GPEN · Question #427
What is the purpose of the following command? C:\>wmic /node:[target IP] /user:[admin-user] /password:[password] process call create [command]
The correct answer is D. Listing the running processes on a remote windows machine. The wmic process call create command connects to a remote Windows machine via WMI and interacts with the running process list on that system.
Question
What is the purpose of the following command? C:>wmic /node:[target IP] /user:[admin-user] /password:[password] process call create [command]
Options
- ARunning a command on a remote Windows machine
- BCreating a service on a remote Windows machine
- CCreating an admin account on a remote Windows machine
- DListing the running processes on a remote windows machine
How the community answered
(25 responses)- A4% (1)
- B12% (3)
- C8% (2)
- D76% (19)
Why each option
The wmic process call create command connects to a remote Windows machine via WMI and interacts with the running process list on that system.
Running an arbitrary command on a remote machine is more precisely accomplished with tools like PsExec or remote scheduled tasks rather than through the WMI process call create method.
Creating a remote service requires the 'wmic service' subcommand or sc.exe, not the 'process call create' syntax used here.
Creating a remote admin account requires 'wmic useraccount' manipulation or 'net user /add' commands, not the process call create method.
The wmic command with /node, /user, and /password establishes a WMI connection to the specified remote Windows host, and the 'process call create' syntax invokes the Win32_Process class to interact with and enumerate the processes running on that remote system. This allows an attacker or administrator to query and manage the remote process space.
Concept tested: WMIC remote Windows process management via WMI
Source: https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process
Topics
Community Discussion
No community discussion yet for this question.