> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/remote-commands/remote-commands-overview.md).

# Remote Commands - Overview

## Overview of Lateral Movement Tools

### From Impacket

<table><thead><tr><th width="146">Tool</th><th width="178">Uses protocols</th><th>Comments</th></tr></thead><tbody><tr><td><a href="https://raw.githubusercontent.com/fortra/impacket/refs/heads/master/examples/atexec.py">atexec.py</a></td><td></td><td></td></tr><tr><td><a href="https://raw.githubusercontent.com/fortra/impacket/refs/heads/master/examples/dcomexec.py">dcomexec.py</a></td><td></td><td></td></tr><tr><td><a href="https://raw.githubusercontent.com/fortra/impacket/refs/heads/master/examples/psexec.py">psexec.py</a></td><td>DCE/RPC + SMB</td><td></td></tr><tr><td><a href="https://raw.githubusercontent.com/Mr-Un1k0d3r/SCShell/refs/heads/master/scshell.py">scshell.py</a></td><td>DCE/RPC</td><td>Uses <code>ChangeServiceConfigA</code> API</td></tr><tr><td><a href="https://raw.githubusercontent.com/fortra/impacket/refs/heads/master/examples/smbexec.py">smbexec.py</a></td><td>DCE/RPC + SMB</td><td></td></tr><tr><td><a href="https://raw.githubusercontent.com/fortra/impacket/refs/heads/master/examples/wmiexec.py">wmiexec.py</a></td><td>DCOM + SMB</td><td></td></tr></tbody></table>

### From Linux Source

<table><thead><tr><th width="125">Tool</th><th width="171">Uses protocols</th><th>Comments</th></tr></thead><tbody><tr><td>evil-winrm</td><td>WinRM</td><td>Doesn't seem to require TrustRecords</td></tr><tr><td></td><td></td><td></td></tr><tr><td></td><td></td><td></td></tr></tbody></table>

### From Windows Source

<table><thead><tr><th width="130">Tool</th><th width="168">Uses protocols</th><th>Comments and requirements</th></tr></thead><tbody><tr><td>PS Remoting</td><td></td><td></td></tr><tr><td>psexec.exe</td><td>RPC + SMB</td><td>Requires Admin account</td></tr><tr><td>SCShell.exe</td><td>DCE/RPC</td><td></td></tr><tr><td>winrs.exe</td><td>WinRM</td><td>Requires Admin account and <br>TrustRecords configured</td></tr><tr><td>wmic.exe</td><td>RPC</td><td></td></tr></tbody></table>

## Commands with Built-in Support

### PowerShell Cmdlets

The following Cmdlets support the use of the `-ComputerName` parameter:

* [Get-CimInstance](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-5.1)
* [Get-Process](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-5.1)
* [Get-Service](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-service?view=powershell-5.1)
* [Restart-Computer](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/restart-computer?view=powershell-5.1)
* [Set-Service](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-5.1)

These types of connections don't use PowerShell remoting and require the `Remote Registry` service instead.

You can check for Cmdlets with the following:

```powershell
Get-Command -ParameterName ComputerName | Where-Object -Property CommandType -Eq Cmdlet | Select-Object -Property Name
```

### Windows Commands

The following built-in commands support remote machines as a parameter:

* [at.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/at)
* [sc.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-config)
* [schtasks.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks)
* [shutdown.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown)
* [taskkill.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/taskkill)
* [tasklist.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist)
* [wevtutil.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil)
* [winrs.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs)
* [wmic.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic)

These commands communicates with the [Windows Remote Registry Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/1dde6845-fca8-49d2-8bc2-199e9a164ac5), which means they use RPC (135/tcp + high ports) over SMB (445/tcp).