Lateral Movement and Pivoting | WMI Lateral Movement & MSI Install

In this TryHackMe Lateral Movement & Pivoting lab, we explore how Windows Management Instrumentation (WMI) can be used for remote software management and how attackers may abuse this legitimate administrative functionality to move between Windows systems.

The technique demonstrated here combines WMI, DCOM/RPC, SMB file transfer, and a Windows Installer package (MSI).

The objective is to understand the complete attack path: from preparing an MSI package on the attacker machine to staging it on a target Windows host, invoking the installation remotely, and observing the result in an authorized lab environment.

𝗖𝗢𝗥𝗘 𝗖𝗢𝗡𝗖𝗘𝗣𝗧

WMI is a built-in Windows management technology that enables administrators to query system information and perform management operations on local or remote computers.

The Win32_Product WMI class exposes methods associated with Windows Installer products, including an installation method that accepts an MSI package location.

When an account has sufficient privileges and remote management is permitted, this functionality can be misused to initiate an installation on another machine.

The important distinction is that the MSI file transfer and the remote installation are separate operations:

• SMB can be used to transfer the MSI to the target. • WMI over DCOM/RPC can be used to invoke the installation remotely. • A reverse TCP connection, if configured in the lab payload, follows a separate network path back to the listener.

𝗟𝗔𝗕 𝗡𝗘𝗧𝗪𝗢𝗥𝗞 & 𝗧𝗔𝗥𝗚𝗘𝗧 𝗗𝗘𝗧𝗔𝗜𝗟𝗦

The supplied proof of concept uses the following lab details:

• Attacker machine: Kali Linux / TryHackMe AttackBox • Example attacker callback IP: 10.150.74.14 • Callback port: TCP 4445 • Jump host: thmjmp2.za.tryhackme.com • Target host: thmiis.za.tryhackme.com • Target file location: C:\Windows\myinstaller.msi • SMB file-transfer port: TCP 445 • DCOM/RPC endpoint mapper: TCP 135 • Default Windows dynamic RPC port range on supported modern Windows systems: TCP 49152–65535

The exact target IP was not included in the original notes. Resolve thmiis.za.tryhackme.com from within the connected lab environment to identify the address assigned to your current session.

Remember that TCP 135 is not necessarily the only port needed for WMI/DCOM. The connection may also require a dynamically assigned RPC port. Firewall rules and network routing determine whether the complete communication path works.

𝗦𝗧𝗘𝗣 𝟭 — 𝗣𝗥𝗘𝗣𝗔𝗥𝗘 𝗧𝗛𝗘 𝗠𝗦𝗜 𝗣𝗔𝗖𝗞𝗔𝗚𝗘

In this stage, the attacker machine prepares an MSI-format package for the authorized lab exercise.

The callback address must be the attacker's lab IP that is reachable from the target, not the target's own IP.

The payload configuration in the supplied proof of concept uses:

LHOST=10.150.74.14

LPORT=4445

Here, LHOST identifies the callback destination, while LPORT identifies the TCP port configured for the receiving handler.

The generated MSI is intended to demonstrate the security implications of remotely invoking an installer. Use this workflow only against systems explicitly included in your authorized lab.

𝗦𝗧𝗘𝗣 𝟮 — 𝗧𝗥𝗔𝗡𝗦𝗙𝗘𝗥 𝗧𝗛𝗘 𝗠𝗦𝗜 𝗧𝗢 𝗧𝗛𝗘 𝗧𝗔𝗥𝗚𝗘𝗧

The next stage demonstrates file staging over SMB using the lab-provided account.

Windows administrative shares such as ADMIN$ can expose the Windows installation directory to appropriately authorized users. In this lab, the intended destination is:

C:\Windows\myinstaller.msi

The important point is that a successful upload does not mean the MSI has been executed. It only establishes that the package is present on the target.

SMB transfer normally uses TCP port 445. This is separate from the DCOM/RPC communication used for the subsequent WMI operation.

For a public write-up, avoid embedding passwords in commands or publishing working credentials. Use the credentials assigned to your own authorized lab session.

𝗦𝗧𝗘𝗣 𝟯 — 𝗣𝗥𝗘𝗣𝗔𝗥𝗘 𝗧𝗛𝗘 𝗟𝗜𝗦𝗧𝗘𝗡𝗘𝗥

The receiving handler is configured on the attacker machine to observe the lab's expected reverse TCP connection.

The example callback destination is:

10.150.74.14:4445/TCP

For a callback to arrive, the address must be reachable from the target, the listener must be running, and the applicable firewall and routing rules must permit the connection.

A configured listener by itself does not prove that the target is reachable or that the installation succeeded. Those are separate conditions to verify during testing.

