security enabled verified high v1.0.0

wmiexec

Impacket tool for semi-interactive remote command execution over Windows Management Instrumentation (WMI) without deploying services or agents.

📋 Live Preview

python3 /usr/share/doc/python3-impacket/examples/wmiexec.py {target} {flags}

📎 target 📎 flags

python3 /usr/share/doc/python3-impacket/examples/wmiexec.py {target} {flags}

Sandbox: execFile · Timeout: 300s

Capabilities

security.lateral.wmi

security.execution.remote

security.shell.remote

security.ad.service.control

security.credential.pth

Parameters

Name	Type	Required	Default	Description	Aliases
`target`	string	Yes	-	Target host in format: domain/username:password@host	-
`command`	string	No	-	Command to execute (if omitted, opens a semi-interactive shell)	-
`flag-share`	string	No	-	SMB share to use (default: ADMIN$)	`-share`
`flag-nooutput`	boolean	No	-	Do not retrieve command output	`-nooutput`
`flag-comspec`	string	No	-	Windows cmd.exe path (default: cmd.exe)	`-comspec`
`flag-silentcommand`	boolean	No	-	Use silent command mode	`-silentcommand`

Contract

Inputs

network.target.ip

Target Windows host IP

credential.username

Username for authentication

credential.password

Plaintext password or NTLM hash

domain.name

Target domain name

Outputs

command.output

Remote command execution output

session.shell

Semi-interactive shell session

Side effects: network_trafficprocess_spawn

Workflow Edges

Produces

command.outputsession.shell

Consumes

network.target.ipcredential.usernamecredential.passworddomain.name

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	low
Disk I/O	none

Examples

Open a semi-interactive shell

impacket-wmiexec domain/username:password@10.0.0.1

Execute a single command

impacket-wmiexec domain/username:password@10.0.0.1 "whoami"

Execute command with NTLM hash (pass-the-hash)

impacket-wmiexec -hashes LM:HASH domain/username@10.0.0.1 "whoami"

Run with local admin account

impacket-wmiexec ./administrator:password@10.0.0.1

Documentation

wmiexec.py — WMI Remote Command Execution

wmiexec.py is an Impacket tool that provides semi-interactive command execution over Windows Management Instrumentation (WMI). Unlike psexec.py, it does not deploy any service or agent on the target, making it stealthier for lateral movement.

Key Features

Semi-interactive shell via WMI
No service deployment (stealthier than psexec)
Pass-the-hash support
Supports local and domain authentication
No binary dropped on disk

Usage

# Basic shell
impacket-wmiexec domain/user:Pass@192.168.1.100

# Single command
impacket-wmiexec domain/user:Pass@192.168.1.100 "ipconfig"

# Pass-the-hash
impacket-wmiexec -hashes aad3b435b51404eeaad3b435b51404ee:NT_HASH user@192.168.1.100

# Local admin
impacket-wmiexec ./admin:Pass@192.168.1.100