> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/online-attacks/netexec.md). # NetExec NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks. ## Online Attacks with nxc ### FTP Brute-force with list of users from file and specific known password, a.k.a password spraying. {% hint style="info" %} Info By default, nxc will exit after a successful login is found. Using the `--continue-on-success` flag will continue spraying even after a valid password is found. Useful for spraying a single password against a large user list. {% endhint %} ```bash nxc ftp $TARGET_IP -u users.txt -p secret_pw --continue-on-success ``` ```bash nxc ftp 10.11.12.0/24 -u users.txt -p secret_pw --continue-on-success ``` ```bash nxc ftp ips.txt-u users.txt -p secret_pw --continue-on-success ``` Add `--port ` if the service is using an non-standard port. ### SSH Brute-force password for specific user, e.g. `john` in this case ```bash nxc ssh $TARGET_IP -u john -p /usr/share/wordlists/rockyou.txt ``` Add `--port ` if the service is using an non-standard port. ## Credential Database A database is automatically used to store used/dumped credentials. Access it with `nxcdb`. ```bash ┌──(kali㉿kali)-[~] └─$ nxcdb -h usage: nxcdb [-h] [-gw] [-cw CREATE_WORKSPACE] [-sw SET_WORKSPACE] NXCDB is a database navigator for NXC options: -h, --help show this help message and exit -gw, --get-workspace get the current workspace -cw, --create-workspace CREATE_WORKSPACE create a new workspace -sw, --set-workspace SET_WORKSPACE set the current workspace ┌──(kali㉿kali)-[~] └─$ nxcdb nxcdb (default) > help Documented commands (type help ): ======================================== exit help proto workspace Undocumented commands: ====================== EOF nxcdb (default) > ``` ### List Known Credentials To list all SMB credentials ```bash nxcdb (default) > proto smb nxcdb (default)(smb) > help Documented commands (type help ): ======================================== clear_database creds dpapi exit export groups help hosts shares wcc Undocumented commands: ====================== back import nxcdb (default)(smb) > creds +Credentials---------+-----------+-------------------+-------------------+--------------------------+ | CredID | Admin On | CredType | Domain | UserName | Password | +--------+-----------+-----------+-------------------+-------------------+--------------------------+ | 1 | 0 Host(s) | plaintext | | | | | 2 | 0 Host(s) | plaintext | | | | | 3 | 0 Host(s) | plaintext | | Guest | | | 4 | 0 Host(s) | plaintext | corp.com | | | | 5 | 1 Host(s) | plaintext | corp.com | stephanie | LegmanTeamBenzoin!! | | 6 | 0 Host(s) | plaintext | vulnnet-rst.local | Guest | | | 7 | 0 Host(s) | plaintext | vulnnet-rst.local | | | | 8 | 0 Host(s) | plaintext | vulnnet-rst.local | t-skid | tj072889* | | 9 | 0 Host(s) | plaintext | vulnnet-rst | t-skid | tj072889* | | 10 | 1 Host(s) | plaintext | vulnnet-rst.local | a-whitehat | bNdKVkjv3RR9ht | | 11 | 0 Host(s) | plaintext | corp.com | jeff | HenchmanPutridBonbon11 | | 12 | 0 Host(s) | plaintext | cicada.htb | | | | 13 | 0 Host(s) | plaintext | cicada.htb | guest | | | 14 | 0 Host(s) | plaintext | cicada.htb | michael.wrightson | Cicada$M6Corpb*@Lp#nZp!8 | | 15 | 0 Host(s) | plaintext | cicada.htb | emily.oscars | Q!3@Lp#M6b*7t*Vt | | 16 | 0 Host(s) | plaintext | sequel.htb | rose | KxEPkKe6R8su | | 17 | 0 Host(s) | plaintext | sequel.htb | oscar | 86LxLBMgEWaKUnBG | | 18 | 0 Host(s) | plaintext | sequel.htb | ryan | WqSZAF6CysDQbGb3 | | 19 | 0 Host(s) | plaintext | htb.local | | | | 20 | 0 Host(s) | plaintext | htb.local | svc-alfresco | s3rvice | +--------+-----------+-----------+-------------------+-------------------+--------------------------+ nxcdb (default)(smb) > ``` We can list the credentials for only one specific user of the known protocol ```bash nxcdb (default)(smb) > creds svc-alfresco +Credential(s)-------+----------------------+-----------+--------------+----------+ | CredID | CredType | Pillaged From HostID | Domain | UserName | Password | +--------+-----------+----------------------+-----------+--------------+----------+ | 20 | plaintext | None | htb.local | svc-alfresco | s3rvice | +--------+-----------+----------------------+-----------+--------------+----------+ +Member of Group(s)+------+ | GroupID | Domain | Name | +---------+--------+------+ +Admin Access to Host(s)-+--------+----+ | HostID | IP | Hostname | Domain | OS | +--------+----+----------+--------+----+ nxcdb (default)(smb) > ``` ### List Known Hosts To list SMB hosts ```bash cmedb (default)(smb) > hosts ``` ### List Known Shares To list SMB shares ```bash cmedb (default)(smb) > shares ``` ## Usage information