𝗦𝗧𝗘𝗣 𝟰 — 𝗘𝗦𝗧𝗔𝗕𝗟𝗜𝗦𝗛 𝗧𝗛𝗘 𝗥𝗘𝗠𝗢𝗧𝗘 𝗪𝗠𝗜 𝗦𝗘𝗦𝗦𝗜𝗢𝗡

The lab uses THMJMP2 as the jump host from which the remote management operation is initiated.

In PowerShell, a PSCredential object represents the credentials supplied for authentication. A CIM session option configured for DCOM specifies the transport used by the remote management session.

The destination is the lab target:

thmiis.za.tryhackme.com

The connection depends on valid lab credentials, sufficient privileges, the appropriate DCOM/WMI permissions, working name resolution, and permitted RPC connectivity.

From a networking perspective, the RPC endpoint mapper initially uses TCP 135 and may then direct the client to a dynamic RPC port. Allowing TCP 135 alone does not guarantee that the remote operation will succeed.

𝗦𝗧𝗘𝗣 𝟱 — 𝗨𝗡𝗗𝗘𝗥𝗦𝗧𝗔𝗡𝗗 𝗧𝗛𝗘 𝗠𝗦𝗜 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡

The relevant WMI operation uses the Install method associated with Win32_Product.

Its PackageLocation argument points to the installer package on the computer where the software is being installed. That is why the lab references the target-side path:

C:\Windows\myinstaller.msi

The other arguments specify installation options and whether the software should be made available to all users.

This is the key learning point: the remote management request invokes an installation operation on the target rather than simply copying a file there.

The Microsoft documentation describes the method, its parameters, and the return values that can be used to assess installation errors.

𝗦𝗧𝗘𝗣 𝟲 — 𝗩𝗘𝗥𝗜𝗙𝗬 𝗧𝗛𝗘 𝗟𝗔𝗕 𝗥𝗘𝗦𝗨𝗟𝗧

After the remote operation, verify each part of the workflow rather than assuming that one successful step proves the entire chain worked.

Check whether the remote installation completed, whether the target generated the expected network activity, and whether the listener recorded the expected connection.

The lab's final validation involves examining the designated user's Desktop on THMIIS and running the exercise's supplied flag.exe as instructed by the room.

The flag is the proof that the lab objective was completed; a successful file upload alone is not sufficient evidence.

𝗪𝗛𝗔𝗧 𝗧𝗛𝗜𝗦 𝗗𝗘𝗠𝗢𝗡𝗦𝗧𝗥𝗔𝗧𝗘𝗦

This exercise illustrates several important points about Windows enterprise environments:

• Legitimate administrative technologies can become attack paths when privileged credentials are misused. • File transfer and remote execution are distinct stages, each with its own permissions and network requirements. • DCOM/RPC connectivity involves more than the endpoint mapper port in many Windows configurations. • A valid management session does not automatically guarantee a successful installation or a working callback.

𝗗𝗘𝗙𝗘𝗡𝗦𝗜𝗩𝗘 𝗧𝗔𝗞𝗘𝗔𝗪𝗔𝗬

From a blue-team perspective, monitor unexpected writes to administrative shares, remote WMI/DCOM activity, unusual MSI installations, and unexpected outbound connections from Windows servers.

Restrict administrative privileges, limit remote management to trusted hosts, protect credentials, and review Windows event logs alongside endpoint and network telemetry.

The goal is not to disable every administrative feature. It is to ensure that legitimate management mechanisms cannot be abused without appropriate authorization and visibility.

𝗧𝗘𝗖𝗛𝗡𝗜𝗖𝗔𝗟 𝗥𝗘𝗙𝗘𝗥𝗘𝗡𝗖𝗘𝗦

Microsoft Learn — Install method of the Win32_Product class: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/msiprov/install-method-in-class-win32-product

Microsoft Learn — RPC dynamic port allocation and firewall considerations: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-rpc-dynamic-port-allocation-with-firewalls

𝗠𝗔𝗦𝗔𝗨𝗗𝗦𝗘𝗖 | 𝗖𝗬𝗕𝗘𝗥𝗦𝗘𝗖𝗨𝗥𝗜𝗧𝗬 𝗥𝗘𝗦𝗢𝗨𝗥𝗖𝗘𝗦

Want to learn cybersecurity, ethical hacking, penetration testing, and bug bounty hunting? Explore my courses and free learning resources below.

𝗪𝗵𝗮𝘁𝘀𝗔𝗽𝗽 𝗦𝘂𝗽𝗽𝗼𝗿𝘁

For course details, mentorship inquiries, and questions:

https://wa.me/923275104800

𝗢𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗪𝗲𝗯𝘀𝗶𝘁𝗲

https://masaudsec.com

𝗙𝗿𝗲𝗲 𝗖𝗼𝗺𝗽𝗹𝗲𝘁𝗲 𝗖𝗼𝘂𝗿𝘀𝗲 𝗢𝘂𝘁𝗹𝗶𝗻𝗲 𝗣𝗗𝗙

Explore the complete cybersecurity learning roadmap: