Impacket dcomexec

dcomexec.py <domain>/<user>:'<pass>'@<target>

Executes commands on a remote Windows host from Linux by abusing DCOM objects (MMC20.Application or ShellWindows) with an interactive semi-shell.

When you need remote execution without creating services (unlike smbexec) and without relying on WinRM. dcomexec uses RPC (135) and returns output via SMB, providing a semi-shell similar to wmiexec but through a different vector that sometimes goes unnoticed.

If the host has DCOM activation restrictions (Machine Launch Restrictions) or the firewall blocks 135. Also avoid it if the blue team correlates the RPC+SMB combination as an Impacket signature.