# WMIExec | Set Of Python Scripts Which Perform Different Ways Of Command Execution

**URL:** <https://onehack.st/t/wmiexec-set-of-python-scripts-which-perform-different-ways-of-command-execution/257591>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [October 4, 2023, 9:26pm UTC](https://onehack.st/t/wmiexec-set-of-python-scripts-which-perform-different-ways-of-command-execution/257591 "2023-10-04T21:26:47Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [October 4, 2023, 9:26pm UTC](https://onehack.st/t/wmiexec-set-of-python-scripts-which-perform-different-ways-of-command-execution/257591/1 "2023-10-04T21:26:47Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/5/5/55c6b2622181a153a86efad75a483a694ccbdfdc.png)

# [WMIexec](https://github.com/WKL-Sec/WMIExec#wmiexec)

Set of python scripts which perform different ways of command execution via WMI protocol.

## [Blog Post](https://github.com/WKL-Sec/WMIExec#blog-post)

> **[Navigating Stealthy WMI Lateral Movement | White Knight Labs](https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/)**
>
> Introduction

## [Usage](https://github.com/WKL-Sec/WMIExec#usage)

### [wmiexec\_scheduledjob.py](https://github.com/WKL-Sec/WMIExec#wmiexec_scheduledjobpy)

Is a python script which authenticates to a remote WMI instance and execute commands via Scheduled Tasks.

To run the script:

python3 wmiexec\_scheduledjob.py -i \<ip\_address\> -u -p -c

### [wmiexec\_win32process.py](https://github.com/WKL-Sec/WMIExec#wmiexec_win32processpy)

Is a python script which authenticates to a remote WMI instance and execute commands via `Win32_Process`.

To run the script:

python3 wmiexec\_win32process.py -i \<ip\_address\> -u -p -c

### [webserver\_ssl.py](https://github.com/WKL-Sec/WMIExec#webserver_sslpy)

Is a python script which creates a HTTPS server (with a self-signed SSL certificate). Used to exfiltrate the command’s output.

Before running the HTTP server, make sure to generate the certificates by running:

openssl genpkey -algorithm RSA -out server.key openssl req -new -key server.key -out server.csr openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

If everything is done correctly, the server will be running without any error:

python3 webserver\_ssl.py

## [Demo](https://github.com/WKL-Sec/WMIExec#demo)

[![wmi_in_action](https://user-images.githubusercontent.com/97109724/247627327-5384a87d-a4b2-432e-9bfe-375a34cf9e7b.mp4)](https://github.com/WKL-Sec/wmiexec/assets/97109724/5384a87d-a4b2-432e-9bfe-375a34cf9e7b)

## [Credits](https://github.com/WKL-Sec/WMIExec#credits)

> **[GitHub - XiaoliChan/wmiexec-RegOut: Modify version of impacket wmiexec.py, get...](https://github.com/XiaoliChan/wmiexec-RegOut)**
>
> Modify version of impacket wmiexec.py, get output(data,response) from registry, don't need SMB connection, also bypassing antivirus-software in lateral movement like WMIHACKER.

> **[Win32\_ScheduledJob class - Win32 apps](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob)**
>
> Represents a job created with the AT command.

## [Author](https://github.com/WKL-Sec/WMIExec#author)

Kleiton Kurti ([@kleiton0x00](https://github.com/kleiton0x00))

## GitHub:

> **[GitHub - WKL-Sec/WMIExec: Set of python scripts which perform different ways...](https://github.com/WKL-Sec/WMIExec)**
>
> Set of python scripts which perform different ways of command execution via WMI protocol.