NetExec
Swiss-army knife for SMB/WinRM/LDAP: validates creds and enumerates (formerly CrackMapExec).
The Swiss-army knife of Windows/AD networks (CrackMapExec's successor). Over SMB, WinRM, LDAP, MSSQL, RDP, SSH and more: it bulk-validates credentials, enumerates shares and users, sprays passwords, does Pass-the-Hash and runs modules. A (Pwn3d!) means admin access.
Family Active Directory enumeration
Flags smb/ldap/winrm -u -p -H --users --shares
Concepts Password Spraying, Pass-the-Hash, Credential reuse, SAM & LSA Secrets Dump, NTDS.dit Dump
Cheatsheet SMB · 139 / 445
Installation
pipx install git+https://github.com/Pennyw0rth/NetExec
# se invoca como 'nxc' o 'netexec'Useful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- AccessProving Grounds Practice
- ActiveHackTheBox
- AdministratorHackTheBox
- ApexProving Grounds Practice
- AtomHackTheBox
- BlueHackTheBox
- BountyHackTheBox
- CascadeHackTheBox
- CertifiedHackTheBox
- ChatterboxHackTheBox
- CicadaHackTheBox
- ClueProving Grounds Practice
- Dance-SambaDockerLabs
- DomainDockerLabs
- ForestHackTheBox
- HeistHackTheBox
- HokkaidoProving Grounds Practice
- MailingHackTheBox
- NagoyaProving Grounds Practice
- NetmonHackTheBox
- SaunaHackTheBox
- ServmonHackTheBox
- ShenziProving Grounds Practice
- SupportHackTheBox
- Symfonos 1 & 2VulnHub
- TimelapseHackTheBox
- VaultProving Grounds Practice