https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96/Recent content in WMI持久化 on Linux邪修Hugozh© 2024 Linux邪修https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/Mon, 01 Jan 0001 00:00:00 +0000https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/<h2 id="技术介绍">技术介绍<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bb%8b%e7%bb%8d">#</a></h2> <p>WMI（Windows Management Instrumentation）持久化是一种利用Windows管理工具进行持久化攻击的技术。攻击者通过创建WMI事件订阅，在系统启动或特定事件发生时执行恶意代码，从而实现持久化访问。本教程将详细介绍WMI持久化的基础知识、核心概念和技术方法，帮助安全人员理解和防御WMI持久化攻击。</p> <h3 id="wmi持久化核心概念">WMI持久化核心概念<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e6%a0%b8%e5%bf%83%e6%a6%82%e5%bf%b5">#</a></h3> <ul> <li><strong>WMI（Windows Management Instrumentation）</strong>：Windows管理工具，用于管理系统和应用程序</li> <li><strong>WMI持久化（WMI Persistence）</strong>：利用WMI进行持久化攻击的技术</li> <li><strong>WMI事件订阅（WMI Event Subscription）</strong>：WMI事件订阅机制</li> <li><strong>WMI事件消费者（WMI Event Consumer）</strong>：WMI事件消费者</li> <li><strong>WMI事件过滤器（WMI Event Filter）</strong>：WMI事件过滤器</li> <li><strong>WMI事件绑定（WMI Event Binding）</strong>：WMI事件绑定</li> <li><strong>WMI提供程序（WMI Provider）</strong>：WMI提供程序</li> <li><strong>WMI类（WMI Class）</strong>：WMI类</li> <li><strong>WMI命名空间（WMI Namespace）</strong>：WMI命名空间</li> <li><strong>WMI查询（WMI Query）</strong>：WMI查询语言（WQL）</li> <li><strong>WMI脚本（WMI Script）</strong>：WMI脚本</li> <li><strong>WMI PowerShell</strong>：使用PowerShell操作WMI</li> <li><strong>持久化（Persistence）</strong>：在系统中保持长期访问的技术</li> </ul> <h3 id="wmi持久化的特点">WMI持久化的特点<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e7%9a%84%e7%89%b9%e7%82%b9">#</a></h3> <ul> <li><strong>隐蔽性</strong>：WMI持久化攻击隐蔽性强</li> <li><strong>持久性</strong>：WMI持久化可以实现持久化访问</li> <li><strong>灵活性</strong>：WMI持久化技术灵活多样</li> <li><strong>依赖性</strong>：WMI持久化依赖WMI服务</li> <li><strong>检测难度</strong>：WMI持久化检测难度较大</li> <li><strong>影响范围</strong>：WMI持久化影响范围广</li> </ul> <h3 id="wmi持久化的重要性">WMI持久化的重要性<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e7%9a%84%e9%87%8d%e8%a6%81%e6%80%a7">#</a></h3> <ul> <li><strong>攻击检测</strong>：检测WMI持久化攻击</li> <li><strong>系统加固</strong>：加固系统防止WMI持久化</li> <li><strong>安全防护</strong>：防护WMI持久化攻击</li> <li><strong>合规性</strong>：满足合规性要求</li> <li><strong>风险降低</strong>：降低安全风险</li> <li><strong>业务保护</strong>：保护业务连续性</li> </ul> <h2 id="技术体系">技术体系<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bd%93%e7%b3%bb">#</a></h2> <p>WMI持久化技术体系主要包括以下几个方面：</p> <h3 id="wmi持久化原理">WMI持久化原理<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e5%8e%9f%e7%90%86">#</a></h3> <ul> <li><strong>WMI架构</strong>：WMI的架构和组件</li> <li><strong>WMI事件订阅机制</strong>：WMI事件订阅的工作机制</li> <li><strong>WMI事件消费者</strong>：WMI事件消费者的类型和功能</li> <li><strong>WMI事件过滤器</strong>：WMI事件过滤器的类型和功能</li> <li><strong>WMI事件绑定</strong>：WMI事件绑定的过程</li> </ul> <h3 id="wmi持久化技术">WMI持久化技术<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e6%8a%80%e6%9c%af">#</a></h3> <ul> <li><strong>WMI事件订阅持久化</strong>：通过WMI事件订阅实现持久化</li> <li><strong>WMI脚本持久化</strong>：通过WMI脚本实现持久化</li> <li><strong>WMI PowerShell持久化</strong>：通过PowerShell和WMI实现持久化</li> <li><strong>WMI提供程序持久化</strong>：通过WMI提供程序实现持久化</li> <li><strong>WMI类持久化</strong>：通过WMI类实现持久化</li> </ul> <h3 