{"slug": "cracking-wmiexec-in-rust-by-byte-diffing-against-impacket", "title": "Cracking wmiexec in Rust by byte-diffing against impacket", "summary": "A developer used Claude Code to reimplement wmiexec in Rust by byte-diffing against impacket, achieving a tight hypothesis-to-fix loop against a live domain controller. The project involves three stages: DCOM activation, OXID resolution, and MS-WMIO object marshaling, with the developer noting that hardcoded 3.1.1 was sufficient for the negotiation table.", "body_md": "# Cracking wmiexec in Rust by byte-diffing against impacket\n\nThe whole project is built with [Claude Code](/en/tags/claude%20code/), and this was the tightest loop I've ever had with an AI. Not autocomplete — a real hypothesis → capture traffic → diff → fix cycle against a live domain controller, with Claude reading the diffs alongside me.\n\n**What wmiexec actually does**\n\nwmiexec is the classic \"quiet\" RCE path. Instead of creating a service (psexec/SVCCTL) or a scheduled task (atexec), you talk to WMI over DCOM and call `Win32_Process.Create`\n\n. No service-install event, different host telemetry. Under the hood it's three stages, each a different flavor of pain:\n\n1. **DCOM activation** — you send a `RemoteCreateInstance`\n\nto the WMI DCOM server and get back an object reference.\n\n2. **OXID resolution** — the DC returns an OXID string, and you have to call the OXID resolver to turn it into a binding. This is where most of the \"garbage error\" happens.\n\n3. **MS-WMIO object marshaling** — you invoke the WMI service and class methods with correct NDR marshalling for\n\n[Next Claude Code + OpenRouter: The Real Setup Guide →](/en/threads/4690/)\n\n## All Replies （4）\n\n[@MicroPanda](/en/users/MicroPanda/)Hardcoded 3.1.1 honestly, the negotiation table felt like overkill for wmiexec. Server just accepts it anyway.", "url": "https://wpnews.pro/news/cracking-wmiexec-in-rust-by-byte-diffing-against-impacket", "canonical_source": "https://promptcube3.com/en/threads/4848/", "published_at": "2026-08-03 12:00:56+00:00", "updated_at": "2026-08-03 12:27:11.147159+00:00", "lang": "en", "topics": ["developer-tools", "artificial-intelligence"], "entities": ["Claude Code", "wmiexec", "impacket", "Rust", "WMI", "DCOM", "OXID", "MS-WMIO"], "alternates": {"html": "https://wpnews.pro/news/cracking-wmiexec-in-rust-by-byte-diffing-against-impacket", "markdown": "https://wpnews.pro/news/cracking-wmiexec-in-rust-by-byte-diffing-against-impacket.md", "text": "https://wpnews.pro/news/cracking-wmiexec-in-rust-by-byte-diffing-against-impacket.txt", "jsonld": "https://wpnews.pro/news/cracking-wmiexec-in-rust-by-byte-diffing-against-impacket.jsonld"}}