> For the complete documentation index, see [llms.txt](https://www.impacket.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.impacket.wiki/reference/script-reference/remote-execution-scripts.md). # Remote Execution Scripts The remote execution examples show several ways to run commands on Windows systems after authentication. They differ in transport, required permissions, artifacts created on the target, and how interactive the resulting shell feels. ## Script List * `psexec.py` -- Remote shell via SMB service creation (SCMR) * `smbexec.py` -- Remote shell via SMB service, no binary upload * `wmiexec.py` -- Remote shell via WMI (DCOM) * `atexec.py` -- Command execution via Task Scheduler (ATSVC/TSCH) * `dcomexec.py` -- Remote shell via DCOM (MMC20, ShellWindows, ShellBrowserWindow) ## Main Scripts | Script | Transport | Typical requirement | Notes | | --------------- | -------------------------------- | -------------------------------- | ------------------------------------------------------------------------- | | `psexec.py` | SMB plus Service Control Manager | Local admin rights | Uploads and runs a service binary by default | | `smbexec.py` | SMB plus Service Control Manager | Local admin rights | Uses command execution through services and SMB shares | | `wmiexec.py` | SMB plus WMI/DCOM | Local admin rights | Semi-interactive shell, often less file-heavy than PsExec-style execution | | `dcomexec.py` | DCOM application objects | Local admin rights | Executes through selected DCOM objects | | `atexec.py` | Task Scheduler RPC | Rights to create scheduled tasks | Runs a command through scheduled task interfaces | | `wmiquery.py` | WMI queries | WMI access | Query-oriented rather than command-shell oriented | | `wmipersist.py` | WMI event subscription | Administrative WMI access | Demonstrates WMI persistence mechanics | ## PsExec Style `psexec.py` is usually the first remote execution example people encounter. ```bash python examples/psexec.py CONTOSO/alice:'Passw0rd!'@files01 ``` With hashes: ```bash python examples/psexec.py -hashes :8846f7eaee8fb117ad06bdd830b7586c CONTOSO/alice@files01 ``` What it teaches: * SMB login and tree connection setup. * Service creation through RPC. * Uploading a helper binary. * Connecting command input and output back to the operator. ## SMBExec `smbexec.py` is another service-based execution model. ```bash python examples/smbexec.py CONTOSO/alice:'Passw0rd!'@files01 ``` This script is useful when studying service control without the exact same helper-binary pattern as `psexec.py`. ## WMIExec `wmiexec.py` runs commands through WMI and retrieves output over SMB. ```bash python examples/wmiexec.py CONTOSO/alice:'Passw0rd!'@files01 ``` With Kerberos: ```powershell $env:KRB5CCNAME = "alice.ccache" python examples/wmiexec.py -k -no-pass files01.contoso.local ``` What it teaches: * DCOM connection setup. * WMI process creation. * Output collection over an administrative share. * Semi-interactive shell loops. ## DCOMExec `dcomexec.py` uses DCOM application objects for execution. ```bash python examples/dcomexec.py CONTOSO/alice:'Passw0rd!'@files01 ``` This is useful for learning how Impacket builds DCOM connections and activates remote COM objects. The selected object changes the execution path, so read the script options before use. > Something worth noting with wmiexec is that it uses \`ShellWindows\` object to execute into. This object is deprecated and so on most systems you will find that it will not be successful on Server 2019+ ## ATExec `atexec.py` runs commands through scheduled task RPC interfaces. ```bash python examples/atexec.py CONTOSO/alice:'Passw0rd!'@files01 whoami ``` This script is a compact reference for task scheduler RPC usage and one-shot command execution. ## Choosing a Remote Execution Script Use this decision path when learning or testing: | Goal | Start with | | ------------------------------------------------ | ------------- | | Understand classic SMB service execution | `psexec.py` | | Compare service execution tradeoffs | `smbexec.py` | | Run a semi-interactive shell through WMI | `wmiexec.py` | | Study DCOM object activation | `dcomexec.py` | | Run a single command through scheduled tasks | `atexec.py` | | Query WMI classes rather than run shell commands | `wmiquery.py` | ## Considerations Remote execution examples can create services, scheduled tasks, files, named pipes, or WMI artifacts. In a lab, run them once with `-debug` and then inspect the target so you understand the cleanup behavior and the Windows events produced by each technique. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.impacket.wiki/reference/script-reference/remote-execution-scripts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.