nxc -h ```bash ┌──(kali㉿kali)-[~] └─$ nxc -h usage: nxc [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT] {smb,ftp,rdp,ssh,wmi,winrm,mssql,vnc,nfs,ldap} ... . . .| |. _ _ _ _____ || || | \ | | ___ | |_ | ____| __ __ ___ ___ \\( )// | \| | / _ \ | __| | _| \ \/ / / _ \ / __| .=[ ]=. | |\ | | __/ | |_ | |___ > < | __/ | (__ / /˙-˙\ \ |_| \_| \___| \__| |_____| /_/\_\ \___| \___| ˙ \ / ˙ ˙ ˙ The network execution tool Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx For documentation and usage examples, visit: https://www.netexec.wiki/ Version : 1.5.1 Codename: Yippie-Ki-Yay Commit : Kali Linux options: -h, --help show this help message and exit Generic Options: --version Display nxc version -t, --threads THREADS set how many concurrent threads to use --timeout TIMEOUT max timeout in seconds of each thread --jitter INTERVAL sets a random delay between each authentication Output Options: --no-progress do not displaying progress bar during scan --log LOG export result into a custom file --verbose enable verbose output --debug enable debug level information DNS: -6 Enable force IPv6 --dns-server DNS_SERVER Specify DNS server (default: Use hosts file & System DNS) --dns-tcp Use TCP instead of UDP for DNS queries --dns-timeout DNS_TIMEOUT DNS query timeout in seconds Available Protocols: {smb,ftp,rdp,ssh,wmi,winrm,mssql,vnc,nfs,ldap} smb own stuff using SMB ftp own stuff using FTP rdp own stuff using RDP ssh own stuff using SSH wmi own stuff using WMI winrm own stuff using WINRM mssql own stuff using MSSQL vnc own stuff using VNC nfs own stuff using NFS ldap own stuff using LDAP ```
nxc smb -h ```bash ┌──(kali㉿kali)-[~] └─$ nxc smb -h usage: nxc smb [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT] [-u USERNAME [USERNAME ...]] [-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce] [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT] [--fail-limit LIMIT] [-k] [--use-kcache] [--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST] [--pfx-cert PFXCERT] [--pfx-base64 PFXB64] [--pfx-pass PFXPASS] [--pem-cert PEMCERT] [--pem-key PEMKEY] [-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L [LIST_MODULES]] [--options] [-H HASH [HASH ...]] [--delegate DELEGATE] [--delegate-spn DELEGATE_SPN] [--generate-st GENERATE_ST] [--self] [-d DOMAIN | --local-auth] [--port PORT] [--share SHARE] [--smb-server-port SMB_SERVER_PORT] [--no-smbv1] [--no-admin-check] [--gen-relay-list OUTPUT_FILE] [--smb-timeout SMB_TIMEOUT] [--laps [LAPS]] [--generate-hosts-file GENERATE_HOSTS_FILE] [--generate-krb5-file GENERATE_KRB5_FILE] [--generate-tgt GENERATE_TGT] [--sam [{secdump,regdump}]] [--lsa [{secdump,regdump}]] [--ntds [{vss,drsuapi}]] [--kerberos-keys] [--history | --enabled] [--user USERNTDS] [--dpapi [{nosystem,cookies} ...]] [--sccm [{disk,wmi}]] [--mkfile MKFILE] [--pvk PVK] [--list-snapshots [LIST_SNAPSHOTS]] [--shares [SHARES]] [--exclude-shares EXCLUDE_SHARES [EXCLUDE_SHARES ...]] [--dir [DIR]] [--interfaces] [--no-write-check] [--filter-shares FILTER_SHARES [FILTER_SHARES ...]] [--disks] [--users [USER ...]] [--users-export USERS_EXPORT] [--groups [GROUP]] [--local-groups [GROUP]] [--computers [COMPUTER]] [--pass-pol] [--rid-brute [MAX_RID]] [--smb-sessions] [--reg-sessions [REG_SESSIONS]] [--loggedon-users [LOGGEDON_USERS]] [--loggedon-users-filter LOGGEDON_USERS_FILTER] [--qwinsta [QWINSTA]] [--tasklist [TASKLIST]] [--taskkill TASKKILL] [--wmi-query QUERY] [--wmi-namespace NAMESPACE] [--spider SHARE] [--spider-folder FOLDER] [--content] [--exclude-dirs