From Valid Credentials to SYSTEM Shell: The SMB RCE Chain

#Three Years Ago I Watched a Junior Pentester Stare at a Share for Twenty Minutes#link

He had valid admin credentials. He had confirmed the target was vulnerable. And he just sat there, unsure what to type next. The gap between "I have credentials" and "I have a shell" is where most people freeze. It should not be. The path is mechanical. PsExec or its Impacket equivalent. One command. SYSTEM shell. Let me walk you through it.

Remote Command Execution via Impacket

nt authority\system. That is the highest privilege level on a Windows host. Impacket uploaded a service binary to ADMIN$, created a service via the Service Control Manager, started it, and gave you an interactive shell. The entire process took four seconds. Alternatives include impacket-smbexec (no file upload, uses a local SMB server for output) and impacket-atexec (uses the Task Scheduler).

Extracting SAM Hashes Remotely

Six hashes dumped remotely. No interactive session. No file transfer. CME pulled them over SMB and stored them in its local database. Now you crack them offline or use them for Pass-the-Hash against other hosts. The --lsa flag additionally dumps LSA secrets which may contain service account passwords in cleartext.

Pass-the-Hash Over SMB

You did not crack the hash. You did not need to. NTLM authentication accepts the hash directly. The server cannot distinguish between a legitimate authentication and you replaying a captured hash. This is Pass-the-Hash. It works with any Impacket tool, smbmap, CrackMapExec, and evil-winrm.

The chain is always the same. Get credentials or a hash. Authenticate over SMB. Execute commands or dump hashes. Use those hashes against the next host. Repeat until you reach the domain controller. This is not theory. This is the exact sequence I have used on over forty engagements. The tools change. The pattern does not.