This slide deck was presented at BlackHat USA 2019 Arsenal and is titled WMImplant: An Offensive Use Case of WMI. This covers how WMImplant weaponizes WMI.

2. WMImplant: An Offensive Use Case of WMI
@ChrisTruncer

3. • WMImplant is a PowerShell-based post-exploitation tool designed
to attack systems leveraging Application Whitelisting
• Specifically Device Guard/Windows Defender Application Control
• It utilizes a “living off the land” approach to compromise and take
action against protected systems
• WMImplant leverages WMI for all stages of an attack
• The means to trigger an action (run a command)
• The C2 channel
• Data storage
• Why?

4. • Windows Defender Application Control/Device Guard enforce
application whitelisting rules on a system
• Just like any app whitelisting software
• So how can you attack it?
• Develop an application whitelisting bypass
• Regsvr32
• MSBuild
• InstallUtil
• These are incredibly effective
• But they cost time and research == MONEY

5. • The other method to attack is to live off the land
• What is likely allowed to run on an app whitelisting protected
system?
• Most Microsoft applications (signed)
• Most default services
• PowerShell
• Is it possible to leverage these?

6. • WMI == Windows
Management Instrumentation
• A service installed and enabled
by default since Windows
2000
• Enables
attackersadministrators to
admin systems
• Get free disk space
• Start processes
• Etc. https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-
Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf

7. • WMI is easily weaponized by
attackers to run programs
• But it has a “blind process
creation” problem
• We can run programs
• But we can’t get any output!
• Let’s try to solve this issue
https://community.spiceworks.com/how_to/127139-run-a-command-on-a-remote-computer

8. • Within your Windows system is a specific WMI class
(Win32_OSRecoveryConfiguration)
• The DebugFilePath property is a writeable property which instructs
Windows where to create a memory dump
• There is no validation performed on the property value

10. • There also isn’t a file size restriction

12. • By having an area to store data,
we can solve the process
output creation problem
• Store data within the WMI
property!
• When weaponized, we can also
remotely run PowerShell
Script, and get their output, all
in memory!
https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-
Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf

14. • More information can be found at the Github Repo, along with a
Wiki containing a large amount of documentation!
• https://github.com/FortyNorthSecurity/WMImplant
• https://github.com/FortyNorthSecurity/WMImplant/wiki
• @ChrisTruncer