wmic 보안 Wmiprvse.exe 윔퍼트리세 관련 보안

[동우]

https://koromoon.blogspot.com/2018/11/wmic.html

wmic process call create "calc.exe"

"wmic process call create" 명령어는 원격 시스템에서 프로세스를 실행하기 위해 사용되는 WMI 기능 중 하나입니다. 이 기능을 악용하는 공격이 발생할 수 있기 때문에, 보안상의 이유로 이 기능을 제한하거나 비활성화해야 할 수 있습니다.

Windows 레지스트리를 사용하여 "wmic process call create" 기능을 제한하려면 다음과 같은 명령어를 사용할 수 있습니다:

제한: 로컬에서만 "wmic process call create" 실행 가능하도록 제한하기
경로: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
항목: Autorecover Mofs
값: 0
비활성화: "wmic process call create" 기능 비활성화하기
경로: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
항목: LocalAccountTokenFilterPolicy
값: 1
위의 레지스트리 항목을 설정하면 원격에서 "wmic process call create" 명령어를 사용하여 로컬 시스템에서 프로세스를 실행할 수 없게 됩니다. 이러한 설정은 시스템 보안을 높이는 데 도움이 됩니다. 단, 이러한 설정은 시스템 관리 작업을 제한할 수 있으므로 사용 전에 잘 검토해야 합니다.

---

REM "게스트 해킹 explorer.exe"
icacls "%windir%\explorer.exe" 
takeown /F "%windir%\explorer.exe" /A
icacls "%windir%\explorer.exe" /save d:\explorer.txt
icacls "%windir%\explorer.exe" /grant Administrators:F
icacls "%windir%\explorer.exe" /setintegritylevel H
icacls "%windir%\explorer.exe" /deny "NETWORK SERVICE":(F) "GUEST":(F) "IIS_IUSRS":(F) "REMOTE INTERACTIVE LOGON":(F) "*S-1-5-32-546:F" "*S-1-0-0:F" "*S-1-5-7:F" "*S-1-5-13:F"
icacls "%windir%\explorer.exe" /setowner "NT SERVICE\TrustedInstaller" 
icacls "%windir%\explorer.exe" /grant:r Administrators:RX
icacls "%windir%\explorer.exe" 

REM "복구 할때"
REM icacls /reset "%windir%\explorer.exe" 
REM icacls %windir%\System32\ d:\explorer.txt

---

icacls "%windir%\System32\wbem\WmiPrvSE.exe" 
takeown /F "%windir%\System32\wbem\WmiPrvSE.exe" /A
icacls "%windir%\System32\wbem\WmiPrvSE.exe" /save d:\WmiPrvSE.exe.txt
icacls "%windir%\System32\wbem\WmiPrvSE.exe" /grant Administrators:F
REM icacls "%windir%\System32\wbem\WmiPrvSE.exe" /setintegritylevel H
icacls "%windir%\System32\wbem\WmiPrvSE.exe" /deny "NETWORK SERVICE":(F) "GUEST":(F) "IIS_IUSRS":(F) "REMOTE INTERACTIVE LOGON":(F) "*S-1-5-32-546:F" "*S-1-5-13:F"
icacls "%windir%\System32\wbem\WmiPrvSE.exe" /setowner "NT SERVICE\TrustedInstaller" 
icacls "%windir%\System32\wbem\WmiPrvSE.exe" /grant:r Administrators:RX
icacls "%windir%\System32\wbem\WmiPrvSE.exe" 

REM "복구 할때"
REM icacls /reset "%windir%\System32\wbem\WmiPrvSE.exe" 
REM icacls %windir%\System32\wbem\ d:\WmiPrvSE.exe.txt

