Executing code via SMB / DCOM without PSEXEC

PSEXEC has been a staple for Windows post exploitation pivoting and system administration for a long while. The basic premise of how all “psexec” tools work is: (Optional) Upload a service executable (PSEXECSVC.EXE in the case of SysInternal’s tool) to the ADMIN$ share Connect to the service manager on the remote host, and create a service based on either a local (to the remote system) executable or the uploaded one.