PSEXEC

• The classic: Use SMB to upload file and RPC to remotely interact with service manager to create new service and run it
• C# example

SMBEXEC

• PSEXEC, but service binpath points to cmd.exe and runs /c to run a batch script containing the command we want to run

COM ( WMI, Scheduled Tasks )

• Windows Management Instrumentation - “infrastructure for management data and operations on Windows-based operating systems […] WMI also supplies management data to other parts of the operating system and products. For example, System Center Operations Manager or Windows Remote Management.”
  • Interesting Classes
    • Win32_Process
    • Win32_Service
    • Win32_ScheduledJob
• Component Object Model - “COM is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. […] [COM] objects can be within a single process, in other processes, even on remote computers”
• WMI is based on COM - in code, we utilize COM to interface with WMI protocols.

• Run a process directly
  • CLI: wmic /node:<remote IP/Hostname> process call create "<command>"
  • C Example
• Scheduled Tasks

  • Create a scheduled task on the current or remote machine to run something. Uses COM under the hood

    • Can be from SMB Share
    • Or a DLL Hijackable executable

  • CLI

    # Replace /RU with /U "user" /P "password" if we want specific context 
    schtasks /s <hostname/IP> /RU "SYSTEM" /create /tn "<task name>" /tr "<command/payload to execute>" /sc ONCE /sd 01/01/1970 /st 00:00
    schtasks /s <hostname/IP> /run /TN "<task name>"
    schtasks /S <hostname/IP> /TN "<task name>" /DELETE /F
    schtasks /S <hostname/IP> /TN "<task name>" /DELETE /F
    

  • ATExec Implements this

DCOM

DLL Hijacks