On newer systems, attackers and penetration testers take advantage of built-in scripting languages, for example, Windows Management Instrumentation Command-line (WMIC), a command-line and scripting interface that is used to simplify access to Windows instrumentation. If the compromised system supports WMIC, several commands can be used to gather information. Refer to the following table:
|
Command |
Description |
|
wmic nicconfig get ipaddress,macaddress |
Obtains the IP address and the MAC address. |
|
wmic computersystem get username |
Verifies the account that was compromised. |
|
wmic netlogin get name, lastlogon |
Determines who used this system last and when they last logged on. |
|
wmic desktop get screensaversecure, screensavertimeout ... |
