CrackMapExec
NetExec's predecessor: SMB/WinRM/LDAP sweeping with credentials.
The domain sweeper that popularised the "one credential against the whole network" attack. Given a user, password or hash it checks at once how many machines it works on, over SMB, WinRM, LDAP, MSSQL or RDP; it enumerates shares, users and policies, dumps the SAM and runs commands wherever the account is an admin (the famous `(Pwn3d!)`). It is the name in nearly every CPTS note, although its development continues today as **NetExec** (`nxc`), which is what you should use; it is documented here because it is what appears in the material and in many writeups.
Family Active Directory enumeration
Flags smb winrm ldap -u -p -H --shares --sam
Concepts Pass-the-Hash, Password Spraying, Credential reuse, SAM & LSA Secrets Dump
Cheatsheet Post-exploitation & lateral
Installation
# CrackMapExec esta descontinuado: usa netexec (nxc). Se mantiene por compatibilidad:
pipx install crackmapexecUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.