id="wmi持久化防御">WMI持久化防御<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e9%98%b2%e5%be%a1">#</a></h3> <ul> <li><strong>WMI事件订阅监控</strong>：监控WMI事件订阅</li> <li><strong>WMI事件消费者监控</strong>：监控WMI事件消费者</li> <li><strong>WMI事件过滤器监控</strong>：监控WMI事件过滤器</li> <li><strong>WMI权限管理</strong>：管理WMI权限</li> <li><strong>WMI服务加固</strong>：加固WMI服务</li> </ul> <h2 id="工具使用">工具使用<a class="anchor" href="#%e5%b7%a5%e5%85%b7%e4%bd%bf%e7%94%a8">#</a></h2> <h3 id="wmi持久化检测工具">WMI持久化检测工具<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e6%a3%80%e6%b5%8b%e5%b7%a5%e5%85%b7">#</a></h3> <ol> <li> <p><strong>PowerShell脚本</strong>：</p>https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96%E6%8A%80%E6%9C%AF%E8%AF%A6%E8%A7%A3/Mon, 01 Jan 0001 00:00:00 +0000https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96/WMI%E6%8C%81%E4%B9%85%E5%8C%96%E6%8A%80%E6%9C%AF%E8%AF%A6%E8%A7%A3/<h1 id="wmi持久化技术详解">WMI持久化技术详解<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e6%8a%80%e6%9c%af%e8%af%a6%e8%a7%a3">#</a></h1> <h2 id="技术介绍">技术介绍<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bb%8b%e7%bb%8d">#</a></h2> <p>WMI（Windows Management Instrumentation）持久化是一种高级的持久化技术，攻击者通过在WMI（Windows管理规范）中创建事件订阅、类或命名空间，实现恶意代码的持久执行。这种技术利用了WMI的合法功能，具有隐蔽性强、难以检测和清除等特点。本教程将详细介绍WMI持久化的核心概念、技术方法、防御措施和案例分析，帮助安全人员理解和防御这种持久化攻击。</p> <h3 id="wmi持久化核心概念">WMI持久化核心概念<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e6%a0%b8%e5%bf%83%e6%a6%82%e5%bf%b5">#</a></h3> <ul> <li><strong>Windows管理规范（WMI）</strong>：Windows系统中用于管理和监控系统资源的框架</li> <li><strong>WMI命名空间</strong>：WMI对象的逻辑容器，类似于文件系统的目录结构</li> <li><strong>WMI类</strong>：WMI对象的模板，定义了对象的属性和方法</li> <li><strong>WMI实例</strong>：WMI类的具体实现，代表系统中的实际资源</li> <li><strong>WMI事件订阅</strong>：监听系统事件的机制，当事件发生时执行指定的操作</li> <li><strong>WMI事件过滤器</strong>：定义要监听的事件类型和条件</li> <li><strong>WMI事件消费者</strong>：定义事件发生时要执行的操作</li> <li><strong>WMI绑定</strong>：将事件过滤器和事件消费者关联起来，形成完整的事件订阅</li> <li><strong>持久化</strong>：使恶意代码在系统重启后仍然能够执行的技术</li> <li><strong>防御规避</strong>：通过合法的WMI功能，逃避安全软件检测的技术</li> </ul> <h3 id="wmi持久化技术体系">WMI持久化技术体系<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e6%8a%80%e6%9c%af%e4%bd%93%e7%b3%bb">#</a></h3> <ul> <li><strong>事件订阅持久化</strong>：创建WMI事件订阅，当特定事件发生时执行恶意代码</li> <li><strong>类持久化</strong>：创建恶意的WMI类，实现持久化和隐蔽执行</li> <li><strong>命名空间持久化</strong>：创建恶意的WMI命名空间，存储恶意代码和配置</li> <li><strong>永久事件订阅</strong>：创建系统重启后仍然存在的事件订阅</li> <li><strong>临时事件订阅</strong>：创建仅在当前会话有效的事件订阅</li> <li><strong>远程WMI持久化</strong>：通过远程WMI连接，在目标系统上创建持久化</li> </ul> <h3 id="wmi持久化防御技术">WMI持久化防御技术<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e9%98%b2%e5%be%a1%e6%8a%80%e6%9c%af">#</a></h3> <ul> <li><strong>WMI事件监控</strong>：监控WMI事件订阅的创建和修改</li> <li><strong>WMI类审计</strong>：审计WMI类的创建和修改</li> <li><strong>WMI命名空间管理</strong>：管理WMI命名空间，防止未授权修改</li> <li><strong>系统加固</strong>：限制WMI的访问权限，减少攻击面</li> <li><strong>安全工具</strong>：使用专业的安全工具检测和清除WMI持久化</li> </ul> <h2 id="入门级使用">入门级使用<a class="anchor" href="#%e5%85%a5%e9%97%a8%e7%ba%a7%e4%bd%bf%e7%94%a8">#</a></h2> <h3 id="wmi基础">WMI基础<a