Assume the following:

  • An attacker has access to a remote Windows share on a remote host.
  • Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB.
  • Attacker can write files via SMB.
  • Victim is fully patched and attacker does not have any zero days.
  • Victim is not a member of a domain controller, it is just a share with local Windows authen.

Can the attacker force the Windows computer to run an executable? If so, how?


While psexec or wmiexec (Linux python equivalent) will work, the latest Windows updates do not work with the default installation.

This is because the ADMIN$ and C$ shares are not accessible without explicit registry configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.