SANS Penetration Testing

Psexec Python Rocks!

[Editor's Note: Last week, we posted an article about the many faces of psexec functionality from Sysinternals, Metasploit, and the Nmap Scripting Engine, with some tips for using it, along with a Penetration Tester's Pledge. Continuing in that vein, Mark Baggett describes another way to do psexec, and to do it very flexibly: via Python. With, penetration testers and ethical hackers can incorporate psexec functionality into their own code, giving huge new avenues of increased flexibility and automation. Sweet! -Ed.]

By Mark Baggett

Python rocks! PSEXEC rocks! So, what could be better than psexec written in Python? The script is one of many examples of super useful penetration testing scripts that are distributed with the IMPACKET Python module available from Core Labs. Kudos and many thanks to Core Security for their lab tools and the great features of IMPACKET.

After downloading and installing IMPACKET, running the Python version of psexec is pretty intuitive. You provide the script with credentials along with a target, and it does exactly what you would expect it to do. The following image illustrates how you would run cmd.exe on target with a username of demoadmin and a password of demopass.

Now, you may be saying to yourself, "SO WHAT? I can do that with the psexec tool from Microsoft Sysinternals." You're right. But this is a Python script! That means if I want to use all of that psexec awesomeness in my own programs, all I need to do is import into my own script, or into the Python shell. Then, I can build features on top of it, and make something even more powerful.

In the next image, you can see it only requires three lines of code to make use of the psexec feature from within your own script. In the first line, we "import psexec", making all the functionality in the original script available in the shell. In the second line, we create an object called "psobject" that is of type "PSEXEC". When we create the object we initialize it with a command (cmd.exe), the path to that program on the remote machine (c:\windows\system32\), the port and protocol (445/SMB), and the login credentials. After we escape the forward slashes in the path of (c:\windows\system32\), it becomes (c:\windows\system32\). Now, to execute the code, all we have to do is provide psobject with a target IP address. In the third line, we provide the target IP address to the psobject's run method.

Running that same command against multiple hosts is just a matter of passing different IP addresses to the run method, so finding targets in a range where these are valid credentials is a trivial process. A simple "for" loop can go through all the targets in a given IP range as follows:

for lastoctet in range(1,256):
ip="10.10.11.%s" % (str(lastoctet))

You can also try a list of usernames and passwords on all those same target hosts like this:

Okay, but who uses passwords anymore? More often than not, I'm passing the hash to access a target. That is not a problem with! Instead of setting the "password" parameter, we set the "hashes" parameter, and login with a hash. Nice!

That is the power of Python, my friends! With an import and a few lines of your own code, you can do some really lethal stuff. You don't have to be a coding expert to create some really great tools by tying together features of already existing, really powerful libraries and modules.

Would you like more information about how you can create your own Python-powered attack tools? I'm sure you do! :) Join me for SEC573 - Automating Information Security for Python, in Austin, TX at SANS Pen Test Austin, in March 2018 or at SANS 2018 in Orlando, FL in April 2018.

Follow me on twitter : @MarkBaggett
-Mark Baggett

SANS Pen Test Austin 2018 - Training Event:


  • Choose from 12 world-class training courses w/ our best instructors!
  • Play in (3) Nights of NetWars
  • Join a team as you hack/defend SANS CyberCity
  • Enjoy a special night of networking and fun for all attendees
  • Earn up to (5) SANS Pen Test Challenge Coins during Coin-A-Palooza
  • March 19 - 24, 2018 - Austin, TX
  • Learn more:


Posted April 29, 2013 at 2:07 PM | Permalink | Reply


Hi and thanks for this excerpt !
First of all I faced a nice little issue with root (cf:
=> Need to export PYTHONPATH=/home/src/impacket ''.
Then trying to launch :
# python -path c:\\\\windows\\\\system32\\\\ -hashes ABCEDF1234:ABCDEF1234 cmd.exe Administrator@
Impacket v0.9.9 ''" Copyright 2002-2012 Core Security Technologies
Trying protocol 445/SMB''
[Errno -2] Name or service not known

Posted April 30, 2013 at 3:35 PM | Permalink | Reply


Send me an email to bethus at and I'll help you out figuring out your problem.

Posted May 30, 2013 at 2:06 PM | Permalink | Reply


Is it work for linux machines?

Posted June 30, 2013 at 5:44 PM | Permalink | Reply


Also receive
Impacket v0.9.10 ''" Copyright 2002-2013 Core Security Technologies
Trying protocol 445/SMB''
[Errno -2] Name or service not known
Did you guys ever resolve this?
P.S. I am able to access the box via 445/SMB with several other tools.

Post a Comment


* Indicates a required field.