remote process creation via WMI

Requirements

• Ports needed:
  • 135/TCP, 49152-65535/TCP (DCERPC)
  • 5985/TCP (WinRM HTTP) or 5986/TCP (WinRM HTTPS)
• Administrator privilege required

To spawn a process under a WMI session:

$Command = "powershell.exe -Command Set-Content -Path C:\text.txt -Value munrawashere";
 
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{
    CommandLine = $Command
}

On legacy systems, the same can be done using wmic from the command prompt:

wmic.exe /user:Administrator /password:Mypass123 /node:TARGET process call create "cmd.exe /c calc.exe"