---

좀 이건 무리가 있고

REM "수상한 wicmin"
icacls "%windir%\System32\wbem" 
takeown /F "%windir%\System32\wbem" /A /r
icacls "%windir%\System32\wbem" /grant Administrators:F /t 

icacls "%windir%\System32\wbem" /reset /t 

takeown /F "%windir%\System32\wbem" /A /r
icacls "%windir%\System32\wbem" /grant Administrators:F /t
icacls "%windir%\System32\wbem" /save d:\wbem.txt /t
icacls "%windir%\System32\wbem" /remove "NT AUTHORITY\NETWORK SERVICE" /T
REM icacls "%windir%\System32\wbem" /setintegritylevel H /t
icacls "%windir%\System32\wbem" /deny "GUEST":(F) "IIS_IUSRS":(F) "REMOTE INTERACTIVE LOGON":(F) "*S-1-5-32-546:F" "*S-1-0-0:F" "*S-1-5-7:F" "*S-1-5-13:F" /t 
icacls "%windir%\System32\wbem" /setowner "NT SERVICE\TrustedInstaller" /t 
icacls "%windir%\System32\wbem" /grant:r Administrators:RX /t 
icacls "%windir%\System32\wbem" 

icacls "%windir%\System32\wbem" /deny "*S-1-5-13":F"
REM 터미널 사용자 서버 "*S-1-5-13":F 

REM "복구 할때"
REM icacls "%windir%\System32\wbem" /reset /t
REM icacls %windir%\System32\ d:\wbem.txt

---

게스트가.. 해킹 한다 -_- 헐 

Set the default process security level with VBScript‎를 나는 보고 있습니다
WbemAuthenticationLevelPktPrivacy 6
wbemImpersonationLevelAnonymous 1
다음 값을 reg add.. 명령어로 설정을 추가 할수 있나요?

REM "https://learn.microsoft.com/en-us/windows/win32/wmisdk/setting-the-default-process-security-level-using-vbscript‎"
REM "VBScript‎로 기본 프로세스 보안 수준 설정"
REM "WbemAuthenticationLevelPktPrivacy=6, wbemImpersonationLevelAnonymous=1"

REM "익명성 차단 Wmiprvse.exe"
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM /v "Default Impersonation Level" /t REG_DWORD /d 1 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM /v AuthenticationLevel /t REG_DWORD /d 6 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM /v ImpersonationLevel /t REG_DWORD /d 1 /f

---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting
Default Impersonation Level 기본값 3 으로 되어 있습니다.

Default Impersonation Level 레지스트리 값의 숫자 값에 따른 의미는 다음과 같습니다.

AI가 미친놈이라 ㅋㅋ 이상하게 알려 주어 다시 정리 한다. 1이 익명성 차단임

https://learn.microsoft.com/en-us/windows/win32/wmisdk/setting-the-default-process-security-level-using-vbscript‎    

AI가 미쳐서 1이 익명성 허용이라고 구라까고 있었음 ㅎㅎㅎb 무서운 녀석 해커 보다 너가 무섭다 ㅋ

wbemImpersonationLevelAnonymous
1
Moniker: Anonymous
Hides the credentials of the caller. Calls to WMI may fail with this impersonation level.
wbemImpersonationLevelIdentify
2
Moniker: Identify
Allows objects to query the credentials of the caller. Calls to WMI may fail with this impersonation level.
wbemImpersonationLevelImpersonate
3
Moniker: Impersonate
Allows objects to use the credentials of the caller. This is the recommended impersonation level for Scripting API for WMI calls.
wbemImpersonationLevelDelegate
4
Moniker: Delegate
Allows objects to permit other objects to use the credentials of the caller. This impersonation will work with Scripting API for WMI calls but may constitute an unnecessary security risk.

