WMI执行自动脚本逻辑

• binding绑定一个consumer与filter
• 一个filter绑定一个timer
• 一个consumer保存代码执行体
• timer决定代码触发时机

C#代码如下

// 创建consumer
var obj = new ManagementClass(@"ROOT\subscription:ActiveScriptEventConsumer").CreateInstance();
obj.SetPropertyValue("Name", "Script_Created_by_Csharp");
obj.SetPropertyValue("ScriptingEngine", "JScript");
// JScript代码执行体如下
obj.SetPropertyValue("ScriptText", "var shell=new ActiveXObject(\"WScript.Shell\");shell.Run(\"cmd /c echo ddd>C:\\\\1.txt\")");
var consumerPath = obj.Put();

// 创建timer
var timer = new ManagementClass(@"ROOT\subscription:__IntervalTimerInstruction").CreateInstance();
timer.SetPropertyValue("TimerId", "tm1");
timer.SetPropertyValue("IntervalBetweenEvents", 30000);
timer.SetPropertyValue("SkipIfPassed", false);
var timerPath = timer.Put();

// 创建filter
var filter = new ManagementClass(@"ROOT\subscription:__EventFilter").CreateInstance();
filter.SetPropertyValue("Name", "ft1");
filter.SetPropertyValue("Query", "select * from __timerEvent where TimerId='tm1'");
filter.SetPropertyValue("QueryLanguage", "WQL");
var filterPath = filter.Put();

// 创建binding
var binding = new ManagementClass(@"ROOT\subscription:__FilterToConsumerBinding").CreateInstance();
binding.SetPropertyValue("Consumer", consumerPath.Path);
binding.SetPropertyValue("Filter", filterPath.Path);
var bindingPath = binding.Put();

执行时由服务DCOMLAUNCH（svchost.exe）启动 scrcons.exe 进程执行脚本，每次执行完毕后 scrcons.exe 进程退出

[http://bbs.myhack58.com/read.php?tid-185642-uid-1515.html]