Impacket wmiquery.py

Back to the category index / Back to the command index

Overview

Connects to a WMI namespace, runs WQL queries, and displays the properties of returned objects.

Item	Details
Implementation	examples/wmiquery.py
Category	Remote execution / WMI / services
Size	219 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and input

Run python examples/wmiquery.py -h for the current option definitions.

Argument	Description
target	[[domain/]username[:password]@]
-namespace	Namespace name (default: //./root/cimv2)
-file	File containing commands for the WQL shell
-debug	Enable debug output
-ts	Add a timestamp to each log message
-com-version	DCOM version in MAJOR_VERSION:MINOR_VERSION format, for example 5.7
-hashes	NTLM hashes in LMHASH:NTHASH format
-no-pass	Do not prompt for a password (useful with -k)
-k	Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line
-aesKey	AES key for Kerberos authentication (128 or 256 bits)
-dc-ip	Domain controller IP address; if omitted, use the domain name (FQDN) from the target parameter
-rpc-auth-level	RPC authentication level: default, integrity (RPC_C_AUTHN_LEVEL_PKT_INTEGRITY), or privacy (RPC_C_AUTHN_LEVEL_PKT_PRIVACY); for example, the CIM path “root/MSCluster” requires privacy by default (choices: integrity, privacy, default)

Detailed processing flow

The tool creates a DCOM connection and logs into the specified namespace (default: root\cimv2). It passes each WQL query to ExecQuery, retrieves objects from the enumerator, displays property names, types, and values, and repeats until it receives the end-of-enumeration status. The RPC authentication level can be set to integrity or privacy.

How it works

A WMI query resembles SQL, but selects WMI class instances or metadata with WQL. This command proceeds through DCOM connection, namespace login, ExecQuery, and enumeration. The namespace defines the scope of classes the query can reference. The same WQL query can return different results, or fail to find a class, in another namespace.

ExecQuery returns a COM enumerator rather than an array of all results. The client calls Next in batches, reads each object’s property set, and treats the HRESULT that marks the end of enumeration as normal termination. Property values may be scalars, arrays, NULL, or embedded objects, so display should retain types and missing values.

-file runs multiple queries in sequence over the same authenticated DCOM/WMI session. A syntax error in one query need not break the entire connection. The RPC authentication level controls packet integrity or privacy, a separate layer from WMI authorization. Releasing query objects and enumerators also matters during long batches.

Key implementation elements

Symbol	Location	Where to trace its responsibility
module-level entry	1	Parses arguments and runs at the top level

Dependencies

Within Impacket

Module	Main names used
impacket.examples	logger
impacket.examples.utils	parse_target
impacket	version
impacket.dcerpc.v5.dtypes	NULL
impacket.dcerpc.v5.dcom	wmi
impacket.dcerpc.v5.dcomrt	COMVERSION, DCOMConnection
impacket.dcerpc.v5.rpcrt	RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY

Output, side effects, and required privileges

• The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.

Failure paths and cleanup

• On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.

When changing the implementation

The code depends on dcerpc.v5.dcomrt, dcom.wmi, and rpcrt. The top-level CLI currently handles orchestration; if adding reusable features, separate query execution and display into a class or functions.

Verification

• Syntax: python -m py_compile examples/wmiquery.py
• CLI: python examples/wmiquery.py -h
• Related test: tests/SMB_RPC/test_rpcrt.py
• Related test: tests/dcerpc/test_dcomrt.py