Impacket wmiexec

wmiexec.py <domain>/<user>:'<pass>'@<target>

Executes commands on a remote Windows host from Linux using WMI, with an interactive shell and output via ADMIN$ share.

When working from your Linux attack machine and you have credentials (cleartext or NTLM hash) for an account with local admin rights on the target host. wmiexec provides a semi-interactive shell without needing to open additional ports.

If the host has WMI blocked by firewall (135) or the environment is noise-sensitive: wmiexec creates temporary files in ADMIN$ to return output. For a single one-off command, use atexec or direct WMI.