Windown Management Instrumentation Command-line (WMIC)

I would like to publish information about Windows Management Instrumentation Command-line Which was kept Secrete! Its really great tool for Forensic tasks.

What is WMIC Tool ?

• I personally never worked with scripting for windows platform but we can do scripting for windows platform using WMI API.
  
• Windows Management Instrumentation scripting API which can be used to get all types of information.
• WMIC Command line is basically front end to access WMI framework.
• WMIC By default installed in windows XP,Windows 2003 server, windows 2000 server etc.
• go to Run and type : wmic
• first time whn u will open you will see the message WMIC Is being installed but infact no media or nythin required to install it.

WMIC Usage

• group list brief

You can view Different types of groups available on System

WMIC in Vulnerabillity And Penetration Testing

• In Vulnerability and penetration testing we must gather as much as information as we can before shutting down the compromised system.

Important WMIC Commands for Forensics

• process list :

This command is used to list currently running processes

• process list brief :

This command is used to list currently running processes with their brief details.

• useraccount list

Gives details of User Account list on our system.

• groupaccount list

Gives details of Group Account list on our system.

• sysaccount list

Gives details of System accounts on system.

• share list
• nicconfig list
• service list
• qfc list :

This command is used to check which security update installed on our computer and on which date.

WIMIC still more to go :

• We just had a formal inroduction to WMIC there are lot more things we can do using WMIC.
• But this formal introduction is more enough atleast you will get a basic idea of what WMIC is!