# Impacket Wmiexec

> Use for tightly scoped WMI-based remote execution validation during authorized internal pentests. Trigger on approved Windows management boundary checks and verifying whether a specific credential can execute on a specific host through WMI.

- Skill: `timsonner/impacket-wmiexec` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/impacket-wmiexec`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/impacket-wmiexec/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/impacket-wmiexec

---


# Impacket WMIExec

## Purpose

Use this skill for narrowly scoped WMI execution validation when the rules of engagement explicitly allow remote management checks.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to validate whether an approved credential has WMI-based execution rights on a specific host.
- Need a management-plane alternative to SMB service creation.
- Need a repeatable retest after WMI or host hardening changes.

## Avoid When

- Remote execution or WMI testing is not explicitly approved.
- Host stability or management-plane sensitivity is uncertain.

## Inputs

- Approved Windows host
- Authorized credential or hash context
- Stop conditions and evidence boundaries

## Procedure

1. Scope the check to the single approved host.
2. Validate only the management-plane access needed to prove the boundary.
3. Avoid persistence, broad reconnaissance, or unnecessary commands.
4. Stop once the hypothesis is answered.
5. Preserve the exact host and auth context for retest.

## Command Syntax

Replace sample domains, hosts, and credentials with approved in-scope values.

```bash
# Interactive shell via WMI
wmiexec.py contoso.com/auditor:'<password>'@10.10.10.100

# Execute a specific command and exit
wmiexec.py contoso.com/auditor:'<password>'@10.10.10.100 'whoami /all'

# Pass-the-Hash
wmiexec.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.100

# Pass-the-Ticket (Kerberos)
KRB5CCNAME=administrator.ccache wmiexec.py -k -no-pass dc01.contoso.com

# No-output mode (fire-and-forget)
wmiexec.py contoso.com/auditor:'<password>'@10.10.10.100 -nooutput 'cmd /c ipconfig > C:\Windows\Temp\out.txt'
```

## Evidence to Capture

- Whether WMI execution succeeded for the approved credential
- Exact host, account, and management path used
- Minimal reproduction path for retest

## Safety Boundaries

- Do not widen scope beyond the approved host.
- Avoid unnecessary command execution after the boundary is confirmed.