krb5cc_wmiq "SELECT Name, State FROM Win32_Service WHERE State='Running'" --limit 3

Using AES Key with Kerberos

If you have an AES key instead of a password, you can use it directly:

# Using AES-256 key (hex format)
wmiq dc01.contoso.com -k --aes-key a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456 "SELECT * FROM Win32_Process" --limit 5

# Combined with ccache file
wmiq dc01.contoso.com -k --ccache /tmp/krb5cc_wmiq --aes-key a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456 "SELECT * FROM Win32_ComputerSystem"

Troubleshooting

Enable Debug Output

Use the --debug flag to see detailed protocol communication:

wmiq target.com -u user -p pass "SELECT * FROM Win32_Process" --debug

Common Issues

Access Denied: Ensure the user has WMI query permissions on the target system
Authentication Failures: Verify credentials and try different authentication methods
Large Result Sets: Use --limit and --page parameters to manage memory usage

Dependencies

RedTeamPentesting/adauth - Active Directory authentication
oiweiwei/go-msrpc - Microsoft RPC protocol implementation

License

This project is licensed under the terms specified in the LICENSE file.

Contributing

Contributions are welcome! Please feel free to submit issues and pull requests.

Security Considerations

This tool can be used for legitimate system administration and security testing
Always ensure you have proper authorization before querying remote systems
Be mindful of credentials and use secure authentication methods when possible
Consider using SOCKS5 proxies in sensitive network environments

Useful Resources

WQL Reference and Documentation

WQL (SQL for WMI) Reference - Official Microsoft WQL documentation
WMI Classes Reference - Complete list of Win32 WMI classes
WQL Operators - WHERE clause operators and syntax
WMI Query Language by Example - Practical WQL examples and syntax guide

12 KiB Raw Permalink Blame History

wmiq

Features

Installation

From Source

Pre-built Binary

Usage

Basic Syntax

Parameters

Examples

Basic Process Query

System Information Query

Service Query with YAML Output

Using NT Hash Authentication

Kerberos Authentication

Named Pipe Transport

Through SOCKS5 Proxy

Performance Optimization

Common WMI Classes

WQL Query Examples

Filter by Process Name

Get Specific Properties

Services with Specific State

Disk Space Information

WMI Namespaces

Common WMI Namespaces

Using Different Namespaces

Discovering Available Classes in a Namespace

Authentication Methods

Username/Password

NT Hash

Kerberos Authentication

Creating a Kerberos ccache file in Linux

Using AES Key with Kerberos

Troubleshooting

Enable Debug Output

Common Issues

Dependencies

License

Contributing

Security Considerations

Useful Resources

WQL Reference and Documentation

12 KiB

Raw Permalink Blame History