Netexec
NetExec (nxc) is a network service exploitation tool for assessing Windows and Active Directory environments at scale. It automates credential validation, share enumeration, command execution, and credential extraction across multiple hosts simultaneously. NetExec is the actively maintained successor to CrackMapExec.
Strategic context
Offensive operations in Windows environments frequently require answering the same questions across many hosts: where do these credentials work, what shares are accessible, which hosts allow administrative access, and where are additional credentials stored. Answering these questions one host at a time is impractical in environments with hundreds or thousands of systems.
NetExec addresses this by wrapping common offensive operations into a tool that operates against subnets and host lists rather than individual targets. A single command can validate credentials against an entire subnet, enumerate shares across all accessible hosts, or extract credentials from every system where administrative access exists.
The tool supports ten protocols, SMB, SSH, LDAP, FTP, WMI, WinRM, RDP, VNC, MSSQL, and NFS, making it applicable across nearly any access scenario. It accepts passwords, NTLM hashes, Kerberos tickets, and certificates for authentication, reflecting the variety of credential material operators encounter during engagements. Its modular architecture supports additional functionality through modules that extend the base capabilities for specific tasks.
For security leaders, NetExec activity shows an attacker moving past initial access and actively mapping the environment for escalation and lateral movement opportunities. The tool's efficiency means that the window between initial compromise and broad credential validation can be very short. Focus detections on patterns of authentication across multiple hosts in rapid succession, especially failed attempts followed by targeted successes. NetExec includes built-in OpSec warnings when executing actions that generate significant forensic artifacts, a feature that also signals which operations defenders should prioritize monitoring.
Execution examples
Credential validation
Testing credentials against a subnet identifies where they provide access and at what privilege level. NetExec marks hosts with (Pwn3d!) when administrative access is confirmed:
# Password authentication
nxc smb 10.10.10.0/24 -u user -p password
# Pass the hash
nxc smb 10.10.10.0/24 -u Administrator -H NTHASH
# Multiple users and passwords (careful with lockout policies)
nxc smb 10.10.10.0/24 -u users.txt -p passwords.txt --no-bruteforceThe --no-bruteforce flag tests each user-password pair in sequence rather than testing every combination, which is critical for avoiding account lockouts during password spraying.
Kerberos and certificate authentication
NetExec supports Kerberos authentication natively, either by requesting tickets with credentials or by using an existing ccache file:
Certificate-based authentication is also supported, which is valuable when exploiting AD CS misconfigurations:
When authenticating with a certificate, NetExec generates a ccache file that can be reused with other tools for Kerberos authentication.
Share enumeration
Enumerating accessible shares across multiple hosts reveals where sensitive data may be stored:
This produces a list of every share accessible with the provided credentials across all reachable hosts, including permission levels (READ, WRITE).
For deeper inspection, the spider_plus module lists or downloads all files from readable shares:
Command execution
When administrative access is confirmed, NetExec can execute commands across multiple hosts:
The -x flag executes cmd commands; -X executes PowerShell commands. Both require administrative access on the target.
Credential extraction
NetExec extracts credentials from hosts where administrative access exists. Beyond the standard SAM, LSA, and NTDS sources, it supports extraction from a wide range of applications and services:
Additional credential sources include SCCM, Veeam backups, WIFI passwords, WinSCP, VNC, mRemoteNG, PuTTY, and Remote Desktop Credential Manager. each accessible through dedicated flags or modules.
LAPS integration
When LAPS is deployed in the domain, NetExec can automatically read and use LAPS-managed passwords:
This reads the LAPS password and uses it for authentication, simplifying operations in LAPS-managed environments.
LDAP enumeration and attacks
NetExec's LDAP protocol support enables Active Directory enumeration and targeted attacks:
BloodHound integration
NetExec includes a built-in BloodHound ingestor and can automatically mark owned users in BloodHound's database when credentials are discovered:
BloodHound auto-marking is configured in ~/.nxc/nxc.conf and is especially useful when credential extraction tools like lsassy return multiple sets of credentials in a single dump.
Modules
NetExec's module system extends its capabilities for specific tasks:
Where NetExec fits in the lifecycle
Reconnaissance: Share enumeration, user and group discovery, SMB signing checks, delegation discovery, LDAP signing validation across subnets
Privilege escalation: Credential validation reveals where existing credentials provide administrative access; Kerberoasting and AS-REP roasting identify crackable accounts; LAPS bypass retrieves local admin passwords
Lateral movement: Credential spraying across subnets identifies movement targets; command execution enables actions on remote hosts; certificate and Kerberos authentication extend access with alternative credential material
Actions on objective: NTDS extraction shows full domain compromise; share spidering identifies and downloads accessible sensitive data; credential extraction from applications reveals stored passwords
Last updated