2

I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf

To do it,I have to get the DLL symbol file. But I can't locate the IWbemServices::ExecQuery method in any DLL.

Is there any idea to detect wmi query string like select * from win32_operatingsystem only using API monitoring?

2
  • Well, as the name indicates, it's a service interface. You need to figure out the (COM) server implementing it and that's where you'd be able to peek into data exchange. Alternatively you can look for instances of CoCreateInstance, CoCreateInstanceEx, CoGetClassObject and similar being called from that binary, look for the CLSID of the interface and use that to get into the flow of data. I think you need to read up on COM first, you seem to have quite some misunderstandings and that's not even RCE at this point.
    – 0xC0000022L
    Jul 8, 2021 at 9:53
  • Actually,I am working on some sandbox features to detect malware evasion point according to the research evasions.checkpoint.com/techniques/wmi.html. After understanding part of the COM, I find fastproxy.dll implementing the method ExecQuery in the IWbemServices interface. But I am not sure if I am on the right point,any advice? Thanks a lot... Below is my write up. hackmd.io/zv9rEy5WRYGJ0TDsKQLu5A
    – jacoblin
    Jul 10, 2021 at 5:04

1 Answer 1

0

I am Not sure what you are looking for if you execute in say wmic

C:\WINDOWS\system32>wmic os get Name

you get back

Name
Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition4

this is executed with your select *from sql or wql query
here is a call stack and relevent info

broken at

0:000> rM0
WMIC!CExecEngine::ProcessSHOWInfo:
00007ff7`a6fc5590 4053            push    rbx

call stack

0:000> kP
Child-SP          RetAddr           Call Site
0000008c`90c9f6a8 00007ff7`a6fc2ffe WMIC!CExecEngine::ProcessSHOWInfo
0000008c`90c9f6b0 00007ff7`a6fe9141 WMIC!CExecEngine::ExecuteCommand+0x1ae
0000008c`90c9f750 00007ff7`a6fe8060 WMIC!CWMICommandLine::ProcessCommandAndDisplayResults+0x5f5
0000008c`90c9f910 00007ff7`a6feee6d WMIC!wmain+0x934
0000008c`90c9fb20 00007ff8`96f07c24 WMIC!__wmainCRTStartup+0x14d
0000008c`90c9fb60 00007ff8`986cd721 KERNEL32!BaseThreadInitThunk+0x14
0000008c`90c9fb90 00000000`00000000 ntdll!RtlUserThreadStart+0x21

script dumping arg1@rcx *rcx **rcx,arg2 @rdx....,arg3@r8....,arg4@r9...

0:000> $$>a< "xxxxx\arg64.wds"
rcx=00007ff7a70198e0
=========       @rcx
00007ff7`a70198e0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
00007ff7`a70198f0  e0 2d 88 07 f5 01 00 00-00 00 00 00 00 00 00 00  .-..............
=========       *@rcx
00000000`00000000  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000000`00000010  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
rdx=00007ff7a70199e8
=========       @rdx
00007ff7`a70199e8  c0 e4 a8 07 f5 01 00 00-60 e5 a8 07 f5 01 00 00  ........`.......
00007ff7`a70199f8  20 01 73 09 f5 01 00 00-00 00 00 00 00 00 00 00   .s.............
=========       *@rdx
000001f5`07a8e4c0  20 00 6f 00 73 00 20 00-67 00 65 00 74 00 20 00   .o.s. .g.e.t. .
000001f5`07a8e4d0  4e 00 61 00 6d 00 65 00-00 00 ab ab ab ab ab ab  N.a.m.e.........
r8=0000000000000001
=========       @r8
00000000`00000001  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000000`00000011  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
=========       *@r8
Memory access error at ') '
r9=0000000000000000
=========       @r9
00000000`00000000  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000000`00000010  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
=========       *@r9
Memory access error at ') '

