User Guide >

Dcom

Dcom

Utility for working with DCOM

Synopsis

Dcom <subcommand>

Subcommands

Command Description
activate Activates an object over DCOM
invoke Invokes a method on an OLE automation object over DCOM

For help on a subcommand, use Dcom <subcommand> -h

Dcom activate

Activates an object over DCOM

Synopsis

Dcom activate [options] -Clsid <Guid> <ServerName> <Clsid>

Parameters

Name Aliases Value Description
<ServerName>   <String> Name of the server to connect to
-Clsid   <Guid> CLSID of object to activate

Options

Name Aliases Value Description
-AuthEpm   <SwitchParam> Authenticates EP mapper requests
-AuthProxy   <EndPoint> Endpoint of auth proxy
-Clsid   <Guid> CLSID of object to activate
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-Delegate   <SwitchParam> Requests delegation (sends TGT and key for Kerberos)
-EncryptEpm   <SwitchParam> Encrypts EP mappend requests
-EncryptRpc   <SwitchParam> Encrypts RPC messages
-FileName   <String> Name of file to activate
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-PreferSmb   <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-RpcCallTimeout   <Duration> Time to wait for RPC calls
-RpcConnectTimeout   <Duration> Time to wait for RPC connections
-Socks5   <host-or-ip:port> End point of SOCKS 5 server to use
-Spnego   <SwitchParam> Uses SP-NEGO for authentication
-SpnOverride   <SpnMapping[]> Specifies an SPN override

Authentication

Name Aliases Value Description
-Anonymous   <SwitchParam> Uses anonymous login
-NtlmHash   <hexadecimal hash> NTLM hash for NTLM authentication
-Password -p <String> Password to authenticate with
-UserDomain -ud <String> Domain of user to authenticate with
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain

Authentication (Kerberos)

Name Aliases Value Description
-AesKey   <HexString> AES key (128 or 256)
-DelegateTicket   <String[]> Sends the tickets (and keys) to the target for delegation
-DesKey   <HexString> DES key
-Kdc   <host-or-ip:port> KDC endpoint
-Keytab   <String> Name of keytab file
-S4ProxyService   <SecurityPrincipalName> Name of service to proxy through
-S4UserCert   <String> Name of file containing a certificate of a user to impersonate with S4U
-S4UserName   <UserPrincipalName> Name of user to impersonate with S4U
-Tgt   <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-TicketCache   <String> Name of ticket cache file
-Tickets -Ticket <String[]> Name of file containing service tickets (.kirbi or ccache)
-U2UserName   <UserPrincipalName> User name to request TGT for U2U
-UserCert   <String> Name of file containing user’s certificate (for PKINIT)
-UserKey   <String> Name of file containing user’s key (for PKINIT)
-UserKeyPassword   <String> Password to decrypt file containing user’s key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-NtlmVersion   <Version> NTLM version number (a.b.c.d)
-Workstation -w <String> Name of workstation to send with NTLM authentication

Client Behavior

Name Aliases Value Description
-DfsReferralBufferSize   <Int32> Specifies the size for the DFS referral buffer (default=4096)
-FollowDfs   <SwitchParam> Checks for and follows DFS referrals (default=true)

Connection

Name Aliases Value Description
-Dialects   <Smb2Dialect[]> List of SMB2 dialects to negotiate
      Possible values:
      Smb2_0_2
      Smb2_1
      Smb3_0
      Smb3_0_2
      Smb3_1_1
-EncryptSmb   <SwitchParam> Requires an encrypted connection
-HostAddress -ha <String[]> Network address(es) of the server
-RequireSecureNegotiate   <SwitchParam> Requires the client to authenticate the negotiation
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint

Output

Name Aliases Value Description
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-Verbose -V <SwitchParam> Prints verbose messages

Dcom invoke

Invokes a method on an OLE automation object over DCOM

Synopsis

Dcom invoke [options] -MethodName <String> -Clsid <Guid> <ServerName> <Clsid> <MethodName> [ <Arguments> ]

Parameters

Name Aliases Value Description
<ServerName>   <String> Name of the server to connect to
-Clsid   <Guid> CLSID of object to activate
-M, -MethodName   <String> Name of method to invoke
-Arguments   <String[]> Arguments to pass to the method

