A Provider for the MOFia - Distributed Post Ex Capabilities

The talk starts from a narrow view of offensive WMI. Most activity centers on Win32_Process Create and event subscriptions, and defenders already watch both closely. The speaker argues that WMI's provider architecture is largely unexplored and presents it as a way to run post-exploitation work from inside the WMI host process.

The central technique is installing a WMI provider on a remote machine without staging files over SMB or WinRM. The speaker reimplemented the parts of mofcomp that parse MOF files and register providers, then serialized the objects in the MS-WMIO binary format and sent them over DCOM. Because WMI has no native file transfer, the talk describes using Desired State Configuration classes to write files and an existing PowerShell v3 class to read them. It also explains that the hosting model sets the privilege a provider runs with, and that removal must follow a fixed order to avoid leaving artifacts in the WMI database.

The speaker released two tools: a WMI-only client for file and process operations, and a provider installer that deploys modules for assembly and BOF execution, token and Kerberos work, and browser cookie access. Demonstrations covered installing and removing providers. Detection ideas include event ID 63 for system-level hosting models, registry writes made through standard RegProv, DSC logging, PowerShell script block logging, and unsigned DLLs in the WBEM directory.