impacket-psexec
executes commands on remote Windows systems via SMB
TLDR
Execute command on remote host
$ impacket-psexec [domain]/[user]:[password]@[target] [command]
Get interactive shell$ impacket-psexec [domain]/[user]:[password]@[target]
Use NTLM hash instead of password$ impacket-psexec -hashes :[hash] [domain]/[user]@[target]
Specify service name$ impacket-psexec -service-name [name] [domain]/[user]:[password]@[target]
SYNOPSIS
impacket-psexec [options] target [command]
DESCRIPTION
impacket-psexec executes commands on remote Windows systems via SMB. Part of the Impacket toolkit. Works by uploading a service executable to ADMIN$ share and using Service Control Manager to start it. Requires administrator credentials. Used for authorized penetration testing and system administration.
PARAMETERS
-hashes LMHASH:NTHASH
Use NTLM hashes for authentication (LM hash may be empty).-k
Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME).-no-pass
Don't ask for password (useful with -k).-aesKey HEX
AES key for Kerberos authentication (128 or 256 bits).-dc-ip IP
IP of the domain controller.-target-ip IP
Target IP (overrides target hostname resolution).-service-name NAME
Name for the SMB server share.-remote-binary-name NAME
Custom remote binary name on target (default: random).-codec CODEC
Output codec used to decode remote stdout (default: locale-aware).-debug
Enable verbose debug output.
INSTALL
sudo pacman -S impacket
CAVEATS
Requires administrator access on target. Leaves artifacts on target system. For authorized security testing only.