Options

Name Aliases Value Description
-Arguments   <String[]> Arguments to pass to the method
-AuthEpm   <SwitchParam> Authenticates EP mapper requests
-AuthProxy   <EndPoint> Endpoint of auth proxy
-Clsid   <Guid> CLSID of object to activate
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-Delegate   <SwitchParam> Requests delegation (sends TGT and key for Kerberos)
-EncryptEpm   <SwitchParam> Encrypts EP mappend requests
-EncryptRpc   <SwitchParam> Encrypts RPC messages
-FileName   <String> Name of file to activate
-M, -MethodName   <String> Name of method to invoke
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-PreferSmb   <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-RpcCallTimeout   <Duration> Time to wait for RPC calls
-RpcConnectTimeout   <Duration> Time to wait for RPC connections
-Socks5   <host-or-ip:port> End point of SOCKS 5 server to use
-Spnego   <SwitchParam> Uses SP-NEGO for authentication
-SpnOverride   <SpnMapping[]> Specifies an SPN override

Authentication

Name Aliases Value Description
-Anonymous   <SwitchParam> Uses anonymous login
-NtlmHash   <hexadecimal hash> NTLM hash for NTLM authentication
-Password -p <String> Password to authenticate with
-UserDomain -ud <String> Domain of user to authenticate with
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain

Authentication (Kerberos)

Name Aliases Value Description
-AesKey   <HexString> AES key (128 or 256)
-DelegateTicket   <String[]> Sends the tickets (and keys) to the target for delegation
-DesKey   <HexString> DES key
-Kdc   <host-or-ip:port> KDC endpoint
-Keytab   <String> Name of keytab file
-S4ProxyService   <SecurityPrincipalName> Name of service to proxy through
-S4UserCert   <String> Name of file containing a certificate of a user to impersonate with S4U
-S4UserName   <UserPrincipalName> Name of user to impersonate with S4U
-Tgt   <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-TicketCache   <String> Name of ticket cache file
-Tickets -Ticket <String[]> Name of file containing service tickets (.kirbi or ccache)
-U2UserName   <UserPrincipalName> User name to request TGT for U2U
-UserCert   <String> Name of file containing user’s certificate (for PKINIT)
-UserKey   <String> Name of file containing user’s key (for PKINIT)
-UserKeyPassword   <String> Password to decrypt file containing user’s key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-NtlmVersion   <Version> NTLM version number (a.b.c.d)
-Workstation -w <String> Name of workstation to send with NTLM authentication

Client Behavior

Name Aliases Value Description
-DfsReferralBufferSize   <Int32> Specifies the size for the DFS referral buffer (default=4096)
-FollowDfs   <SwitchParam> Checks for and follows DFS referrals (default=true)

Connection

Name Aliases Value Description
-Dialects   <Smb2Dialect[]> List of SMB2 dialects to negotiate
      Possible values:
      Smb2_0_2
      Smb2_1
      Smb3_0
      Smb3_0_2
      Smb3_1_1
-EncryptSmb   <SwitchParam> Requires an encrypted connection
-HostAddress -ha <String[]> Network address(es) of the server
-RequireSecureNegotiate   <SwitchParam> Requires the client to authenticate the negotiation
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint

Output

Name Aliases Value Description
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-Verbose -V <SwitchParam> Prints verbose messages

Details

Dcom invoke activates the object with the specified CLSID and attempts to invoke the specified method. The arguments are not parsed locally and are all passed as strings. It is up to the server to coerce them to the correct type. Most implementations rely on OLE automation to do this.

The -MethodName may specify either a method or a property. If it is a property, the value of the property is retrieved and printed.

If the method is specified as a dot-separated multi-part name, this is interpreted as a property path. The properties are retrieved one by one. The last part is interpreted as the actual name of the method to invoke on the resulting object.

Examples

Example 1 - Invoke MMC20 ExecuteShellCommand

Dcom invoke LUMON-FS1 -UserName milchick@LUMON -Password Br3@kr00m! 49B2791A-B1AE-4C90-9B8E-E860BA07F889 Document.ActiveView.ExecuteShellCommand "cmd.exe" C:\ " /c whoami" ""

The CLSID corresponds to MMC20.Application. This object is activated, then the properties Document and retrieved ActiveView, and finally ExecuteShellCommand is executed on the ActiveView object.

Example 2 - Invoke MMC20 ExecuteShellCommand with FQDN

Dcom invoke LUMON-FS1.lumon.ind -UserName milchick@LUMON -Password Br3@kr00m! -Kdc LUMON-DC1 49B2791A-B1AE-4C90-9B8E-E860BA07F889 Document.ActiveView.ExecuteShellCommand "cmd.exe" C:\ " /c whoami" ""

The CLSID corresponds to MMC20.Application. This object is activated, then the properties Document and retrieved ActiveView, and finally ExecuteShellCommand is executed on the ActiveView object.