Assume the following:

  • An attacker has access to a remote Windows share on a remote host.
  • Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB.
  • Attacker can write files via SMB.
  • Victim is fully patched and attacker does not have any zero days.
  • Victim is not a member of a domain controller, it is just a share with local Windows authen.

Can the attacker force the Windows computer to run an executable? If so, how?

  • 1
    If it's an admin account you can use psexec
    – paj28
    Dec 8, 2018 at 0:43
  • Testing on my home network and it's failing "Access is denied." Pretty sure it's an admin account. Is it due to UAC?
    – Saustin
    Dec 8, 2018 at 0:58
  • Perhaps. This may help stackoverflow.com/questions/16735900/psexec-and-uac-issue
    – paj28
    Dec 8, 2018 at 8:51
  • Old question, but you could look into using the IPC$ share to communicate with named pipes, and do something like execute WMIC, modify the registry, or create a scheduled task.
    – Bob
    Oct 27, 2021 at 20:03

1 Answer 1


While psexec or wmiexec (Linux python equivalent) will work, the latest Windows updates do not work with the default installation.

This is because the ADMIN$ and C$ shares are not accessible without explicit registry configuration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .