The whole project is built with Claude Code, and this was the tightest loop I've ever had with an AI. Not autocomplete β a real hypothesis β capture traffic β diff β fix cycle against a live domain controller, with Claude reading the diffs alongside me.
What wmiexec actually does
wmiexec is the classic "quiet" RCE path. Instead of creating a service (psexec/SVCCTL) or a scheduled task (atexec), you talk to WMI over DCOM and call Win32_Process.Create
. No service-install event, different host telemetry. Under the hood it's three stages, each a different flavor of pain:
- DCOM activation β you send a
RemoteCreateInstance
to the WMI DCOM server and get back an object reference.
-
OXID resolution β the DC returns an OXID string, and you have to call the OXID resolver to turn it into a binding. This is where most of the "garbage error" happens.
-
MS-WMIO object marshaling β you invoke the WMI service and class methods with correct NDR marshalling for
Next Claude Code + OpenRouter: The Real Setup Guide β
All Replies οΌ4οΌ #
@MicroPandaHardcoded 3.1.1 honestly, the negotiation table felt like overkill for wmiexec. Server just accepts it anyway.