Cracking WMI-exec in Rust by turning impacket into a byte-level oracle

How I implemented wmiexec from scratch in Rust — DCOM activation, OXID resolution, and MS-WMIO object marshaling — by using impacket not as a library but as a debugging oracle, and diffing my wire bytes against it until a Windows DC accepted them byte-for-byte.

This is a build log from ADhammer, an Active Directory audit + validation toolkit I'm writing in Rust on a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack (think "impacket for Rust"). The whole project is built with Claude Code, and this post is the single best example of what that actually looks like — not autocomplete, but a tight loop of hypothesis → capture live traffic → diff → fix against a real domain controller.

The goal: wmiexec, from scratch

wmiexec is the classic "quiet" remote-code-execution technique: instead of creating a service (psexec/SVCCTL) or a scheduled task (atexec), you talk to WMI over DCOM and call Win32_Process.Create. No service-install event, different host telemetry.

Under the hood it's three stages, each a different flavour of pain: