Impacket smbexec.py

Back to the category index / Back to the command index

Overview

Creates a temporary service through SCMR and retrieves command output over an SMB share. It does not leave an executable binary installed on the target.

Item	Details
Implementation	examples/smbexec.py
Category	Remote execution / WMI / services
Size	404 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and input

Run python examples/smbexec.py -h for the current option definitions.

Argument	Description
target	[[domain/]username[:password]@]
-share	Share from which to retrieve output (default: C$)
-mode	Mode to use (default: SHARE; SERVER requires root; choices: SERVER, SHARE)
-ts	Add a timestamp to each log message
-debug	Enable debug output
-codec	Help text generated dynamically from the runtime value
-shell-type	Command processor for the semi-interactive shell (choices: cmd, powershell; default: cmd)
-dc-ip	Domain controller IP address; if omitted, use the domain name (FQDN) from the target parameter
-target-ip	Target machine IP address; if omitted, use the target value. Useful when a NetBIOS target name cannot be resolved
-port	Destination SMB server port (choices: 139, 445; default: 445)
-service-name	Name of the service used to trigger the payload
-hashes	NTLM hashes in LMHASH:NTHASH format
-no-pass	Do not prompt for a password (useful with -k)
-k	Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line
-aesKey	AES key for Kerberos authentication (128 or 256 bits)
-keytab	Read SPN keys from a keytab file

Detailed processing flow

The tool connects to Service Control Manager over an SMB transport, registers the command as the service’s binPath, and starts the service. It directs output to a specified share and retrieves it through the client or a local SMB server. SERVER and SHARE modes use different output paths. On exit, it deletes the service and temporary output.

How it works

SMBEXEC does not place an executable service binary on the target. Instead, it sets the shell command itself as the SCMR service’s binPath and starts it. The service is not expected to run for long; after the command interpreter finishes, the tool removes the temporary service entry. Unlike PSEXEC, it uses no dedicated named-pipe agent.

The service cannot return stdout and stderr directly over RPC, so the command line redirects them to a file or UNC path. SHARE mode retrieves output from a share on the target; SERVER mode starts a temporary SMB server on the client and has the target write to it. The choice changes inbound connection needs, firewall behavior, and credential exposure.

For each input, the interactive shell creates a new service command and polls for the output file before displaying it. A service start may return a timeout or error even after the command has run, so evaluate SCMR status and the presence of the output file separately. Clean up the temporary service, local server thread, and output file.

Key implementation elements

Symbol	Location	Where to trace its responsibility
SMBServer	62	__init__(), cleanup_server(), run(), stop()
CMDEXEC	116	__init__(), run()
RemoteShell	173	__init__(), finish(), do_shell(), do_exit(), do_EOF(), emptyline(), do_cd(), do_CD(), default(), get_output(), execute_remote(), send_data()

Dependencies

Within Impacket

Module	Main names used
impacket.examples	logger
impacket.examples.utils	parse_target
impacket	smbserver, version
impacket.dcerpc.v5	scmr, transport
impacket.krb5.keytab	Keytab

Output, side effects, and required privileges

• Some operations change the target’s state. Check the target name, SID, and path before making changes.
• Some paths use temporary resources such as remote services, tasks, files, shares, and WMI/RPC resources. Cleaning them up after an abnormal exit is part of the behavior contract.

Failure paths and cleanup

• On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
• Cleanup-related methods include cleanup_server(), stop(), and finish(). Check that new early returns and exception paths reach them too.

When changing the implementation

The code depends on dcerpc.v5.scmr, transport, impacket.smbserver, and keytabs. CMDEXEC handles connections, RemoteShell handles the command lifecycle, and SMBServer provides the callback share.

Verification

• Syntax: python -m py_compile examples/smbexec.py
• CLI: python examples/smbexec.py -h
• Related test: tests/misc/test_dcerpc_v5_ndr.py