Execute commands through service command lines and SMB output

Needs: Accepted authentication, service create/start rights and the selected output-share/server path

Shell commands

# Baseline
impacket-smbexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-smbexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

# Kerberos and alternate output modes
export KRB5CCNAME="$PWD/USER.ccache"
impacket-smbexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

# SHARE is default; SERVER starts a local SMB server and needs permission to bind locally.
impacket-smbexec -mode SHARE -share C$ 'DOMAIN/USER:PASSWORD@TARGET'

SMBExec creates temporary services whose command lines redirect output through a share. It does not use the same uploaded RemCom binary as PsExec, but it still requires SCM/service rights and produces substantial service/event artifacts.

Verify → Verify command effect separately from successful output retrieval and remove created artifacts as appropriate.

If it fails → Missing output can coexist with successful execution. Check service event/effect and share permissions before changing payloads. More detail ↓

If → then

A new Windows session or claimed administrator/SYSTEM transition → Establish Windows token, host and process context
Needs: A functioning command channel and the actual effective token/process context
A destination grants administrative-share write and service-control rights → Execute through uploaded service creation using PsExec
Needs: SMB/SCM reachability, writable required share, effective service-creation/start rights and an accepted password/hash or supported Kerberos context
Command execution or payload delivery exists but the expected usable channel does not → Diagnose connection direction, listener and session failures in order
Needs: A recorded first execution proof, correct advertised route, active compatible listener and observable connection evidence

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Execute commands through service command lines and SMB output

USE WHEN: SCM rights and SMB output access exist but an uploaded service binary is unsuitable
STARTING ACCESS: Identified authentication material, destination service reachability and a candidate authorized identity
RESULT: A remote command result through service-based execution

Recognize the clue

Inspect known administrative SMB/SCM context and the output-share path when a service-command mechanism is preferable to binary upload.

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares

SYNTHETIC EXAMPLE OUTPUT

ADMIN$: accessible
Accepted identity: DOMAIN\USER
Service-command and output retrieval: verify separately

Means: A share and possible service rights suggest the command-line service route, whose output still has its own access path.

Confirm: Confirm service create/start, exact output mode/share and command effect independently from retrieved stdout.

After validation: The service command executes and its selected output is available: choose SMBExec.
Ruled out in this context: SCM creation is denied: reject service-command execution despite SMB login.
Still inconclusive: No stdout may be output-share failure rather than failed process execution.

Troubleshooting: Missing output can coexist with successful execution. Check service event/effect and share permissions before changing payloads.

SMBExec creates temporary services whose command lines redirect output through a share. It does not use the same uploaded RemCom binary as PsExec, but it still requires SCM/service rights and produces substantial service/event artifacts.

Kerberos and alternate output modes

Why it works

SMBExec uses service command lines and file/share output rather than PsExec's uploaded RemCom binary. It still creates services and needs its documented output path.

Worked example · hypothetical

Observation: service control is allowed while a binary-upload approach is blocked. Test: select the supported service-command mechanism and verify output. Illustrative output: hostname/whoami returns through the chosen share. Interpretation: retain the effect and destination identity.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