title: Understanding smb and DCERPC for remote command execution capabilities
body: <p>I'm trying to understand all the methods available to execute remote commands on Windows through the impacket scripts:</p>
  
  <p><a href="https://www.coresecurity.com/corelabs-research/open-source-tools/impacket" rel="noreferrer">https://www.coresecurity.com/corelabs-research/open-source-tools/impacket</a></p>
  
  <p><a href="https://github.com/CoreSecurity/impacket" rel="noreferrer">https://github.com/CoreSecurity/impacket</a></p>
  
  <p>I understand the high level explanation of psexec.py and smbexec.py, how they create a service on the remote end and run commands through <code>cmd.exe -c</code> but I can't understand how can you create a service on a remote windows host through SMB. Wasn't smb supposed to be mainly for file transfers and printer sharing? Reading the source code I see in the notes that they use DCERPC to create this services, is this part of the smb protocol? All the resources on DCERPC i've found were kind of confusing, and not focused on its service creating capabilities. Looking at the sourcecode of atexec.py, it says that it interacts with the task scheduler service of the windows host, also through DCERPC. Can it be used to interact with all services running on the remote box? </p>
  
  <p>Thanks!</p>