How do I install the Impacket Wmiexec skill?

Run npx skillmds@latest add timsonner/impacket-wmiexec in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Impacket Wmiexec safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Impacket Wmiexec?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Impacket Wmiexec free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Impacket Wmiexec?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Impacket Wmiexec by timsonner — Agent Skill

Name: Impacket Wmiexec
Author: timsonner

Impacket Wmiexec

Use for tightly scoped WMI-based remote execution validation during authorized internal pentests. Trigger on approved Windows management boundary checks and verifying whether a specific credential can execute on a specific host through WMI.

timsonner f6e161b 2.3 KB Updated Sep 17, 2026

File contents

Impacket WMIExec

Purpose

Use this skill for narrowly scoped WMI execution validation when the rules of engagement explicitly allow remote management checks.

Phase Fit

Primary: Validation and Controlled Impact Demonstration
Secondary: Retest and Closure

Use When

Need to validate whether an approved credential has WMI-based execution rights on a specific host.
Need a management-plane alternative to SMB service creation.
Need a repeatable retest after WMI or host hardening changes.

Avoid When

Remote execution or WMI testing is not explicitly approved.
Host stability or management-plane sensitivity is uncertain.

Inputs

Approved Windows host
Authorized credential or hash context
Stop conditions and evidence boundaries

Procedure

Scope the check to the single approved host.
Validate only the management-plane access needed to prove the boundary.
Avoid persistence, broad reconnaissance, or unnecessary commands.
Stop once the hypothesis is answered.
Preserve the exact host and auth context for retest.

Command Syntax

Replace sample domains, hosts, and credentials with approved in-scope values.

# Interactive shell via WMI
wmiexec.py contoso.com/auditor:'<password>'@10.10.10.100

# Execute a specific command and exit
wmiexec.py contoso.com/auditor:'<password>'@10.10.10.100 'whoami /all'

# Pass-the-Hash
wmiexec.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.100

# Pass-the-Ticket (Kerberos)
KRB5CCNAME=administrator.ccache wmiexec.py -k -no-pass dc01.contoso.com

# No-output mode (fire-and-forget)
wmiexec.py contoso.com/auditor:'<password>'@10.10.10.100 -nooutput 'cmd /c ipconfig > C:\Windows\Temp\out.txt'

Evidence to Capture

Whether WMI execution succeeded for the approved credential
Exact host, account, and management path used
Minimal reproduction path for retest

Safety Boundaries

Do not widen scope beyond the approved host.
Avoid unnecessary command execution after the boundary is confirmed.

---name: impacket-wmiexecdescription: Use for tightly scoped WMI-based remote execution validation during authorized internal pentests. Trigger on approved Windows management boundary checks and verifying whether a specific credential can execute on a specific host through WMI.license: MIT---# Impacket WMIExec## PurposeUse this skill for narrowly scoped WMI execution validation when the rules of engagement explicitly allow remote management checks.## Phase Fit- Primary: Validation and Controlled Impact Demonstration- Secondary: Retest and Closure## Use When- Need to validate whether an approved credential has WMI-based execution rights on a specific host.- Need a management-plane alternative to SMB service creation.- Need a repeatable retest after WMI or host hardening changes.## Avoid When- Remote execution or WMI testing is not explicitly approved.- Host stability or management-plane sensitivity is uncertain.## Inputs- Approved Windows host- Authorized credential or hash context- Stop conditions and evidence boundaries## Procedure1. Scope the check to the single approved host.2. Validate only the management-plane access needed to prove the boundary.3. Avoid persistence, broad reconnaissance, or unnecessary commands.4. Stop once the hypothesis is answered.5. Preserve the exact host and auth context for retest.## Command SyntaxReplace sample domains, hosts, and credentials with approved in-scope values.```bash# Interactive shell via WMIwmiexec.py contoso.com/auditor:'<password>'@10.10.10.100# Execute a specific command and exitwmiexec.py contoso.com/auditor:'<password>'@10.10.10.100 'whoami /all'# Pass-the-Hashwmiexec.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.100# Pass-the-Ticket (Kerberos)KRB5CCNAME=administrator.ccache wmiexec.py -k -no-pass dc01.contoso.com# No-output mode (fire-and-forget)wmiexec.py contoso.com/auditor:'<password>'@10.10.10.100 -nooutput 'cmd /c ipconfig > C:\Windows\Temp\out.txt'```## Evidence to Capture- Whether WMI execution succeeded for the approved credential- Exact host, account, and management path used- Minimal reproduction path for retest## Safety Boundaries- Do not widen scope beyond the approved host.- Avoid unnecessary command execution after the boundary is confirmed.

Frequently asked questions