Trying to execute binary remotely through wmi infra in shared folder

Question

Hi, I have deployed a domain in which I try to execute a binary file placed in a shared folder using wmi primitives (ExecMethod_):

• The shared folder is published by the server of the domain
• The server executes a local script which, by means of wmi infrstructure, tries to execute in a remote machine a script which in turn tries to execute a binary file placed in this shared folder.

I have checked that the remote script is indeed executed by the remote machine (since it has some side effects visible in the machine), but when it comes to execute the shared folder placed binary file, nothing happens (this is why it seems to me some wmi-shared folder permission issue). I have already given shared folder permissions to remote machine.
Any ideas on how could i avoid this problem?

Thanks!

Jaume

Answer 1

Now, if MyBinary.exe lives in any local folder of the remote machine, the binary gets called properly, but if it lives in any shared folder it doesnt.

This is known as the infamous Windows double hop problem. Your credentials can authenticate from machine A to machine B, but not from A to B to C.

https://www.bing.com/search?q=windows+double+hop

Answer 2

Hi Viorel-1,

Just to introduce some context, the script I execute from server is (in perl):

eval { $process = 
Win32::OLE->GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\" . $serviceAddress . "\\root\\cimv2:Win32_Process"); };

if(defined $process)
{
    $objMethod = $process->Methods_("Create");

    my $cmdLine = 'cmd /c cd %TEMP% && copy nul _foo.txt && \\\\MySharedFolder\\MyBinary.exe';

Spawn an instance of inParameters and assign the values.

    $inParam = $objMethod->inParameters->SpawnInstance_ if (defined $objMethod);
    $inParam->{CommandLine} = $cmdLine;
    $inParam->{ProcessStartupInformation} = undef;

    $outParam = $process->ExecMethod_("Create", $inParam) if (defined $inParam);
    if ($outParam->{ReturnValue})
    {
        print Win32::OLE->LastError, "\n";
    }
}
else
{
    print Win32::OLE->LastError, "\n";
}

The ExecMethod_ call works fine (since it does not show any error code in standard output). I have added copy command so I have a sided effect visible in the remote machine, and I actually can see that file created there (_foo.txt). Now, if MyBinary.exe lives in any local folder of the remote machine, the binary gets called properly, but if it lives in any shared folder it doesnt.
I have given plenty of permissions to the remote machine for the shared folder and some other persmissions in the context of wmi (basically followed this https://helpdesk.kaseya.com/hc/en-gb/articles/4407333863825-Allowing-Remote-WMI-Access-in-a-WORKGROUP).
I have tried to print in a local file (of the remote machine) the %errorlevel% right after trying to execute MBinary.exe but it does print nothing, it's like it gets aborted. Do you have any suggestion on how to get more info about what may went wrong?

Kind regards,

Jaume