RemProc — Remote Windows Process Manager

RemProc connects to a remote Windows machine via WMI (DCOM) and lets you interactively browse running processes and select which ones to terminate.

# Recommended: domain as a separate flag (no escaping headaches)
python3 remproc.py <hostname-or-ip> -u username -d DOMAIN

# Also works (but must quote the backslash):
python3 remproc.py 192.168.1.100 -u 'DOMAIN\username'

---

Requirements

• Python 3.10+
• The target Windows machine must:
  • Be reachable over the network
  • Have DCOM (port 135/TCP) accessible (enabled by default on Windows)
  • Allow WMI through the firewall, or be on the same trusted network
  • Your account must have administrative privileges on the remote machine
  • Domain accounts work seamlessly; local accounts work too

---

Setup

# 1. Create a virtual environment (isolated dependencies)
python3 -m venv venv

# 2. Activate it
source venv/bin/activate

# 3. Install the single dependency
pip install -r requirements.txt

Dependencies are in requirements.txt:

impacket>=0.13.0

No global installation — everything stays inside venv/.

---

Usage

Basic — list processes and kill interactively

# ✅ Recommended: domain as a separate flag
./venv/bin/python3 remproc.py 192.168.1.100 -u username -d DOMAIN

# ✅ Hostname resolves via DNS (domain as separate flag)
./venv/bin/python3 remproc.py pc-name -u username -d DOMAIN

# Also works: DOMAIN\user syntax (must quote the backslash!)
./venv/bin/python3 remproc.py 192.168.1.100 -u 'DOMAIN\username'

# With password on command line (less secure)
./venv/bin/python3 remproc.py 192.168.1.100 -u username -d DOMAIN -p P@ssw0rd

Watch mode — keep polling on a loop

./venv/bin/python3 remproc.py 192.168.1.100 -u MYDOMAIN\admin --watch --delay 5

This re-lists processes every 5 minutes and lets you kill each cycle.

Help

./venv/bin/python3 remproc.py --help

---

Interactive session walkthrough

$ ./venv/bin/python3 remproc.py 192.168.1.100 -u username -d DOMAIN
Password: [hidden input]

[+] Resolved pc-name → 192.168.1.100
[+] Connecting to 192.168.1.100 as DOMAIN\username ...
[+] Connected successfully

[*] Fetching process list ...

  #      PID      Name                                          SessionId
  -------------------------------------------------------------------------
  1      4        System                                        0
  2      472      smss.exe                                      0
  3      580      csrss.exe                                     0
  ...
  42     1234     SmartPSS.exe                                  1
  ...
  142    5678     OUTLOOK.EXE                                   1

  Total: 142 processes

Enter process numbers to kill (e.g. 1,3,5 or 1-5) [0=cancel]: 42, 142

[*] Killing 2 process(es) ...
  [OK] Killed SmartPSS.exe (PID: 1234)
  [OK] Killed OUTLOOK.EXE (PID: 5678)
[+] Done: 2 killed, 0 failed
[*] Connection closed.

Selection syntax

Input	Meaning
42	Kill process #42 only
1, 3, 5	Kill processes #1, #3, #5
1 3 5	Same (space works too)
1-10	Kill processes #1 through #10
1-5, 42, 100-110	Mix of ranges and singles
3168	Kill the process with PID 3168
8, 3168	Mix of line # and PID
#8, #3168	# prefix is also accepted
0 or Enter	Cancel — do nothing

Numbers within the process count are treated as line numbers (# column); larger numbers are looked up by PID automatically.

---

How RemProc Works

1. Resolve — If you pass a hostname, it's resolved to an IP via DNS. If you pass an IP address, it's used as-is.

2. Connect — A DCOM connection is established to the remote machine over port 135 (TCP). Authentication uses the credentials you provide. The connection is encrypted using the Windows authentication protocol.

3. Query — A WMI query (SELECT * FROM Win32_Process) is executed over the DCOM session. All running processes are retrieved.

4. Select — Processes are displayed in a numbered table. You enter the numbers of the processes you want to terminate using simple syntax (comma, space, ranges).

5. Kill — For each selected process, the Terminate method is called via WMI on Win32_ProcessHandle. Results are reported individually.

6. Cleanup — The DCOM connection is properly closed when done.

---

Password handling

Method	Security	How it works
-p flag	⚠️ Less safe	Password is visible in shell history and process list
Omit -p	✅ Safe	getpass.getpass() prompts for password with hidden input (no echo)
Env variable	Can be added	If you need this, wrap it: -p "$MY_PASSWORD"

The recommended approach is to omit -p — the script will prompt for the password securely without showing it on screen.

Example:

./venv/bin/python3 remproc.py 192.168.1.100 -u MYDOMAIN\admin
Password: [typing is hidden]

---

Troubleshooting

Symptom	Likely cause
DCOM connection failed: ...	Port 135 blocked, host unreachable, or wrong IP/hostname
WMI login failed: ...	Wrong username, password, or insufficient privileges. Also: shell ate your backslash — use -d flag instead
ExecQuery returns 0 processes	Multi-homed target: OXID resolver picks wrong IP. Retried automatically with IP-binding patch.
Failed to kill ...	You don't have rights to terminate that process
Name or service not known	Hostname doesn't resolve — use the IP directly instead

Firewall on target Windows machine

If the target has a firewall, ensure these rules are enabled (they are ON by default for domain networks):

netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes

---

Project structure

remproc/
├── remproc.py          ← The tool (single file)
├── requirements.txt    ← Python dependencies
├── venv/               ← Isolated virtual environment (not committed)
└── README.md           ← This file

---

License

MIT — do whatever you want with it.