No description, website, or topics provided.
Switch branches/tags
Nothing to show
Clone or download
Latest commit 680d22d May 11, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
Invoke-WMILM.ps1 Added Wsman protocol support, and made Command parameter mandatory May 10, 2018
LICENSE Initial commit May 8, 2018 Update May 10, 2018


This is a PoC script for various methods to acheive authenticated remote code execution via WMI, without (at least directly) using the Win32_Process class. The type of technique is determined by the "Type" parameter.


  • Target - Name or IP of target machine
  • Type - The type of technique to use
  • Protocol - Decides between the DCOM and Wsman (WinRM) protocols as the underlying transport. Default is DCOM
  • Name - For techniques creating named objects (services, tasks etc.)
  • Command - Executable to run
  • CommandArgs - Arguments to the executable
  • CleanUp - an optional phase to remove artifacts created by the various techniques
  • Username
  • Password

Supported Techniques

  • DerivedProcess - Creates a class deriving from Win32_Process, and calls the Create method of that class
  • Service - Creates a service and runs it using WMI. Basically PSEXEC with different network traffic
  • Job - Creates an at.exe style scheduled task to run in 30 seconds. Does not work on Win8+, unless at.exe is enabled
  • Task - Creates an schtasks.exe style scheduled task and runs it. Works only on Win8+
  • Product - Runs an arbitrary MSI file from a given path (given by the Command parameter)
  • Provider - Creates a new provider with the command and arguments as the underlying COM object, and loads it