Remote Execution / WMI / Services

Back to the Command Index

This category uses RPC over SMB named pipes or DCOM to run temporary services, tasks, WMI, and Terminal Services. The execution paths are as follows.

Path	Main Interface	Commands
Deployed binary + SCMR + named pipe	scmr + RemCom	psexec
SCMR only (no persistent binary)	scmr	smbexec, services
Task Scheduler	tsch / atsvc	atexec
DCOM/WMI	dcomrt + dcom/wmi	wmiexec, wmiquery, wmipersist, dcomexec
Terminal Services	tsts	tstool
External mimikatz RPC	mimilib	mimikatz

Related Technologies

• DCE/RPC and NDR
• SMB / NetBIOS — IPC$ and pipes
• NTLM / SPNEGO / Kerberos

Temporary services, tasks, WMI filters/consumers, and deployed binaries must be removed on both success and exception paths.

Command Index

Command	Summary
atexec.py	Registers a temporary task through Task Scheduler RPC and runs a command on the target Windows host.
dcomexec.py	Uses DCOM objects to run commands or a semi-interactive shell on the target host.
psexec.py	Deploys and starts a RemCom service binary on the target, then runs commands or an interactive shell through named pipes.
smbexec.py	Creates a temporary service through SCMR and retrieves command output over an SMB share. Does not leave an execution binary permanently on the target.
wmiexec.py	Runs commands or a semi-interactive shell through DCOM/WMI Win32_Process.Create.
wmipersist.py	Creates or removes WMI event filters, consumers, and bindings to run VBScript when an event occurs.
wmiquery.py	Connects to a WMI namespace, runs WQL queries, and displays attributes of returned objects.
mimikatz.py	Connects to a mimikatz RPC server and sends commands interactively or from a file.
tstool.py	Uses Terminal Services RPC to enumerate, disconnect, log off, or terminate sessions and processes.
services.py	Uses Service Control Manager RPC to list, inspect, create, configure, start, stop, or delete services.