0

I'm stuck with an issue that may not be easily solvable, but I'm hoping someone will be able to help. I am attempting to run an exe to install some software (SCCM client) on a remote device.

So what is happening is that I am running the program from my PC (Host1) to connect to a remote device (Host2) and instruct that device to run an exe from a server.

I have been using standard remote execution WMI code with no luck:

ConnectionOptions connOptions = new ConnectionOptions();
connOptions.Impersonation = ImpersonationLevel.Impersonate;
connOptions.EnablePrivileges = true;
ManagementScope manScope = new ManagementScope(String.Format(@"\\{0}\ROOT\CIMV2", Host2), connOptions);
manScope.Connect();
if(manScope.IsConnected)
{
    ObjectGetOptions objectGetOptions = new ObjectGetOptions();
    ManagementPath managementPath = new ManagementPath("Win32_Process");
    ManagementClass processClass = new ManagementClass(manScope, managementPath, objectGetOptions);

    ManagementBaseObject inParams = processClass.GetMethodParameters("Create");
    inParams["CommandLine"] = @sCommand;
    ManagementBaseObject outParams = processClass.InvokeMethod("Create", inParams, null);
}
else
{
    MessageBox.Show("An error occurerd while attempting to connect to WMI.");
}

The problem I'm running into is executing sCommand when the exe is on a server. So when the parameter is "\\server\share\program.exe" nothing happens. When the parameter is "c:\Folder\program.exe" it works great. These devices we are targeting unfortunately have Admin$ and C$ disabled, and do not have the exe on their hard drive.

I am at a loss unfortunately - is it possible to use the Win32_Process.Create method to run a UNC exe, or is it possible to copy the exe or even the folder it is in to the Host device when Admin$ and C$ are disabled? I am trying to avoid psexec, and I'm honestly wondering if I'd run into the same issue using it anyways.

BBL Admin
  • 57
  • 1
  • 2
  • 9
  • Is the missing "\" at the start of your UNC path a typo in the question? – Richard Deeming Feb 26 '14 at 18:37
  • I believe if $admin is disabled, then psexec won't work either as it uses it to copy itself over to target machine... – LB2 Feb 26 '14 at 18:47
  • Yeah, that was a typo above - code does not pass that way. – BBL Admin Feb 26 '14 at 18:56
  • Could I be missing a permissions piece or am I not passing permissions correctly? The account I'm running the code on has administrator rights on all 3 devices and read/execute on the server share. – BBL Admin Feb 26 '14 at 18:58

1 Answers1

0

Can't you deploy a custom Windows Service application on the remote machine? This way you'll just have to communicate with the service using whatever channel you want and run the executable from there.

Crono
  • 10,211
  • 6
  • 43
  • 75
  • That might be a little bit more complicated than we're trying to accomplish. This is meant to be more of a quick fix for some legacy systems but is quickly becoming more of a hassle than we had hope for. But I get what you're saying though and it does sound interesting. I might investigate that some more. – BBL Admin Feb 26 '14 at 19:34