# Impacket Smbexec

> Use for tightly scoped SMB-based remote command validation during authorized internal pentests. Trigger on approved execution-boundary checks and confirming whether a specific credential can execute commands on a specific Windows host over SMB.

- Skill: `timsonner/impacket-smbexec` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/impacket-smbexec`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/impacket-smbexec/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/impacket-smbexec

---


# Impacket SMBExec

## Purpose

Use this skill for narrowly bounded SMB-based command validation only when the rules of engagement explicitly permit remote execution checks.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to validate SMB-backed command execution on a specific approved host.
- Need an alternative execution path to compare control boundaries.
- Need a repeatable retest after host or service hardening.

## Avoid When

- Remote execution is not explicitly approved.
- Host scope, credential handling, or service impact is unclear.

## Inputs

- Approved host
- Authorized credential or hash
- Stop conditions and evidence limits

## Procedure

1. Limit activity to the single approved host.
2. Confirm only the execution boundary needed by the assessment.
3. Avoid persistence, lateral expansion, or bulk command use.
4. Record only the minimum proof of impact.
5. Preserve the exact auth context for retest.

## Command Syntax

Replace sample domains, hosts, and credentials with approved in-scope values.

```bash
# Interactive shell via service-based SMB execution
smbexec.py contoso.com/auditor:'<password>'@10.10.10.100

# Pass-the-Hash
smbexec.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.100

# Pass-the-Ticket (Kerberos)
KRB5CCNAME=administrator.ccache smbexec.py -k -no-pass dc01.contoso.com

# Server mode (execute as SYSTEM via network share)
smbexec.py contoso.com/auditor:'<password>'@10.10.10.100 -mode SERVER
```

## Evidence to Capture

- Whether SMB-backed execution worked on the approved host
- Exact account, host, and protocol path used
- Minimal reproduction details for retest

## Safety Boundaries

- Do not expand beyond the approved host and objective.
- Stop immediately if service instability or unapproved state changes occur.