search

Remote process

1. Psexec

  • Ports: 445/TCP (SMB)

  • Required Group Memberships: Administrators (on the remote target)

  • Command:

    psexec64.exe \\MACHINE_IP -u Administrator -p <PASSWORD> -i cmd.exe

hashtag
2. Remote Process Creation Using WinRM

  • Ports:

    • 5985/TCP (WinRM HTTP)

    • 5986/TCP (WinRM HTTPS)

  • Required Group Memberships: Remote Management Users

Commands

  • Interactive session:

    $username = 'Administrator';
$password = '<PASSWORD>';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force; 
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;

# Start an interactive session
Enter-PSSession -ComputerName TARGET -Credential $credential

  • Execute a single command:

    Invoke-Command -ComputerName TARGET -Credential $credential -ScriptBlock { whoami }

  • WinRS Command:

    winrs.exe -u:Administrator -p:<PASSWORD> -r:TARGET cmd

hashtag
3. Remotely Creating Services Using sc

  • Ports:

    • 135/TCP, 49152-65535/TCP (DCE/RPC)

    • 445/TCP, 139/TCP (RPC over SMB Named Pipes)

  • Required Group Memberships: Administrators

Commands

  • Create a service:

  • Start the service:

  • Stop the service:

  • Delete the service:

hashtag
4. Creating Scheduled Tasks Remotely

  • Command to Create a Task:

  • Command to Run a Task:

  • Command to Delete a Task:

PreviousPassing the Hash (PtH)NextWMI

Last updated