Impacket wmiexec.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Runs commands or a semi-interactive shell through DCOM/WMI Win32_Process.Create.
| Item | Details |
|---|---|
| Implementation | examples/wmiexec.py |
| Category | Remote execution / WMI / services |
| Size | 469 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/wmiexec.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@] |
-share | Share from which to retrieve output (default: ADMIN$) |
-nooutput | Do not print output (no SMB connection is created) |
-ts | Add a timestamp to each log message |
-silentcommand | Run the given command without cmd.exe (no output) |
-debug | Enable debug output |
-codec | Help text generated dynamically from the runtime value |
-shell-type | Command processor for the semi-interactive shell (choices: cmd, powershell; default: cmd) |
-com-version | DCOM version in MAJOR_VERSION:MINOR_VERSION format, for example 5.7 |
command | Command to run on the target; if empty, launch a semi-interactive shell |
-hashes | NTLM hashes in LMHASH:NTHASH format |
-no-pass | Do not prompt for a password (useful with -k) |
-k | Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line |
-aesKey | AES key for Kerberos authentication (128 or 256 bits) |
-dc-ip | Domain controller IP address; if omitted, use the domain name (FQDN) from the target parameter |
-target-ip | Target machine IP address; if omitted, use the target value. Useful when a NetBIOS target name cannot be resolved |
-A | smbclient/mount.cifs-style authentication file; see smbclient manual page option -A |
-keytab | Read SPN keys from a keytab file |
Related technology: DCOM/WMI in DCE/RPC and output retrieval over SMB.
Detailed processing flow
Section titled “Detailed processing flow”The tool connects over DCOM, logs into the WMI root\cimv2 namespace, obtains Win32_Process, and creates a process. With output enabled, it redirects the command to a temporary file on a share and reads it back over SMB. A path equivalent to -nooutput runs without an SMB connection in a fire-and-forget mode.
How it works
Section titled “How it works”WMIEXEC connects to the WMI service over DCOM and calls the Create method
of the Win32_Process class in the root\cimv2 namespace. Unlike approaches
that create an SCMR service, Windows Management Instrumentation provides the
control plane for process creation. DCOM authentication and WMI namespace login are separate stages.
A WMI method returns process creation status and a PID, but not stdout.
To capture output, a shell command redirects it to a temporary file on an SMB
share. RemoteShell.get_output() waits for the file, then reads it.
The -silentcommand and no-output paths avoid this SMB dependency, but also
reduce the ability to observe completion and the exit code.
For the interactive shell, cd keeps the remote current directory in local
state and prefixes it to the next command. The WMI process itself has no persistent
current directory. Manage the lifecycles of DCOM interface releases, the WMI login
object, the SMB session, and temporary files separately.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
WMIEXEC | 49 | __init__(), run() |
RemoteShell | 121 | __init__(), do_shell(), do_help(), do_lcd(), do_lget(), do_lput(), do_exit(), do_EOF(), emptyline(), do_cd(), default(), get_output(), and others |
AuthFileSyntaxError | 305 | __init__() |
load_smbclient_auth_file() | 319 | Module function |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket | version |
impacket.smbconnection | SMB2_DIALECT_002, SMB2_DIALECT_21, SMBConnection, SMB_DIALECT |
impacket.dcerpc.v5.dcomrt | COMVERSION, DCOMConnection |
impacket.dcerpc.v5.dcom | wmi |
impacket.dcerpc.v5.dtypes | NULL |
impacket.krb5.keytab | Keytab |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- Some operations change the target’s state. Check the target name, SID, and path before making changes.
- Some paths use temporary resources such as remote services, tasks, files, shares, and WMI/RPC resources. Cleaning them up after an abnormal exit is part of the behavior contract.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
- Even without an explicit cleanup function, check for
finally-equivalent paths and closure or deletion of protocol handles.
When changing the implementation
Section titled “When changing the implementation”The code depends on dcerpc.v5.dcomrt, dcom.wmi, SMBConnection, and keytabs. WMIEXEC owns the WMI session, while RemoteShell owns commands and file transfers. Preserve COM releases and temporary-file removal.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/wmiexec.py - CLI:
python examples/wmiexec.py -h - Related test:
tests/dcerpc/test_dcomrt.py