Connecting & Executing
- Windows Targets
- Linux Targets
PowerShell Remoting (WinRM)
| Command | Description |
|---|---|
Enter-PSSession <system-name>Enter-PSSession -ComputerName <computer-name> | Interactive PowerShell Remoting session into another host, from a domain-joined Windows box. |
$session = New-PSSession -ComputerName <host>Invoke-Command -Session $session -ScriptBlock { whoami } | Non-interactive: run one command (or a script block) against a session without dropping into a full shell, convenient for scripting against many hosts. |
Invoke-Command -ComputerName <host1>,<host2> -ScriptBlock { hostname } | Run the same command across multiple hosts at once. |
evil-winrm -u <user> -p <pass> -i <host> | WinRM connection with a full-featured shell, from Linux (file transfer, Kerberos auth support via -r, loadable PowerShell/Mimikatz modules via -s). |
RDP
SMB-Based Execution (Impacket)
DCOM
| Command | Description |
|---|---|
impacket-dcomexec <user>@<ip> | Remote execution via a DCOM application object (MMC20, ShellWindows, ShellBrowserWindow) instead of WMI, an alternative when WMI is logged or blocked but DCOM isn’t. |
NetExec (Bulk / Scripted)
Quick Reference Tools
Pass-the-Hash
Use the SMB/WinRM/RDP tools above with a captured NTLM hash instead of a password.
Pass-the-Ticket
Use the same tools above with a stolen or forged Kerberos ticket instead of a password.
Kerberos Double Hop Problem
Why a second remote command run from inside a PSSession/WMI/DCOM session can fail to authenticate further out.