Remote execution protocols

Remote execution via SMB

SMB-based execution tools create a service on the remote host, execute commands through it, and retrieve output. PsExec (and its Impacket implementation) is the most well-known approach:

psexec.py domain/user:password@TARGET

PsExec writes a binary to disk, creates a service, and communicates over named pipes. This is effective but generates artifacts (file on disk, service creation event, named pipe activity) that are visible to endpoint detection.

SMBExec uses a different approach. it creates a service that writes command output to a file share, avoiding the binary drop:

smbexec.py domain/user:password@TARGET

Remote execution via WMI

WMI-based execution uses Windows Management Instrumentation to execute commands remotely. It avoids creating services or dropping files, making it generally quieter than SMB-based methods:

wmiexec.py domain/user:password@TARGET

PowerShell remoting

PowerShell remoting (WinRM) provides native remote execution that is considered legitimate administrative activity in most environments:

Enter-PSSession -ComputerName TARGET -Credential domain\user
Invoke-Command -ComputerName TARGET -ScriptBlock { whoami }

From Linux, Evil-WinRM provides equivalent functionality:

evil-winrm -i TARGET -u user -p password
evil-winrm -i TARGET -u user -H NTHASH

SSH

For Linux to Linux movement, SSH provides authenticated remote access:

ssh user@TARGET
ssh -i id_rsa user@TARGET

When SSH keys are discovered during enumeration, they should always be tested against other accessible systems.