Impacket Psexec

Impacket PsExec

Purpose

Use this skill for tightly bounded remote execution validation only when the rules of engagement explicitly permit service-based execution checks.

Phase Fit

• Primary: Validation and Controlled Impact Demonstration
• Secondary: Retest and Closure

Use When

• Need to validate whether an approved credential can execute on a specific host over SMB.
• Need to test an administrative boundary with a well-understood execution path.
• Need a repeatable retest after host hardening.

Avoid When

• Remote execution is not explicitly approved.
• Target scope or service-impact risk is unclear.

Inputs

• Approved Windows host
• Authorized credential or hash
• Stop conditions and service-impact limits

Procedure

1. Limit the check to the single approved host and credential set.
2. Validate only the execution path needed to prove the boundary.
3. Avoid persistence, post-exploitation, or broad host interaction.
4. Capture minimal evidence and stop once the hypothesis is answered.
5. Preserve the exact host and auth context for retest.

Command Syntax

Replace sample domains, hosts, and credentials with approved in-scope values.

# Connect with username and password
psexec.py contoso.com/auditor:'<password>'@10.10.10.100

# Execute a specific command and exit
psexec.py contoso.com/auditor:'<password>'@10.10.10.100 cmd.exe

# Pass-the-Hash authentication
psexec.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.100

# Pass-the-Ticket (Kerberos)
KRB5CCNAME=administrator.ccache psexec.py -k -no-pass dc01.contoso.com

# Connect via alternate SMB port
psexec.py contoso.com/auditor:'<password>'@10.10.10.100

Evidence to Capture

• Whether the approved credential enabled execution on the target
• Exact host, account, and protocol context
• Minimal proof path required for reproduction

Safety Boundaries

• Do not use beyond the explicitly approved host and purpose.
• Stop immediately if service instability or unapproved state changes occur.