How do I install the Impacket Smbexec skill?

Run npx skillmds@latest add timsonner/impacket-smbexec in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Impacket Smbexec safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Impacket Smbexec?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Impacket Smbexec free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Impacket Smbexec?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Impacket Smbexec by timsonner — Agent Skill

Name: Impacket Smbexec
Author: timsonner

Impacket Smbexec

Use for tightly scoped SMB-based remote command validation during authorized internal pentests. Trigger on approved execution-boundary checks and confirming whether a specific credential can execute commands on a specific Windows host over SMB.

timsonner 5446686 2.1 KB Updated Sep 17, 2026

File contents

Impacket SMBExec

Purpose

Use this skill for narrowly bounded SMB-based command validation only when the rules of engagement explicitly permit remote execution checks.

Phase Fit

Primary: Validation and Controlled Impact Demonstration
Secondary: Retest and Closure

Use When

Need to validate SMB-backed command execution on a specific approved host.
Need an alternative execution path to compare control boundaries.
Need a repeatable retest after host or service hardening.

Avoid When

Remote execution is not explicitly approved.
Host scope, credential handling, or service impact is unclear.

Inputs

Approved host
Authorized credential or hash
Stop conditions and evidence limits

Procedure

Limit activity to the single approved host.
Confirm only the execution boundary needed by the assessment.
Avoid persistence, lateral expansion, or bulk command use.
Record only the minimum proof of impact.
Preserve the exact auth context for retest.

Command Syntax

Replace sample domains, hosts, and credentials with approved in-scope values.

# Interactive shell via service-based SMB execution
smbexec.py contoso.com/auditor:'<password>'@10.10.10.100

# Pass-the-Hash
smbexec.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.100

# Pass-the-Ticket (Kerberos)
KRB5CCNAME=administrator.ccache smbexec.py -k -no-pass dc01.contoso.com

# Server mode (execute as SYSTEM via network share)
smbexec.py contoso.com/auditor:'<password>'@10.10.10.100 -mode SERVER

Evidence to Capture

Whether SMB-backed execution worked on the approved host
Exact account, host, and protocol path used
Minimal reproduction details for retest

Safety Boundaries

Do not expand beyond the approved host and objective.
Stop immediately if service instability or unapproved state changes occur.

---name: impacket-smbexecdescription: Use for tightly scoped SMB-based remote command validation during authorized internal pentests. Trigger on approved execution-boundary checks and confirming whether a specific credential can execute commands on a specific Windows host over SMB.license: MIT---# Impacket SMBExec## PurposeUse this skill for narrowly bounded SMB-based command validation only when the rules of engagement explicitly permit remote execution checks.## Phase Fit- Primary: Validation and Controlled Impact Demonstration- Secondary: Retest and Closure## Use When- Need to validate SMB-backed command execution on a specific approved host.- Need an alternative execution path to compare control boundaries.- Need a repeatable retest after host or service hardening.## Avoid When- Remote execution is not explicitly approved.- Host scope, credential handling, or service impact is unclear.## Inputs- Approved host- Authorized credential or hash- Stop conditions and evidence limits## Procedure1. Limit activity to the single approved host.2. Confirm only the execution boundary needed by the assessment.3. Avoid persistence, lateral expansion, or bulk command use.4. Record only the minimum proof of impact.5. Preserve the exact auth context for retest.## Command SyntaxReplace sample domains, hosts, and credentials with approved in-scope values.```bash# Interactive shell via service-based SMB executionsmbexec.py contoso.com/auditor:'<password>'@10.10.10.100# Pass-the-Hashsmbexec.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.100# Pass-the-Ticket (Kerberos)KRB5CCNAME=administrator.ccache smbexec.py -k -no-pass dc01.contoso.com# Server mode (execute as SYSTEM via network share)smbexec.py contoso.com/auditor:'<password>'@10.10.10.100 -mode SERVER```## Evidence to Capture- Whether SMB-backed execution worked on the approved host- Exact account, host, and protocol path used- Minimal reproduction details for retest## Safety Boundaries- Do not expand beyond the approved host and objective.- Stop immediately if service instability or unapproved state changes occur.

Frequently asked questions