---

REM 이번에는 날 안 죽이겠지? ㅋㅋ 영어로 보여 주었는대 아무튼 6이라고 하는 
가장 보안이 좋은 것은 WbemAuthenticationLevelPktPrivacy (6)입니다. 이 설정은 이전 인증 수준을 모두 인증하고 각 원격 프로시저 호출의 인수 값을 암호화합니다. 이 설정은 연결되는 네임스페이스가 암호화 연결을 필요로 할 때 사용하는 것이 좋습니다. 그러나, 외부에서 원격 연결을 하지 않으며, 서버도 사용하지 않으므로, 이 설정은 필요하지 않을 수 있습니다. WbemAuthenticationLevelNone (1) 설정을 사용하면 완전한 인증 없이 WMI에 액세스할 수 있습니다.

---

6.txt

1.66KB

REM "https://cafe.daum.net/candan/BLQD/97 지저분한 자격증명 인증 관련 보안 해보기"

REM "게스트 해커가 접근 하려는 거 차단 해보는"
REM "WMI 해킹 차단 관련"

setx /m __PSLockDownPolicy 0

setx /m __PSLockDownPolicy 4


$acl = Get-Acl "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders"

$rule1 = New-Object System.Security.AccessControl.RegistryAccessRule(
"ANONYMOUS LOGON", "FullControl", "ContainerInherit,ObjectInherit", "None", "Deny")

$rule2 = New-Object System.Security.AccessControl.RegistryAccessRule(
"GUEST", "FullControl", "ContainerInherit,ObjectInherit", "None", "Deny")

$rule3 = New-Object System.Security.AccessControl.RegistryAccessRule(
"IIS_IUSRS", "FullControl", "ContainerInherit,ObjectInherit", "None", "Deny")

$rule4 = New-Object System.Security.AccessControl.RegistryAccessRule(
"REMOTE INTERACTIVE LOGON", "FullControl", "ContainerInherit,ObjectInherit", "None", "Deny")

$rule5 = New-Object System.Security.AccessControl.RegistryAccessRule(
"Remote Management Users", "FullControl", "ContainerInherit,ObjectInherit", "None", "Deny")

$rule6 = New-Object System.Security.AccessControl.RegistryAccessRule(
"GUESTS", "FullControl", "ContainerInherit,ObjectInherit", "None", "Deny")

$rule7 = New-Object System.Security.AccessControl.RegistryAccessRule(
"TERMINAL SERVER USER", "FullControl", "ContainerInherit,ObjectInherit", "None", "Deny")

$acl.SetAccessRule($rule1)
$acl.SetAccessRule($rule2)
$acl.SetAccessRule($rule3)
$acl.SetAccessRule($rule4)
$acl.SetAccessRule($rule5)
$acl.SetAccessRule($rule6)
$acl.SetAccessRule($rule7)

$acl | Set-Acl -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders"

---

REM "레지스트키 권한 거부 등록 하기 게스트."
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders" /v NetworkIncludesAuthenticatedUsers /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders" /v EveryoneIncludesAnonymous /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders" /v GuestAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders" /v GuestsAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders" /v IIS_IUSRSAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders" /v RemoteInteractiveLogonAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders" /v RemoteManagementUsersAccess /t REG_DWORD /d 0 /f

---

8.txt

1.06KB

3.txt

723B

[동우]

https://docs.symphonysummitai.com/display/TAHSP1/Windows+Servers+discovery+and+WMI+User+Access

[동우]

https://www.sysnet.pe.kr/2/0/11957

[동우]

wmic /namespace:\\root\cimv2 path Win32_LogicalFileSecuritySetting TakeOwnershipOfWin32_ACE /action:append /user:"DOMAIN\administrators" /rights:"GenericExecute,GenericRead,GenericWrite" /InheritanceFlags:"ContainerInherit,ObjectInherit" /PropagationFlags:"InheritOnly" /accounttype:"DomainUser"

[동우]

https://gonsystem.blogspot.com/2016/02/monitorizacion-nagios-y-wmi-anadir.html

[동우]

Get-WmiObject -Namespace root -Class __Namespace > d:txt.txt
https://0xinfection.github.io/posts/wmi-classes-methods-part-2/

[동우]

wbemtest
https://k1asd1.tistory.com/9