nerdexam
GIAC

GPEN · Question #427

What is the purpose of the following command? C:\>wmic /node:[target IP] /user:[admin-user] /password:[password] process call create [command]

The correct answer is D. Listing the running processes on a remote windows machine. The wmic process call create command connects to a remote Windows machine via WMI and interacts with the running process list on that system.

Exploitation & Post-Exploitation Techniques

Question

What is the purpose of the following command? C:>wmic /node:[target IP] /user:[admin-user] /password:[password] process call create [command]

Options

  • ARunning a command on a remote Windows machine
  • BCreating a service on a remote Windows machine
  • CCreating an admin account on a remote Windows machine
  • DListing the running processes on a remote windows machine

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    12% (3)
  • C
    8% (2)
  • D
    76% (19)

Why each option

The wmic process call create command connects to a remote Windows machine via WMI and interacts with the running process list on that system.

ARunning a command on a remote Windows machine

Running an arbitrary command on a remote machine is more precisely accomplished with tools like PsExec or remote scheduled tasks rather than through the WMI process call create method.

BCreating a service on a remote Windows machine

Creating a remote service requires the 'wmic service' subcommand or sc.exe, not the 'process call create' syntax used here.

CCreating an admin account on a remote Windows machine

Creating a remote admin account requires 'wmic useraccount' manipulation or 'net user /add' commands, not the process call create method.

DListing the running processes on a remote windows machineCorrect

The wmic command with /node, /user, and /password establishes a WMI connection to the specified remote Windows host, and the 'process call create' syntax invokes the Win32_Process class to interact with and enumerate the processes running on that remote system. This allows an attacker or administrator to query and manage the remote process space.

Concept tested: WMIC remote Windows process management via WMI

Source: https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process

Topics

#WMIC#remote command execution#lateral movement#Windows management

Community Discussion

No community discussion yet for this question.

Full GPEN Practice