# Impacket Psexec

> Use for tightly scoped remote execution validation over SMB during authorized internal pentests. Trigger on approved administrative boundary checks, service-creation path review, and confirming whether a specific credential can execute on a specific Windows host.

- Skill: `timsonner/impacket-psexec` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/impacket-psexec`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/impacket-psexec/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/impacket-psexec

---


# Impacket PsExec

## Purpose

Use this skill for tightly bounded remote execution validation only when the rules of engagement explicitly permit service-based execution checks.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to validate whether an approved credential can execute on a specific host over SMB.
- Need to test an administrative boundary with a well-understood execution path.
- Need a repeatable retest after host hardening.

## Avoid When

- Remote execution is not explicitly approved.
- Target scope or service-impact risk is unclear.

## Inputs

- Approved Windows host
- Authorized credential or hash
- Stop conditions and service-impact limits

## Procedure

1. Limit the check to the single approved host and credential set.
2. Validate only the execution path needed to prove the boundary.
3. Avoid persistence, post-exploitation, or broad host interaction.
4. Capture minimal evidence and stop once the hypothesis is answered.
5. Preserve the exact host and auth context for retest.

## Command Syntax

Replace sample domains, hosts, and credentials with approved in-scope values.

```bash
# Connect with username and password
psexec.py contoso.com/auditor:'<password>'@10.10.10.100

# Execute a specific command and exit
psexec.py contoso.com/auditor:'<password>'@10.10.10.100 cmd.exe

# Pass-the-Hash authentication
psexec.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.100

# Pass-the-Ticket (Kerberos)
KRB5CCNAME=administrator.ccache psexec.py -k -no-pass dc01.contoso.com

# Connect via alternate SMB port
psexec.py contoso.com/auditor:'<password>'@10.10.10.100
```

## Evidence to Capture

- Whether the approved credential enabled execution on the target
- Exact host, account, and protocol context
- Minimal proof path required for reproduction

## Safety Boundaries

- Do not use beyond the explicitly approved host and purpose.
- Stop immediately if service instability or unapproved state changes occur.