the second argument contins your sql/ wql query

0:000> dpu @rdx
00007ff7`a70199e8  000001f5`07a8e4c0 " os get Name"
00007ff7`a70199f0  000001f5`07a8e560 "os"
00007ff7`a70199f8  000001f5`09730120 "Installed Operating System/s management. "
00007ff7`a7019a00  00000000`00000000
00007ff7`a7019a08  00000000`00000000
00007ff7`a7019a10  00000000`00000000
00007ff7`a7019a18  000001f5`097300d0 "get"
00007ff7`a7019a20  00000000`00000000
00007ff7`a7019a28  00000000`00000000
00007ff7`a7019a30  00000000`00000000
00007ff7`a7019a38  00000000`00000000
00007ff7`a7019a40  000001f5`07a8ee00 "Select * from Win32_OperatingSystem"
00007ff7`a7019a48  00000000`00000000
00007ff7`a7019a50  00000000`00000001
00007ff7`a7019a58  000001f5`07a81770 "ᝰ.ǵ"
00007ff7`a7019a60  00000000`00000000
0:000>  

if you follow further you can see instead of wildcard a specific attribute is queried

0:000> rM0
WMIC!CExecEngine::ObtainXMLResultSet:
00007ff7`a6fc3030 4c8bdc          mov     r11,rsp
0:000> r rcx,rdx,r8,r9
rcx=00007ff7a70198e0 rdx=00000204437822d8 r8=00007ff7a70199e8 r9=0000003789d3b5b8
0:000> du /c 100 @rdx
00000204`437822d8  "SELECT Name FROM Win32_OperatingSystem"
0:000>  

there is a documented example to retrieve data from wmi methods here

compiling it and tracing it you can see the method being resolved in fastprox.dll as below

0:000> dps @rax+0xa0 l1
00007ff8`855846b0  00007ff8`854ec8f0 fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery
0:000> r
rax=00007ff885584610 rbx=00007ff669e67bc8 rcx=00000160178261a0
rdx=00000160178122b8 rsi=0000000000000000 rdi=00000160177e65e0
rip=00007ff669da1638 rsp=00000050a376faf0 rbp=0000000000000000
 r8=000001601781fb08  r9=0000000000000030 r10=00000050a376fa20
r11=00000160178122b8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
wbemexec!main+0x448:
00007ff6`69da1638 ff90a0000000    call    qword ptr [rax+0A0h] ds:00007ff8`855846b0={fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery (00007ff8`854ec8f0)}
0:000> ?? @rax == @@masm(poi(@rcx))
bool true
0:000> du @rdx
00000160`178122b8  "WQL"
0:000> du @r8
00000160`1781fb08  "SELECT * FROM Win32_OperatingSys"
00000160`1781fb48  "tem"
0:000>  

here is the same fastprox::..::execquery being called from wmic command prior to editing of the answer

0:000> rM0
fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery:
00007ff8`854ec8f0 4c8bdc          mov     r11,rsp
0:000> kp
Child-SP          RetAddr           Call Site
00000017`37abb518 00007ff7`ce3931c5 fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery
00000017`37abb520 00007ff7`ce395e3d WMIC!CExecEngine::ObtainXMLResultSet+0x195
00000017`37abb760 00007ff7`ce392ffe WMIC!CExecEngine::ProcessSHOWInfo+0x8ad
00000017`37abf960 00007ff7`ce3b9141 WMIC!CExecEngine::ExecuteCommand+0x1ae
00000017`37abfa00 00007ff7`ce3b8060 WMIC!CWMICommandLine::ProcessCommandAndDisplayResults+0x5f5
00000017`37abfbc0 00007ff7`ce3bee6d WMIC!wmain+0x934
00000017`37abfdd0 00007ff8`96f07c24 WMIC!__wmainCRTStartup+0x14d
00000017`37abfe10 00007ff8`986cd721 KERNEL32!BaseThreadInitThunk+0x14
00000017`37abfe40 00000000`00000000 ntdll!RtlUserThreadStart+0x21
0:000> du @rdx; du /c 100 @r8
00000209`96d22868  "WQL"
00000209`96d76d38  "SELECT Name FROM Win32_OperatingSystem"
0:000> dps poi(@rcx)+a0 l1
00007ff8`855846b0  00007ff8`854ec8f0 fastprox!CWbemSvcWrapper::XWbemServices::ExecQuery
0:000>  
1
  • Thanks for your answer! Very Helpful... Go working for the sandbox feature next.
    – jacoblin
    Jul 10, 2021 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.