I have a problem understanding remote WMI traffic.
Let's say I have 2 PC's in a LAN (PC-A and PC-B).
From PC-A i type in CMD:
wmic /node:"PC-B" /user:"B" /password:"whatever" computersystem get "name"There now should be traffic inside the LAN between the two PCs, and the answer to that query should be sent back to PC-A, from PC-B.
I tried using Wireshark, but the traffic is too overwhelming for me.
As of right now, what I understand going on goes like this (I barely understand it):
- llmnr/mdns trying to resolve the node parameter (the PC domain inside the LAN)
- TCP 3-way-handshake over port 135 (of PC-B)
- What happens next is completely out of my understanding, i think it should go like:
- dcom (establishing something) over port 135
- dcom, session moved to a different port
I'm completely clueless... I am having trouble finding useful information.
I'm thankful for any of you who can share knowledge with me.
Edit:
This is the PCAP file: https://drive.google.com/file/d/1FpvNujHlAIsY2aXxZdB0uGZd6RC4islm/view?usp=sharing