Remote Command Execution

Command Execution

Executing commands on a windows system requires Administrator credentials, CME automatically tells you if the credential set you're using has admin access to a host by appending '(Pwn3d!)' to the output when authentication is successful.

See the Credentialarrow-up-right section for details on how to use credentials.

Execution Methods

CME has three different command execution methods:

  • wmiexec executes commands via WMI

  • atexec executes commands by scheduling a task with windows task scheduler

  • smbexec executes commands by creating and running a service

By default CME will fail over to a different execution method if one fails. It attempts to execute commands in the following order:

  1. wmiexec

  2. atexec

  3. smbexec

If you want to force CME to use only one execution method you can specify which one using the --exec-method flag.

Executing commands

In the following example, we try to execute whoami on the target using the -x flag:

You can also directly execute PowerShell commands using the -X flag:

Bypass AMSI

Last updated