WQL Injection

Generally in application security, the user input must be sanitized. When it comes to SQL injection the root cause most of the time is because the input not being sanitized properly. I was curious about Windows Management Instrumentation Query Language – WQL which is the SQL for WMI. Can we abuse WQL if the input is not sanitized?

I wrote a simple application in C++ which gets the service information from the Win32_Service class. It will display members such as Name, ProcessId, PathName, Description, etc.

This is the WQL Query.

1
SELECT * FROM win32_service where Name='User Input'

As you can see I am using the IWbemServices::ExecQuery method to execute the query and enumerte its members using the IEnumWbemClassObject::Next method.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
BSTR input = L"SELECT * FROM win32_service where Name='User Input'";
 
if (FAILED(hRes = pService->ExecQuery(L"WQL", input, WBEM_FLAG_FORWARD_ONLY, NULL, &pEnumerator))) {
pLocator->Release();
pService->Release();
cout << "Unable to retrive Services: 0x" << std::hex << hRes << endl;
return 1;
}
 
IWbemClassObject* clsObj = NULL;
int numElems;
while ((hRes = pEnumerator->Next(WBEM_INFINITE, 1, &clsObj, (ULONG*)&numElems)) != WBEM_S_FALSE) {
if (FAILED(hRes)) break;
VARIANT vRet;
VariantInit(&vRet);
if (SUCCEEDED(clsObj->Get(L"Name", 0, &vRet, NULL, NULL))
&& vRet.vt == VT_BSTR) {
wcout << L"Name: " << vRet.bstrVal << endl;
VariantClear(&vRet);
}

Once the user enters a service name the application will display its members.

I was thinking if it’s possible to make the query true and return all the services of the target host. Something like id=1 or 1=1 in SQLi where we make the statement logically true.
Since the user input is not properly sanitized in this case we can use the and keyword and enumerate all the services by using the like keyword.

1
SELECT * FROM win32_service where Name='Appinfo' or name like '[^]%'

You could simply use “%” as well.

This is just a simple demonstration to prove WQL injection. I’m sure there might be better cases to demonstrate this. However, Extended WQL which is a superset of the WQL can be used to combine statements and do more cool stuff. It’s used by the System Center Configuration Manager – SCCM. Always sanitize the input of the application.

You can download the applications from here to play around.
https://github.com/OsandaMalith/WMI/releases/download/1/WinServiceInfo.7z

2 thoughts on “WQL Injection”

  1. I am getting this error : “Unable to initialize security: 0x”

    Advice me on this buddy !

    Reply

    • Hi Muthu I believe the GUI application would not work with Windows 10. Please try the other binary which is included which is the CLI version. It’s compiled on a Visual Studio 2015.

      Reply

Leave a Reply