C＃从远程客户端上的远程服务器运行可执行文件

Question

I have the following function for connecting to a remote client machine and running an executable on it.

I copied it from a response on this site, but don't have the link anymore, so I'm not sure who to give credit to.

    public static void ConnectToRemoteClient(string client_machine, string user, string password, string target_exe )
    {
        var connection = new ConnectionOptions();
        // The '.\' is for a local user on the remote machine
        // or 'mydomain\user' for a domain user
        connection.Username = user;
        connection.Password = password;


        object[] theProcessToRun = { target_exe };

        var wmiScope = new ManagementScope($@"\\{client_machine}\root\cimv2", connection);

        wmiScope.Connect();

        using (var managementClass = new ManagementClass(wmiScope, new ManagementPath("Win32_Process"), new ObjectGetOptions()))
        {
            managementClass.InvokeMethod("Create", theProcessToRun );
        }   
    }

It is called using the following syntax:

    string exe = string.Format("taskkill.exe {0} {1}", @"/F", @"/PID 8704");
    ConnectToRemoteClient("ClientMachine", @"Domain\Username", @"password", exe);

It works just fine for executables that exist on the remote client machine.

However, I want to call an executable from a server, and run it on that remote client machine.

Not sure how best to approach this. I tried feeding it the following:

    ConnectToRemoteClient("ClientMachine", @"Domain\User", @"password", @"\\ServerName\MyDir\Myfile.exe");

But it never initiated the executable on the machine. No error messages.

The reason I want to do this, is to save me from having to copy the large executable and supporting files to each client, but rather just run it from the server depot on each remote client.

Do I have to call a CMD window and feed it the \\\\ServerName\\MyDir\\Myfile.exe in order to get it to work properly? or is there a way I can make this work?

Answer 1

You are connecting to the remote machine using the passed credentials, but that only establishes your rights to open WMI. The command you then pass to WMI to execute is not running as the credentials you pass in, but under the LocalSystem account credentials.

LocalSystem does not have access to the network share.

To do this you need to remotely execute PSEXEC ( https://ss64.com/nt/psexec.html ) which allows you to pass the parameters to launch the application as. PSEXEC runs as LocalSystem but allows you to pass credentials to use when it launches your designated application. The launched program will then impersonate the user you pass in, and will have access to the network share.