Skip to main content

​
Overview

impacket-atexec executes commands on a remote Windows host by creating a scheduled task via the ATSVC (Task Scheduler) named pipe. The command output is written to a temp file on the target and retrieved over SMB. Useful when other execution methods (psexec, wmiexec, smbexec) are blocked but the Task Scheduler service is still accessible.

​
Authentication

​
Basic Usage

Execute a command and get output:
Execute with IP target:
Multiple commands chained:

​
How It Works

  1. Authenticates to the target over SMB (port 445)
  2. Connects to the ATSVC named pipe (Task Scheduler RPC interface)
  3. Creates a scheduled task set to execute immediately
  4. The task runs cmd.exe /C <command> > %windir%\Temp\<random>.tmp 2>&1
  5. Reads the output file from the ADMIN$ share (ADMIN$\Temp\<random>.tmp, i.e. C:\Windows\Temp) over SMB
  6. Deletes the output file and the scheduled task
The entire flow happens over SMB (port 445). No additional ports needed.

​
OPSEC

Task name is random but follows a recognizable pattern. Detection rules commonly alert on rapid task create/delete cycles.

​
Pass-the-Hash

Full LM:NT format:

​
Kerberos Authentication

Requires a valid TGT in the KRB5CCNAME environment variable.
With explicit DC IP:
Target must be specified by hostname (FQDN) when using Kerberos, not by IP.

​
When to Use atexec

atexec is a single-command execution tool, not an interactive shell. For interactive access, use wmiexec or smbexec.

​
Quick Reference