0

This wmic query (NODE, USER, PASS all desensitised)...

wmic /NODE:10.00.00.1 /LOCALE:MS_409 /PRIVILEGES:ENABLE /TRACE:OFF /INTERACTIVE:OFF /FAILFAST:OFF /USER:domain\my_user /PASSWORD:myPass! /OUTPUT:STDOUT /APPEND:STDOUT /AGGREGATE:ON class StdRegProv CALL EnumKey ^&H80000002,"Software\Microsoft\SystemCertificates\MY\Certificates"

^&H80000002 is the uint32 conversion of HKEY_LOCAL_MACHINE

... runs flawlessly in a CMD prompt in Windows. I can also run it in the context of a node package from my local windows machine with success, I'm going to assume this is because the wmic call is made specifically to the local machine (windows) where it is handled effortlessly. Returning to me a result containing what I require...

res.sNames [ 'BB731A3DD8F089A6D4E59AF9D706...' ]

I created a docker container running Alpine and node where I host an express application. I followed the instructions below to install WMIC on Linux...

https://askubuntu.com/questions/885407/installing-wmic-on-ubuntu-16-04-lts

This installed successfully.

Now when I run the exact same query from a bash prompt in Ubuntu either via my Node app or a direct command, I'm receiving this result:

$ wmic.exe /NODE:10.00.00.1 /LOCALE:MS_409 /PRIVILEGES:ENABLE /TRACE:OFF /INTERACTIVE:OFF /FAILFAST:OFF /USER:domain\my_user /PASSWORD:myPass! /OUTPUT:STDOUT /APPEND:STDOUT /AGGREGATE:ON class StdRegProv CALL EnumKey ^&H80000002,"Software\Microsoft\SystemCertificates\MY\Certificates"

[1] 426

bash: H80000002,Software\Microsoft\SystemCertificates\MY\Certificates: No such file or directory

$ ERROR: Description = Access is denied.

I can't for the life of me work out whether this is due to a string formatting error in Linux vs Windows or whether Linux is running a different variant of wmic that isn't resolving my query correctly?

After trying @A.B's suggestion I removed the caret/ampersand (^&) altogether and this was the output:

$ wmic /NODE:10.23.0.11 /LOCALE:MS_409 /PRIVILEGES:ENABLE /TRACE:OFF /INTERACTIVE:OFF /FAILFAST:OFF /USER:aim4gain\svc_certdisc /PASSWORD:finiTAryduRationmagneticDialuP! /OUTPUT:STDOUT /APPEND:STDOUT /AGGREGATE:ON class StdRegProv CALL EnumKey H80000002,"Software\Microsoft\SystemCertificates\MY\Certificates"

ERROR:

Description = Access is denied.

It's the same query with the same credentials I'm running from both operating systems - however I get no auth problems from Windows.

  • 1
    use quotes. the [1] 426 is a forked command because of the & somewhere. And there's no relation between Debian and Alpine Linux – A.B Oct 29 '19 at 18:47
  • @A.B Hi there, thanks for the correction and the suggestion - I'll give it a bash now! – MattGarnett Oct 29 '19 at 18:55
  • @A.B Added a comment to the post – MattGarnett Oct 29 '19 at 19:04
  • I didn't tell you to remove something which might be part of the parameters, I told you to escape them. YOu have to understand how it's working: manpages.debian.org/bash/bash.1#QUOTING (or manpages.debian.org/dash/dash.1#Quoting etc.) . note: I don't know anything about wmic – A.B Oct 29 '19 at 19:08
  • Understood. In command prompt since & is a special char, you must escape it with ^, resulting in ^&. And in bash, as you've pointed out you must escape the & with \. I did that and the result was the same outcome as the one I followed up with in my question. Thanks for your help anyway though. – MattGarnett Oct 29 '19 at 19:40
0

For anyone wondering, after hours of testing this with very obscure error messages. Make sure you escape absolutely everything in bash style not in a windows fashion.

Note:

  • \$ instead of ^&
  • Wrap USER value in ''
  • Wrap PASSWORD value in ''

References here (thanks to @A.B):

https://manpages.debian.org/buster/bash/bash.1.en.html#QUOTING

$ wmic /NODE:10.23.0.11 /LOCALE:MS_409 /PRIVILEGES:ENABLE /TRACE:OFF /INTERACTIVE:OFF /FAILFAST:OFF /USER:'domain\my_user' /PASSWORD:'myPass!' /OUTPUT:STDOUT /APPEND:STDOUT /AGGREGATE:ON class StdRegProv CALL EnumKey \&H80000002,"Software\Microsoft\SystemCertificates\MY\Certificates"
Executing (StdRegProv)->EnumKey()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
        ReturnValue = 0;
        sNames = {"BB731A3DD8F089A6D4E59AF9D70601F9CBB94A9D"};
};

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.