{"id":98355,"date":"2018-03-27T07:00:00","date_gmt":"2018-03-27T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/?p=98355"},"modified":"2019-03-13T00:51:14","modified_gmt":"2019-03-13T07:51:14","slug":"20180327-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20180327-00\/?p=98355","title":{"rendered":"The WMI root node is just a node in the WMI namespace"},"content":{"rendered":"

A security vulnerability report arrived that went roughly like this: <\/p>\n

\n

There is a serious zero-day security vulnerability in the WMIC.EXE<\/code> program<\/a>. It does not check whether the user has administrative privileges before granting access. Simply sign in as a standard user and run the wmic<\/code> program. Observe from the prompt that it gives you root access. <\/p>\n

\nC:\\> del config.sys\nAccess is denied\n\nC:\\> wmic\nwmic:root\\cli> cdrom get description, drive\nDescription   Drive\nCD-ROM Drive  D:\n<\/pre>\n<\/blockquote>\n
The WMIC prompt looks like this: <\/p>\n
\nwmic:root\\cli>\n<\/pre>\n
This is telling you that your current location (which WMI calls a role<\/i> for some reason) is the cli<\/code> node in the root of the WMI namespace. You can change this by typing <\/p>\n
\nwmic:root\\cli> \/ROLE:..\\cimv2\nwmic:root\\cimv2>\n<\/pre>\n
We suspect that the finder saw the word root<\/i> and assumed it had the same meaning here as it does in Unix. In Windows, the administrator account is called Administrator<\/i>, not root<\/i>. <\/p>\n
Their screen shot shows that they don’t have administrator privileges when they started (because they can’t delete the file C:\\config.sys<\/code>). From inside the WMIC<\/code> tool, they printed information about the CD-ROM drives, but that operation doesn’t require administrator privileges, so that isn’t proof that any elevation occurred. <\/p>\n
Running the WMIC<\/code> program doesn’t change your security level. If you don’t have administrator privileges, then you still cannot do things like, say, delete system files. <\/p>\n
\nwmic:root\\cli>datafile where name=\"C:\\\\config.sys\" delete\nDelete '\\\\PC\\ROOT\\CIMV2:CIM_DataFile.Name=\"c:\\\\config.sys\"' (Y\/N\/?)? y\nDeleting instance \\\\PC\\ROOT\\CIMV2:CIM_DataFile.Name=\"c:\\\\config.sys\"\nERROR:\nDescription = Access denied\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
Don’t let the name fool you.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-98355","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
Don’t let the name fool you.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/98355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=98355"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/98355\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=98355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=98355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=98355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}