Vault7: CIA Hacking Tools Revealed
Navigation: » Directory
Owner: User #71468
User #71468
| Pages | Date | User |
|---|---|---|
Attachments:
Blog posts:
-
[User #71468]: Trust Issues: MSDNMicrosoft Developer Network Lies regarding WMI
Came across another reason why Microsoft is the reason we all have trust issues today.
When attempting to remove/delete a WMIWindows Management Instrumentation object used to create a registry execution backdoor, I came across the following function:
HRESULT IWbemServices::DeleteInstance(const BSTR strObjectPath, LONG lFlags, IWbemContext *pCtx, IWbemCallResult **ppCallResult);
IWbemServices is the interface used to interact WMI. In the MSDNMicrosoft Developer Network documentation, we see the that parameter "lFlags" has the following (single) option.
Semi-synchronous with WMIWindows Management Instrumentation makes sense... it's conceivable Windows wouldn't be able to tell when the object was actually deleted.
So what's the catch? Passing this value, which remember is the only one listed as a possibility according to MSDN, causes the function to fail. The only way I was able to get the function to succeed was to pass 0 for no flags instead.
#WMIisAnnoying #MSDNlies #MicrosoftIsTheReasonIHaveTrustIssues
-
[User #71468]: Confluence: The new Whose Line is it Anyway
...where everything's made up, and the points don't matter
