Is it possible to execute an executable with authenticated SMB?

Question

Assume the following:

An attacker has access to a remote Windows share on a remote host.
Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB.
Attacker can write files via SMB.
Victim is fully patched and attacker does not have any zero days.
Victim is not a member of a domain controller, it is just a share with local Windows authen.

Can the attacker force the Windows computer to run an executable? If so, how?

Testing on my home network and it's failing "Access is denied." Pretty sure it's an admin account. Is it due to UAC? — Saustin, Commented Dec 8, 2018 at 0:58
Perhaps. This may help stackoverflow.com/questions/16735900/psexec-and-uac-issue — paj28, Commented Dec 8, 2018 at 8:51
Old question, but you could look into using the IPC$ share to communicate with named pipes, and do something like execute WMIC, modify the registry, or create a scheduled task. — Bob, Commented Oct 27, 2021 at 20:03

Saustin · Accepted Answer · 2018-12-11 04:21:10Z

1

While psexec or wmiexec (Linux python equivalent) will work, the latest Windows updates do not work with the default installation.

This is because the ADMIN$ and C$ shares are not accessible without explicit registry configuration.

answered Dec 11, 2018 at 4:21

Saustin

3211 silver badge10 bronze badges

Add a comment |

1 Answer 1