Remote Execution Modes with nimux

Overview

Remote execution is not one technique. It is a decision point. Different environments allow different management protocols, logging profiles, privilege contexts, output behavior, and authentication paths. nimux exposes several execution modes so the operator can choose the least disruptive method that proves the assessment objective.

This article compares the major nimux execution modes and shows neutral command patterns.

Start with reachability and authentication

Before running commands, confirm the management ports and authentication context.

nimux scan server01.corp.local --port 135,445,5985,5986 --open

nimux smb server01.corp.local -d corp.local -u operator -p '<password>' --shares

nimux winrm server01.corp.local -d corp.local -u operator -p '<password>' --cmd whoami

Use Kerberos when that is the expected authentication path:

nimux winrm server01.corp.local -d corp.local -k \
  --ccache operator.ccache \
  --cmd whoami

WinRM

WinRM is the cleanest option when it is enabled and the account has remote management rights. It gives direct command output and supports an interactive shell.

nimux winrm server01.corp.local -d corp.local -u operator -p '<password>' \
  --cmd 'whoami /all'

nimux winrm server01.corp.local -d corp.local -u operator -p '<password>' --shell

Use TLS when the environment requires it:

nimux winrm server01.corp.local -d corp.local -u operator -p '<password>' \
  --ssl \
  --cmd hostname

WinRM should usually be the first choice for authorized administration-style validation.

CIM and WMI

The cim command uses DCOM/WMI and Win32_Process.Create. It is useful when WinRM is unavailable but DCOM and WMI are reachable.

nimux cim server01.corp.local -d corp.local -u operator -p '<password>' \
  --cmd 'ipconfig /all'

nimux cim server01.corp.local -d corp.local -u operator -H <nt_hash> \
  --cmd whoami

Interactive mode is available:

nimux cim server01.corp.local -d corp.local -u operator -p '<password>' --shell

Use CIM when WMI is part of the approved assessment path and you need command output without deploying a helper service.

SCM service execution

The scm command uses the Service Control Manager. It is useful when SMB and SCM are reachable and the account has local administrator rights.

nimux scm server01.corp.local -d corp.local -u Administrator -H <nt_hash> \
  --cmd 'dir C:\'

The SCM mode runs in session 0 as SYSTEM. The source help notes that some Win32 console applications may not return stdout reliably in that service context, so use winrm, cim, or bin when reliable output matters.

Helper service mode

The bin mode uses SCM plus a Nim helper service. It is designed for reliable output from normal console programs and supports interactive shell workflows.

nimux bin server01.corp.local -d corp.local -u Administrator -p '<password>' \
  --cmd whoami

nimux bin server01.corp.local -d corp.local -u Administrator -H <nt_hash> \
  --cmd tasklist

Interactive helper shell:

nimux bin server01.corp.local -d corp.local -u Administrator -p '<password>' --shell

Use bin when the test requires reliable command output and the temporary helper-service behavior is approved.

Task Scheduler mode

The task aliases include task, sch, schtask, and atexec. This mode is useful when scheduled task execution is the approved control path.

nimux task server01.corp.local -d corp.local -u Administrator -p '<password>' \
  --cmd whoami

nimux sch server01.corp.local -d corp.local -u Administrator -H <nt_hash> \
  --cmd 'ipconfig /all'

Interactive shell mode is available:

nimux task server01.corp.local -d corp.local -u Administrator -p '<password>' --shell

Scheduled task execution is stateful by nature. Document task creation, command, result, and cleanup.

DCOM MMC mode

The mmc command executes through DCOM IDispatch objects. It supports several object choices.

nimux mmc server01.corp.local -d corp.local -u Administrator -p '<password>' \
  --cmd whoami

nimux mmc server01.corp.local -d corp.local -u Administrator -p '<password>' \
  --cmd whoami \
  --object ShellWindows

nimux mmc server01.corp.local -d corp.local -u Administrator -H <nt_hash> \
  --cmd 'ipconfig /all'

Use DCOM only when it is in scope and when the DCOM object behavior is understood.

Choosing the mode

A practical selection order is:

1. WinRM when available and approved. 2. CIM/WMI when WinRM is unavailable and WMI is allowed. 3. Helper service when reliable output is required and temporary service deployment is allowed. 4. SCM when simple service execution is enough. 5. Scheduled task when that path is expected or more reliable. 6. DCOM when the environment supports it and the method is in scope.

Reporting

Always report the protocol, authentication method, account context, command, host, output, and cleanup state. Remote execution findings should explain why the account had the ability to execute, not only that a command returned output.