# rootclay/WMIHACKER

A Bypass Anti-virus Software Lateral Movement Command Execution Tool

Repository: https://github.com/rootclay/WMIHACKER
Canonical: https://ross.abutalabs.com/products/wmihacker
Language: VBScript
License: Apache-2.0
License Family: permissive
Last push: 2025-01-20T15:37:28+00:00

## Health v2 (maintenance only)
Score: 33/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 2, release rhythm 35, longevity 100
- inputs: {"age_days": 2253, "days_push": 590, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1465, forks 236 (observed 2026-08-28T04:04:48.314067+00:00)

## What it is
WMIHACKER is a VBScript-based command-line tool for lateral movement on Windows hosts via WMI (port 135), avoiding the commonly detected 445/port-based service creation techniques. It supports remote command execution, interactive shell mode, and file upload/download while bypassing anti-virus detection.

## Use cases
- execute commands on a remote windows host without port 445
- bypass antivirus during lateral movement testing
- get an interactive shell on a remote windows machine via wmi
- upload files to a remote windows host
- download files from a remote windows host
- red team lateral movement over wmi port 135

## When to choose
- you need remote command execution on Windows using only WMI/DCOM (port 135)
- target environment blocks port 445 or detects Win32_Process.create/service-based tools like WMIEXEC and PSEXEC
- you need file transfer to/from a remote Windows host without SMB

## When to avoid
- you need a stealthy, maintained C2 framework rather than a simple script
- target hosts are non-Windows or WMI/DCOM is firewalled
- you require encrypted or authenticated channels beyond WMI credentials

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, cli
- domain: security, penetration-testing, windows
- platform: windows, cli
- tags: wmi, lateral-movement, av-bypass, vbscript, red-team, post-exploitation, remote-command-execution

## Member repositories
- rootclay/WMIHACKER (main) score 33

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:48.314067+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:35:06.900554+00:00, confidence not recorded.
  - readme: https://github.com/rootclay/WMIHACKER (fetched 2026-08-28T04:04:48.314067+00:00, sha cc4a6e4cf6fb)
- Data as of 2026-08-30T08:39:29.467469+00:00.