Files
Viper/docs/en/module/LateralMovement_PassTheHash_ByInvokeWMIExec.md
2025-04-25 21:39:22 +08:00

11 lines
384 B
Markdown

# Invoke-WMIExec Pass-the-Hash
Use known username and NTLM hash to execute payload on target host via WMI.
The module executes WMI in memory using the Invoke-WMIExec method. Compared to "WMI Pass-the-Hash", it does not require file upload.
## Operation Method
![](img/LateralMovement_PassTheHash_ByInvokeWMIExec/1.webp)
![](img/LateralMovement_PassTheHash_ByInvokeWMIExec/2.webp)