> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/remote-commands/remote-commands-via-smb-dcom.md).

# Remote Commands via SMB/DCOM

## wmiexec from Impacket

```
#   wmiexec.py
#   ----------
#   A similar approach to smbexec but executing commands through WMI.
#   Main advantage here is it runs under the user (has to be Admin)
#   account, not SYSTEM, plus, it doesn't generate noisy messages
#   in the event log that smbexec.py does when creating a service.
#   Drawback is it needs DCOM, hence, I have to be able to access
#   DCOM ports at the target machine.
```

{% hint style="info" %}
NOTE:\
`impacket-wmiexec` is really a symbolic link that point to `/usr/share/impacket/script` which is just a wrapper script:

```
┌──(kali㉿kali)-[~]
└─$ cat /usr/share/impacket/script
#!/bin/sh

name_script=$(basename $0)
example_name=${name_script##impacket-}

exec python3 /usr/share/doc/python3-impacket/examples/$example_name.py "$@"
```

{% endhint %}

The generic format for credentials and destination, also known as *target*, are:

```
[[domain/]username[:password]@]<targetName or address>
```

To launch a `cmd.exe` session on a remote machine

```bash
impacket-wmiexec Admin:Admin@192.168.88.128
```

To launch a `powershell.exe` session on a remote machine

```bash
impacket-wmiexec Admin:Admin@192.168.88.128 -shell-type powershell
```

### Built-in Commands

There are a few built-in commands that can be listed with `help`

```
C:\>help

 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 lput {src_file, dst_path}   - uploads a local file to the dst_path (dst_path = default current directory)
 lget {file}                 - downloads pathname to the current local dir
 ! {cmd}                    - executes a local shell cmd

```

### Protocols used

wmiexec uses SMB (445/tcp) and DCOM (135/tcp + high ports).

If you don't need any out put returned, you can use the `-nooutput` parameter and no SMB-connection will be needed.

### Usage information

<details>

<summary>impacket-wmiexec -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec -h                                 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

usage: wmiexec.py [-h] [-share SHARE] [-nooutput] [-ts] [-silentcommand] [-debug] [-codec CODEC] [-shell-type {cmd,powershell}] [-com-version MAJOR_VERSION:MINOR_VERSION]
                  [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-target-ip ip address] [-A authfile] [-keytab KEYTAB]
                  target [command ...]

Executes a semi-interactive shell using Windows Management Instrumentation.

positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>
  command               command to execute at the target. If empty it will launch a semi-interactive shell

options:
  -h, --help            show this help message and exit
  -share SHARE          share where the output will be grabbed from (default ADMIN$)
  -nooutput             whether or not to print the output (no SMB connection created)
  -ts                   Adds timestamp to every logging output
  -silentcommand        does not execute cmd.exe to run given command (no output)
  -debug                Turn DEBUG output ON
  -codec CODEC          Sets encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with
                        https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py again with -codec and the corresponding codec
  -shell-type {cmd,powershell}
                        choose a command processor for the semi-interactive shell
  -com-version MAJOR_VERSION:MINOR_VERSION
                        DCOM version, format is MAJOR_VERSION:MINOR_VERSION e.g. 5.7

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful for -k)
  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the
                        ones specified in the command line
  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)
  -dc-ip ip address     IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve
                        it
  -A authfile           smbclient/mount.cifs-style authentication file. See smbclient man page's -A option.
  -keytab KEYTAB        Read keys for SPN from keytab file

```

</details>

## Resources

**wmiexec.py** - Impacket - GitHub: <https://raw.githubusercontent.com/fortra/impacket/refs/heads/master/examples/wmiexec.py>