0

This wmic query (NODE, USER, PASS all desensitised)...

wmic /NODE:10.00.00.1 /LOCALE:MS_409 /PRIVILEGES:ENABLE /TRACE:OFF /INTERACTIVE:OFF /FAILFAST:OFF /USER:domain\my_user /PASSWORD:myPass! /OUTPUT:STDOUT /APPEND:STDOUT /AGGREGATE:ON class StdRegProv CALL EnumKey ^&H80000002,"Software\Microsoft\SystemCertificates\MY\Certificates"

^&H80000002 is the uint32 conversion of HKEY_LOCAL_MACHINE

... runs flawlessly in a CMD prompt in Windows. I can also run it in the context of a node package from my local windows machine with success, I'm going to assume this is because the wmic call is made specifically to the local machine (windows) where it is handled effortlessly. Returning to me a result containing what I require...

res.sNames [ 'BB731A3DD8F089A6D4E59AF9D706...' ]

I created a docker container running Alpine and node where I host an express application. I followed the instructions below to install WMIC on Linux...

https://askubuntu.com/questions/885407/installing-wmic-on-ubuntu-16-04-lts

This installed successfully.

Now when I run the exact same query from a bash prompt in Ubuntu either via my Node app or a direct command, I'm receiving this result:

$ wmic.exe /NODE:10.00.00.1 /LOCALE:MS_409 /PRIVILEGES:ENABLE /TRACE:OFF /INTERACTIVE:OFF /FAILFAST:OFF /USER:domain\my_user /PASSWORD:myPass! /OUTPUT:STDOUT /APPEND:STDOUT /AGGREGATE:ON class StdRegProv CALL EnumKey ^&H80000002,"Software\Microsoft\SystemCertificates\MY\Certificates"

[1] 426

bash: H80000002,Software\Microsoft\SystemCertificates\MY\Certificates: No such file or directory

$ ERROR: Description = Access is denied.

I can't for the life of me work out whether this is due to a string formatting error in Linux vs Windows or whether Linux is running a different variant of wmic that isn't resolving my query correctly?

After trying @A.B's suggestion I removed the caret/ampersand (^&) altogether and this was the output:

$ wmic /NODE:10.23.0.11 /LOCALE:MS_409 /PRIVILEGES:ENABLE /TRACE:OFF /INTERACTIVE:OFF /FAILFAST:OFF /USER:aim4gain\svc_certdisc /PASSWORD:finiTAryduRationmagneticDialuP! /OUTPUT:STDOUT /APPEND:STDOUT /AGGREGATE:ON class StdRegProv CALL EnumKey H80000002,"Software\Microsoft\SystemCertificates\MY\Certificates"

ERROR:

Description = Access is denied.

It's the same query with the same credentials I'm running from both operating systems - however I get no auth problems from Windows.

Improve this question
5
  • 1
    use quotes. the [1] 426 is a forked command because of the & somewhere. And there's no relation between Debian and Alpine Linux
    – A.B
    Oct 29, 2019 at 18:47
  • @A.B Hi there, thanks for the correction and the suggestion - I'll give it a bash now!
    – MattGarnett
    Oct 29, 2019 at 18:55
  • @A.B Added a comment to the post
    – MattGarnett
    Oct 29, 2019 at 19:04
  • I didn't tell you to remove something which might be part of the parameters, I told you to escape them. YOu have to understand how it's working: manpages.debian.org/bash/bash.1#QUOTING (or manpages.debian.org/dash/dash.1#Quoting etc.) . note: I don't know anything about wmic
    – A.B
    Oct 29, 2019 at 19:08
  • Understood. In command prompt since & is a special char, you must escape it with ^, resulting in ^&. And in bash, as you've pointed out you must escape the & with \. I did that and the result was the same outcome as the one I followed up with in my question. Thanks for your help anyway though.
    – MattGarnett
    Oct 29, 2019 at 19:40

1 Answer 1

Reset to default
0

For anyone wondering, after hours of testing this with very obscure error messages. Make sure you escape absolutely everything in bash style not in a windows fashion.

Note:

  • \$ instead of ^&
  • Wrap USER value in ''
  • Wrap PASSWORD value in ''

References here (thanks to @A.B):

https://manpages.debian.org/buster/bash/bash.1.en.html#QUOTING

$ wmic /NODE:10.23.0.11 /LOCALE:MS_409 /PRIVILEGES:ENABLE /TRACE:OFF /INTERACTIVE:OFF /FAILFAST:OFF /USER:'domain\my_user' /PASSWORD:'myPass!' /OUTPUT:STDOUT /APPEND:STDOUT /AGGREGATE:ON class StdRegProv CALL EnumKey \&H80000002,"Software\Microsoft\SystemCertificates\MY\Certificates"
Executing (StdRegProv)->EnumKey()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
        ReturnValue = 0;
        sNames = {"BB731A3DD8F089A6D4E59AF9D70601F9CBB94A9D"};
};
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .