wmiexec.py

Remote execution over WMI, stealthier than psexec (impacket).

Remote command execution on Windows over WMI (Impacket), stealthier than psexec because it creates no service and drops no binary. It gives a semi-shell where each command runs separately. It accepts a password or a hash.

Family Access, shells & transfer

Flags -hashes

Concepts Pass-the-Hash

Cheatsheet Post-exploitation & lateral

Installation

# All of Impacket's *.py tools ship in the same package:
pipx install impacket
# invoke them as impacket-<tool> or <Tool>.py depending on the packaging

Repositorygithub.com/fortra/impacket

Useful commands4 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.