class="anchor" href="#wmi%e5%9f%ba%e7%a1%80">#</a></h3> <p>了解WMI的基本概念和操作：</p> <div class="highlight"><pre tabindex="0" style="color:#e2e4e5;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#78787e"># 1. WMI命令行工具</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># WMIC（WMI命令行）工具</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看系统信息</span> </span></span><span style="display:flex;"><span>wmic os get caption,version </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看进程信息</span> </span></span><span style="display:flex;"><span>wmic process get name,processid </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看服务信息</span> </span></span><span style="display:flex;"><span>wmic service get name,state </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 2. PowerShell WMI cmdlets</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看系统信息</span> </span></span><span style="display:flex;"><span>Get-WmiObject -Class Win32_OperatingSystem | Select-Object Caption,Version </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看进程信息</span> </span></span><span style="display:flex;"><span>Get-WmiObject -Class Win32_Process | Select-Object Name,ProcessId </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看服务信息</span> </span></span><span style="display:flex;"><span>Get-WmiObject -Class Win32_Service | Select-Object Name,State </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 3. WMI命名空间</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 列出所有WMI命名空间</span> </span></span><span style="display:flex;"><span>Get-WmiObject -Namespace root -Class __Namespace | Select-Object Name </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 4. WMI事件订阅</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看现有的WMI事件订阅</span> </span></span><span style="display:flex;"><span>Get-WmiObject -Namespace root<span style="color:#5af78e">\s</span>ubscription -Class __EventFilter | Select-Object Name,Query </span></span><span style="display:flex;"><span>Get-WmiObject -Namespace root<span style="color:#5af78e">\s</span>ubscription -Class CommandLineEventConsumer | Select-Object Name,CommandLineTemplate </span></span><span style="display:flex;"><span>Get-WmiObject -Namespace root<span style="color:#5af78e">\s</span>ubscription -Class __FilterToConsumerBinding </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 5. WMI安全</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看WMI命名空间的安全设置</span> </span></span><span style="display:flex;"><span>Get-WmiObject -Namespace root -Class __SystemSecurity </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 6. WMI基础最佳实践</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 了解WMI的基本架构和功能</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 熟悉WMI命令行工具和PowerShell cmdlets</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 学习WMI事件订阅的基本概念</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 在隔离环境中练习WMI操作</span></span></span></code></pre></div><h3 id="wmi持久化基础">WMI持久化基础<a class="anchor" href="#wmi%e6%8c%81%e4%b9%85%e5%8c%96%e5%9f%ba%e7%a1%80">#</a></h3> <p>了解WMI持久化的基本技术：</p>