Academy Node
SMBExec / PsExec
SMBExec and PsExec use admin rights over SMB to execute commands remotely.
Intermediate100 XPLateral Movement
Why it matters
AdminTo plus SMB often means fast shell or secret dumping.
How to identify it
- NetExec Pwn3d!
- AdminTo edge
- Writable ADMIN$
BloodHound indicators
- AdminTo
NetExec commands
nxc smb 192.168.184.150 -d xutslabs.local -u USER -p PASS --samImpacket commands
impacket-psexec xutslabs.local/USER:PASS@192.168.184.150impacket-smbexec xutslabs.local/USER:PASS@192.168.184.150impacket-wmiexec xutslabs.local/USER:PASS@192.168.184.150Expected output
- NT AUTHORITY\\SYSTEM shell
- SAM hashes
Success looks like
- Remote shell
- Secrets dumped
Failure looks like
- AV blocks service
- UAC restrictions
- SMB signing/policy
Troubleshooting
- Try psexec/smbexec/wmiexec
- Use hashes if password unavailable
Common mistakes
- Only trying one exec method
- Not trying wmiexec
Alternative attacks
- WinRM
- RDP
What to try next
- Dump creds
- Collect sessions
- Pivot
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.