SMB-based
MITRE ATT&CK™ Remote Services: SMB/Windows Admin Shares - Technique T1021.002
Last updated
Was this helpful?
MITRE ATT&CK™ Remote Services: SMB/Windows Admin Shares - Technique T1021.002
Last updated
Was this helpful?
can be abuse by attackers to execute remote code and perform lateral movements.
Psexec is one of many Sysinternals Tools and can be downloaded , It connect to the $ADMIN shares with SMB and upload a service binary. Psexec uses psexesvc.exe as the name. Then it connect to the service control manager to create and run a service named PSEXESVC associated with the previous binary. Finally Psexec create some named pipes to handle stdin/stdout/stderr.
The script can execute a remote process.
We may manually replicate techniques use by PsExec with from impacket
SmbExec is an script that works similarly to PsExec without using RemComSvc. The main difference is that smbexec avoids transferring a potentially detectable binary to the target site. Instead, it lives completely off the land by running the local Windows command shell. implementation goes one step further, instantiating a local smbserver to receive the output of the commands. This is useful in the situation where the target machine does NOT have a writeable share available.
The script can execute a remote process.
You can utilize as a powerful alternative to SMBexec or PsExec for executing code over SMB connections. You can specify the execution methode and the shell interpretor (cmd or powershell.
can execute a remote process.