Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf
To do it,I have to get the DLL symbol file.
But I can't locate the IWbemServices::ExecQuery method in any DLL.
Is there any idea to detect wmi query string like select * from win32_operatingsystem
only using API monitoring?
I am Not sure what you are looking for if you execute in say wmic
C:\WINDOWS\system32>wmic os get Name
you get back
Name
Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition4
this is executed with your select *from sql or wql query
here is a call stack and relevent info
broken at
0:000> rM0
WMIC!CExecEngine::ProcessSHOWInfo:
00007ff7`a6fc5590 4053 push rbx
call stack
0:000> kP
Child-SP RetAddr Call Site
0000008c`90c9f6a8 00007ff7`a6fc2ffe WMIC!CExecEngine::ProcessSHOWInfo
0000008c`90c9f6b0 00007ff7`a6fe9141 WMIC!CExecEngine::ExecuteCommand+0x1ae
0000008c`90c9f750 00007ff7`a6fe8060 WMIC!CWMICommandLine::ProcessCommandAndDisplayResults+0x5f5
0000008c`90c9f910 00007ff7`a6feee6d WMIC!wmain+0x934
0000008c`90c9fb20 00007ff8`96f07c24 WMIC!__wmainCRTStartup+0x14d
0000008c`90c9fb60 00007ff8`986cd721 KERNEL32!BaseThreadInitThunk+0x14
0000008c`90c9fb90 00000000`00000000 ntdll!RtlUserThreadStart+0x21
script dumping arg1@rcx *rcx **rcx,arg2 @rdx....,arg3@r8....,arg4@r9...
0:000> $$>a< "xxxxx\arg64.wds"
rcx=00007ff7a70198e0
========= @rcx
00007ff7`a70198e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
00007ff7`a70198f0 e0 2d 88 07 f5 01 00 00-00 00 00 00 00 00 00 00 .-..............
========= *@rcx
00000000`00000000 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
00000000`00000010 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
rdx=00007ff7a70199e8
========= @rdx
00007ff7`a70199e8 c0 e4 a8 07 f5 01 00 00-60 e5 a8 07 f5 01 00 00 ........`.......
00007ff7`a70199f8 20 01 73 09 f5 01 00 00-00 00 00 00 00 00 00 00 .s.............
========= *@rdx
000001f5`07a8e4c0 20 00 6f 00 73 00 20 00-67 00 65 00 74 00 20 00 .o.s. .g.e.t. .
000001f5`07a8e4d0 4e 00 61 00 6d 00 65 00-00 00 ab ab ab ab ab ab N.a.m.e.........
r8=0000000000000001
========= @r8
00000000`00000001 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
00000000`00000011 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
========= *@r8
Memory access error at ') '
r9=0000000000000000
========= @r9
00000000`00000000 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
00000000`00000010 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
========= *@r9
Memory access error at ') '
the second argument contins your sql/ wql query
0:000> dpu @rdx
00007ff7`a70199e8 000001f5`07a8e4c0 " os get Name"
00007ff7`a70199f0 000001f5`07a8e560 "os"
00007ff7`a70199f8 000001f5`09730120 "Installed Operating System/s management. "
00007ff7`a7019a00 00000000`00000000
00007ff7`a7019a08 00000000`00000000
00007ff7`a7019a10 00000000`00000000
00007ff7`a7019a18 000001f5`097300d0 "get"
00007ff7`a7019a20 00000000`00000000
00007ff7`a7019a28 00000000`00000000
00007ff7`a7019a30 00000000`00000000
00007ff7`a7019a38 00000000`00000000
00007ff7`a7019a40 000001f5`07a8ee00 "Select * from Win32_OperatingSystem"
00007ff7`a7019a48 00000000`00000000
00007ff7`a7019a50 00000000`00000001
00007ff7`a7019a58 000001f5`07a81770 "ᝰ.ǵ"
00007ff7`a7019a60 00000000`00000000
0:000>
if you follow further you can see instead of wildcard a specific attribute is queried
0:000> rM0
WMIC!CExecEngine::ObtainXMLResultSet:
00007ff7`a6fc3030 4c8bdc mov r11,rsp
0:000> r rcx,rdx,r8,r9
rcx=00007ff7a70198e0 rdx=00000204437822d8 r8=00007ff7a70199e8 r9=0000003789d3b5b8
0:000> du /c 100 @rdx
00000204`437822d8 "SELECT Name FROM Win32_OperatingSystem"
0:000>
there is a documented example to retrieve data from wmi methods here
compiling it and tracing it you can see the method being resolved in fastprox.dll as below
0:000> dps @rax+0xa0 l1
00007ff8`855846b0 00007ff8`854ec8f0 fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery
0:000> r
rax=00007ff885584610 rbx=00007ff669e67bc8 rcx=00000160178261a0
rdx=00000160178122b8 rsi=0000000000000000 rdi=00000160177e65e0
rip=00007ff669da1638 rsp=00000050a376faf0 rbp=0000000000000000
r8=000001601781fb08 r9=0000000000000030 r10=00000050a376fa20
r11=00000160178122b8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
wbemexec!main+0x448:
00007ff6`69da1638 ff90a0000000 call qword ptr [rax+0A0h] ds:00007ff8`855846b0={fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery (00007ff8`854ec8f0)}
0:000> ?? @rax == @@masm(poi(@rcx))
bool true
0:000> du @rdx
00000160`178122b8 "WQL"
0:000> du @r8
00000160`1781fb08 "SELECT * FROM Win32_OperatingSys"
00000160`1781fb48 "tem"
0:000>
here is the same fastprox::..::execquery being called from wmic command prior to editing of the answer
0:000> rM0
fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery:
00007ff8`854ec8f0 4c8bdc mov r11,rsp
0:000> kp
Child-SP RetAddr Call Site
00000017`37abb518 00007ff7`ce3931c5 fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery
00000017`37abb520 00007ff7`ce395e3d WMIC!CExecEngine::ObtainXMLResultSet+0x195
00000017`37abb760 00007ff7`ce392ffe WMIC!CExecEngine::ProcessSHOWInfo+0x8ad
00000017`37abf960 00007ff7`ce3b9141 WMIC!CExecEngine::ExecuteCommand+0x1ae
00000017`37abfa00 00007ff7`ce3b8060 WMIC!CWMICommandLine::ProcessCommandAndDisplayResults+0x5f5
00000017`37abfbc0 00007ff7`ce3bee6d WMIC!wmain+0x934
00000017`37abfdd0 00007ff8`96f07c24 WMIC!__wmainCRTStartup+0x14d
00000017`37abfe10 00007ff8`986cd721 KERNEL32!BaseThreadInitThunk+0x14
00000017`37abfe40 00000000`00000000 ntdll!RtlUserThreadStart+0x21
0:000> du @rdx; du /c 100 @r8
00000209`96d22868 "WQL"
00000209`96d76d38 "SELECT Name FROM Win32_OperatingSystem"
0:000> dps poi(@rcx)+a0 l1
00007ff8`855846b0 00007ff8`854ec8f0 fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery
0:000>
CoCreateInstance,CoCreateInstanceEx,CoGetClassObjectand similar being called from that binary, look for the CLSID of the interface and use that to get into the flow of data. I think you need to read up on COM first, you seem to have quite some misunderstandings and that's not even RCE at this point.