impacket-psexec

PsExec-style remote shell over SMB (authorized testing only).

$ impacket-psexec corp/operator:'Pw'@10.0.0.5
$ impacket-psexec -hashes :NTHASH corp/operator@10.0.0.5