rootclay/WMIHACKER

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1465 stars · 236 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

WMIHACKER is a VBScript-based command-line tool for lateral movement on Windows hosts via WMI (port 135), avoiding the commonly detected 445/port-based service creation techniques. It supports remote command execution, interactive shell mode, and file upload/download while bypassing anti-virus detection.

Use cases

• execute commands on a remote windows host without port 445
• bypass antivirus during lateral movement testing
• get an interactive shell on a remote windows machine via wmi
• upload files to a remote windows host
• download files from a remote windows host
• red team lateral movement over wmi port 135

When to choose

• you need remote command execution on Windows using only WMI/DCOM (port 135)
• target environment blocks port 445 or detects Win32_Process.create/service-based tools like WMIEXEC and PSEXEC
• you need file transfer to/from a remote Windows host without SMB

When to avoid

• you need a stealthy, maintained C2 framework rather than a simple script
• target hosts are non-Windows or WMI/DCOM is firewalled
• you require encrypted or authenticated channels beyond WMI credentials

Facets

cli-tool · maturity maintenance

security penetration-testing cli security penetration-testing windows windows cli wmi lateral-movement av-bypass vbscript red-team post-exploitation remote-command-execution

Member repositories

For agents

markdown · JSON · MCP: product_card(name="rootclay/WMIHACKER")