mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-01 03:54:44 +02:00
田中ザック Isaac Mathis
b84b97b358
* Collect bounded local WMI namespace access evidence * Reference PR428 and preserve UTC worker query timestamps * Observe equivalent runtime self tokens without reverting caller context * Test native token equivalence against restricted caller changes * Diagnose native token differences and package WMI probe guidance * Limit WMI connections to the explicitly scoped security privilege * Document verified native WMI events and privilege preservation * Require an already-running WMI service before namespace reads
16 lines
1.4 KiB
PowerShell
16 lines
1.4 KiB
PowerShell
$ErrorActionPreference='Stop';$repo=Split-Path $PSScriptRoot -Parent;$engine=(Get-Process -Id $PID).Path;$count=0
|
|
$cases=@(
|
|
@{Args=@('wmi-probe','-Help');Code=0;Pattern='Fixed local read'},
|
|
@{Args=@('configure','-WmiProbeAction','Run','-Auto');Code=1;Pattern='require wmi-probe'},
|
|
@{Args=@('wmi-auditing','-WmiProbeNamespace','root\default');Code=1;Pattern='require wmi-probe'},
|
|
@{Args=@('wmi-probe','-Help','-WmiAction','Configure');Code=1;Pattern='only dedicated'},
|
|
@{Args=@('wmi-probe','-Help','-Auto');Code=1;Pattern='only dedicated'},
|
|
@{Args=@('wmi-probe','-Help','-DryRun');Code=1;Pattern='only dedicated'},
|
|
@{Args=@('wmi-probe','-Help','-ResultsPath','unused');Code=1;Pattern='only dedicated'},
|
|
@{Args=@('wmi-probe','-Help','-Profile','wela-2.2.0');Code=1;Pattern='only dedicated'},
|
|
@{Args=@('wmi-probe','-WmiProbeNamespace','\\remote\root\default');Code=1;Pattern='exact local'},
|
|
@{Args=@('wmi-probe','-WmiProbeNamespace','root\default','-WmiProbeAction','Run');Code=1;Pattern='new WmiProbeOutputPath'})
|
|
foreach($case in $cases){$ErrorActionPreference='Continue';$output=& $engine -NoProfile -NonInteractive -File (Join-Path $repo 'WELA.ps1') @($case.Args) 2>&1|Out-String;$code=$LASTEXITCODE;$ErrorActionPreference='Stop';if($code -ne $case.Code -or $output -notmatch $case.Pattern){throw "CLI failed: $($case.Args -join ' ') [$code] $output"};$count++}
|
|
Write-Host "PASS: $count WMI probe public CLI checks."
|
|
$global:LASTEXITCODE=0
|