> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Remote Access & Execution

Various connection methods for moving onto another host once you\`ve got valid credentials. This page covers the tools with a normal password.

## Connecting & Executing

**Windows Targets**

### PowerShell Remoting (WinRM)

<table>
  <colgroup>
    <col width="351" />

    <col width="325" />
  </colgroup>

  <thead>
    <tr>
      <th>Command</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`Enter-PSSession <system-name>`\
      `Enter-PSSession -ComputerName <computer-name>`</td>
      <td>Interactive PowerShell Remoting session into another host, from a domain-joined Windows box.</td>
    </tr>

    <tr>
      <td>`$session = New-PSSession -ComputerName <host>`\
      `Invoke-Command -Session $session -ScriptBlock { whoami }`</td>
      <td>Non-interactive: run one command (or a script block) against a session without dropping into a full shell, convenient for scripting against many hosts.</td>
    </tr>

    <tr>
      <td>`Invoke-Command -ComputerName <host1>,<host2> -ScriptBlock { hostname }`</td>
      <td>Run the same command across multiple hosts at once.</td>
    </tr>

    <tr>
      <td>`evil-winrm -u <user> -p <pass> -i <host>`</td>
      <td>WinRM connection with a full-featured shell, from Linux (file transfer, Kerberos auth support via `-r`, loadable PowerShell/Mimikatz modules via `-s`).</td>
    </tr>
  </tbody>
</table>

### RDP

| Command | Description |
| - | - |
| `xfreerdp /u:<user> /p:<pass> /v:<host> /dynamic-resolution /cert:ignore +clipboard` | RDP session from Linux. |
| `rdesktop <host> -u <user> -p <pass>` | Older, lighter-weight RDP client, still useful as a fallback when xfreerdp has compatibility issues. |
| `mstsc /v:<host>` | Native Windows RDP client, attacker box is also domain-joined Windows. |

### SMB-Based Execution (Impacket)

| Command | Description |
| - | - |
| `impacket-psexec <user>@<ip>` | Uploads a service binary, runs it as **SYSTEM**, cleans up on exit. Noisiest of the three (writes a file, creates+deletes a service), but a full interactive shell. |
| `impacket-wmiexec <user>@<ip>` | Executes via WMI over DCOM, semi-interactive shell, no service created, no binary dropped to disk, quieter than psexec. |
| `impacket-smbexec <user>@<ip>` | Similar to psexec but runs each command as its own service invocation rather than dropping a persistent binary, no file touches disk at all. |
| `impacket-atexec <user>@<ip> <command>` | Runs a single command via the Task Scheduler service, output only, not an interactive shell, useful when the other three are blocked/monitored. |

### DCOM

<table>
  <colgroup>
    <col width="252" />

    <col width="406" />
  </colgroup>

  <thead>
    <tr>
      <th>Command</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`impacket-dcomexec <user>@<ip>`</td>
      <td>Remote execution via a DCOM application object (MMC20, ShellWindows, ShellBrowserWindow) instead of WMI, an alternative when WMI is logged or blocked but DCOM isn't.</td>
    </tr>
  </tbody>
</table>

### NetExec (Bulk / Scripted)

| Command | Description |
| - | - |
| `netexec smb <ip> -u <user> -p <password> -x "whoami"` | Run a single command over SMB (wmiexec-style) without a full interactive session, across one host or a whole subnet. |
| `netexec winrm <ip> -u <user> -p <password> -x "whoami"` | Same idea over WinRM. |

**Linux Targets**

### SSH

| Command | Description |
| - | - |
| `ssh <user>@<host>` | Standard password-based SSH. |
| `ssh -i <certificate> <user>@<host>` | Key-based SSH using a private key instead of a password. |

### Bulk / Scripted

| Command | Description |
| - | - |
| `netexec ssh <ip> -u <user> -p <password> -x "whoami"` | Run a single command over SSH across one host or a subnet, same idea as the Windows NetExec rows. |

***

## Quick Reference Tools

> **[Pass-the-Hash](https://0-x.dev/lateral-movement/pass-the-hash.md)**
>
> Use the SMB/WinRM/RDP tools above with a captured NTLM hash instead of a password.

> **[Pass-the-Ticket](https://0-x.dev/lateral-movement/pass-the-ticket.md)**
>
> Use the same tools above with a stolen or forged Kerberos ticket instead of a password.

> **[Kerberos Double Hop Problem](https://0-x.dev/lateral-movement/kerberos-double-hop-problem.md)**
>
> Why a second remote command run from inside a PSSession/WMI/DCOM session can fail to authenticate further out.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.