wmic命令

  • wmic远程连接机器
wmic /node:"127.0.0.1" /user:"domain\administrator" /password:"123456"
  • wmic远程执行命令
wmic /node:192.168.3.200 /user:Administrator /password:Password@ process call create "cmd.exe /c whoami >c:\whoami.txt"
  • wmic查看系统安装软件
wmic product get name,version
  • wmic查看进程命令
wmic process get Caption,executablepath,ProcessId

wmic process get Caption,executablepath,Commandline,ProcessId

wmic /namespace:\\root\cimv2 path win32_product get name,version

#powershell

Get-WmiObject -Class win32_product | Select-Object -Property name,version

mofcomp

Mofcomp.exe是系统自带的一个工具，用来编译mof文件，并将mof文件中的信息添加到WMI数据库中，可以用WMI Explorer工具来查看WMI支持的各种类。
所以我们可以直接通过Mofcomp.exe执行SampleProductsList.mof文件将读取到的注册表项中的子健结果添加进VMI数据库中，然后再用WMIC命令查询即可。

mofcomp.exe C:\ProgramData\SampleProductsList.mof
wmic /namespace:"\\root\default" path sampleproductslist get displayname,displayversion
wmic /namespace:"\\root\default" path sampleproductslist32 get displayname,displayversion

ListSoftware #WMI——重写版

https://www.freesion.com/article/85051221254/
https://blog.csdn.net/shuteer_xu/article/details/107925650

#SampleProductsList.mof


// "AS-IS" sample MOF file for returning the two uninstall registry subkeys
// Unsupported, provided purely as a sample
// Requires compilation. Example: mofcomp.exe sampleproductslist.mof
// Implements sample classes: "SampleProductList" and "SampleProductlist32"
// (for 64-bit systems with 32-bit software)

#PRAGMA AUTORECOVER
[dynamic, provider("RegProv"),
ProviderClsid("{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}"),ClassContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall")]

class SampleProductsList {
[key] string KeyName;
[read, propertycontext("DisplayName")] string DisplayName;
[read, propertycontext("DisplayVersion")] string DisplayVersion;
};

[dynamic, provider("RegProv"),
ProviderClsid("{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}"),ClassContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432node\\Microsoft\\Windows\\CurrentVersion\\Uninstall")]

class SampleProductsList32 {
[key] string KeyName;
[read, propertycontext("DisplayName")] string DisplayName;
[read, propertycontext("DisplayVersion")] string DisplayVersion;
};
  • wmic查看系统版本
wmic OS get Caption,CSDVersion,OSArchitecture,Version
  • wmic查看用户列表
wmic useraccount list
  • wmic根据Pid查找进程路径
wmic process get name,executablepath,processid|findstr pid
  • wmic查看磁盘信息
Wmic logicaldisk
  • 查看组,hostname,等信息
wmic computersystem get Name, Domain, Manufacturer, Model, Username, Roles/format:list
  • wmic获取进程命令行
wmic process where caption="Chrome.exe" get caption,commandline /value
  • wmic获取进程命令行
wmic process get commandline
  • wmic查看程序绝对路径
wmic process where name="cmd.exe" get processid,executablepath,name
  • wmic查看系统进程
wmic process list brief
  • wmic查看本机已打补丁
wmic qfe get Caption,Description,HotFixID,InstalledOn
  • wmic查看本机杀软信息
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
  • wmic查看本机杀软信息
WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName,productState, pathToSignedProductExe
  • wmic开启3389
wmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 1