Assume the following:

  • An attacker has access to a remote Windows share on a remote host.
  • Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB.
  • Attacker can write files via SMB.
  • Victim is fully patched and attacker does not have any zero days.
  • Victim is not a member of a domain controller, it is just a share with local Windows authen.

Can the attacker force the Windows computer to run an executable? If so, how?

  • 1
    If it's an admin account you can use psexec
    – paj28
    Dec 8, 2018 at 0:43
  • Testing on my home network and it's failing "Access is denied." Pretty sure it's an admin account. Is it due to UAC?
    – Saustin
    Dec 8, 2018 at 0:58
  • Perhaps. This may help stackoverflow.com/questions/16735900/psexec-and-uac-issue
    – paj28
    Dec 8, 2018 at 8:51
  • Old question, but you could look into using the IPC$ share to communicate with named pipes, and do something like execute WMIC, modify the registry, or create a scheduled task.
    – Bob
    Oct 27, 2021 at 20:03

1 Answer 1


While psexec or wmiexec (Linux python equivalent) will work, the latest Windows updates do not work with the default installation.

This is because the ADMIN$ and C$ shares are not accessible without explicit registry configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.