6.4.3 Execute using SMB or WMI mechanisms
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A scoped host, compatible authentication and verified remote execution rights. A visible writable share alone is insufficient.
Where to look: For service-based execution inspect administrative share/file delivery and service-control rights. For WMI/DCOM inspect RPC endpoint/dynamic transport and namespace/COM authorization. Track execution separately from output retrieval.
Expected behavior / secure boundary: Remote administrative execution is deliberately privileged. A local Administrators membership can be affected by remote token filtering/policy. An output-file failure can occur after execution; avoid blindly rerunning a state-changing command.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.4.3.1 Execute on a selected host through verified administrative SMB access SMB execution using Impacket
Run: Kali / Linux with Impacket. Requires: Required administrative share/service-control rights and compatible authentication. Effect: Remote execution; may upload files and create/remove a service.
6.4.3.1.1 Authenticate with a known password in the correct account scope Password
# Password
impacket-psexec 'DOMAIN/USER:PASSWORD@TARGET'
6.4.3.1.2 Authenticate with the account's NT hash where supported NT hash / Pass-the-Hash
# NT hash / Pass-the-Hash
impacket-psexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
6.4.3.2 Execute on a selected host through verified administrative SMB access SMB execution using native Windows PsExec
Run: Windows with Sysinternals PsExec. Requires: Required target administrative/service rights and selected credentials. Effect: Remote execution/service activity; first use can accept the tool EULA.
PsExec64.exe -accepteula \\TARGET_HOST -u DOMAIN\USER -p PASSWORD cmd.exe
What this checks: PsExec-style and SMBExec-style mechanisms differ in service, file and output handling. They require their respective access paths. WMI is a separate mechanism with RPC/dynamic-port requirements, documented in the linked full procedure.
6.4.3.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
SMB authentication: success
ADMIN$ file upload: access denied
WMI: process created, return value 0
Output retrieval: failed
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| ADMIN$ upload denied | The selected delivery step lacks access. | Recheck administrative context or choose a method whose actual requirements are satisfied. | §6.2.6.1 — Validate host-specific access rights |
| WMI return 0 | The process-creation API accepted the request. | Verify its effect/output and run-as identity; no interactive shell is implied. | §6.5.2.1 — Re-enumerate after an identity or host change |
| Output retrieval failed | The result channel failed. | Check whether execution already happened before retrying. | §6.5.1.1 — Diagnose the failed boundary |
Stop when: Execution acceptance, run-as identity, effect and output-channel result are separated.
Revisit only when: New service/file/RPC rights or result-channel evidence appears.
6.4.3.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | The chosen mechanism executes and verifies the intended identity: record the transition. | §6.5.2.1 — Re-enumerate after an identity or host change |
| Ruled out in this context | Required service/file/namespace rights are denied: reject that mechanism in this context. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Inconclusive / failed check | Command submission works but output is absent: diagnose the result channel without assuming no execution. | §6.5.1.1 — Diagnose the failed boundary |
6.4.3.5 Tooling and complete procedure
Impacket PsExec/SMBExec/WMIExec or native Windows CIM/Sysinternals alternatives. SMB/service rights and RPC routes differ; use the exact source procedure for the selected mechanism. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.