DIR_LIST] [--depth DEPTH] [--only-files] [--silent] [--pattern PATTERN [PATTERN ...] | --regex REGEX [REGEX ...]] [--put-file FILE FILE] [--get-file FILE FILE] [--append-host] [--exec-method {wmiexec,atexec,smbexec,mmcexec}] [--dcom-timeout DCOM_TIMEOUT] [--get-output-tries GET_OUTPUT_TRIES] [--codec CODEC] [--no-output] [-x COMMAND | -X PS_COMMAND] [--obfs] [--amsi-bypass FILE] [--clear-obfscripts] [--force-ps32] [--no-encode] target [target ...] positional arguments: target the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s) options: -h, --help show this help message and exit -H, --hash HASH [HASH ...] NTLM hash(es) or file(s) containing NTLM hashes --delegate DELEGATE Impersonate user with S4U2Self + S4U2Proxy --delegate-spn DELEGATE_SPN SPN to use for S4U2Proxy, if not specified the SPN used will be cifs/ --generate-st GENERATE_ST Store the S4U Service Ticket in the specified file --self Only do S4U2Self, no S4U2Proxy (use with delegate) -d, --domain DOMAIN domain to authenticate to --local-auth authenticate locally to each target --port PORT SMB port (default: 445) --share SHARE specify a share (default: C$) --smb-server-port SMB_SERVER_PORT specify a server port for SMB (default: 445) --no-smbv1 Force to disable SMBv1 in connection --no-admin-check Avoid checking admin which queries the Service Control Manager --gen-relay-list OUTPUT_FILE outputs all hosts that don't require SMB signing to the specified file --smb-timeout SMB_TIMEOUT SMB connection timeout (default: 2) --laps [LAPS] LAPS authentification --generate-hosts-file GENERATE_HOSTS_FILE Generate a hosts file like from a range of IP --generate-krb5-file GENERATE_KRB5_FILE Generate a krb5 file like from a range of IP --generate-tgt GENERATE_TGT Generate a tgt ticket Generic Options: --version Display nxc version -t, --threads THREADS set how many concurrent threads to use (default: 256) --timeout TIMEOUT max timeout in seconds of each thread --jitter INTERVAL sets a random delay between each authentication Output Options: --no-progress do not displaying progress bar during scan --log LOG export result into a custom file --verbose enable verbose output --debug enable debug level information DNS: -6 Enable force IPv6 --dns-server DNS_SERVER Specify DNS server (default: Use hosts file & System DNS) --dns-tcp Use TCP instead of UDP for DNS queries --dns-timeout DNS_TIMEOUT DNS query timeout in seconds (default: 3) Authentication: -u, --username USERNAME [USERNAME ...] username(s) or file(s) containing usernames -p, --password PASSWORD [PASSWORD ...] password(s) or file(s) containing passwords -id CRED_ID [CRED_ID ...] database credential ID(s) to use for authentication --ignore-pw-decoding Ignore non UTF-8 characters when decoding the password file --no-bruteforce No spray when using file for username and password (user1 => password1, user2 => password2) --continue-on-success continues authentication attempts even after successes --gfail-limit LIMIT max number of global failed login attempts --ufail-limit LIMIT max number of failed login attempts per username --fail-limit LIMIT max number of failed login attempts per host Kerberos Authentication: -k, --kerberos Use Kerberos authentication --use-kcache Use Kerberos authentication from ccache file (KRB5CCNAME) --aesKey AESKEY [AESKEY ...] AES key to use for Kerberos Authentication (128 or 256 bits) --kdcHost KDCHOST FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter Certificate Authentication: --pfx-cert PFXCERT Use certificate authentication from pfx file .pfx --pfx-base64 PFXB64 Use certificate authentication from pfx file encoded in base64 --pfx-pass PFXPASS Password of the pfx certificate --pem-cert PEMCERT Use certificate authentication from PEM file --pem-key PEMKEY Private key for the PEM format Modules: -M, --module MODULE module to use -o MODULE_OPTION [MODULE_OPTION ...] module options -L, --list-modules [LIST_MODULES] list available modules --options display module options Credential Gathering: --sam [{secdump,regdump}] dump SAM hashes from target systems --lsa [{secdump,regdump}] dump LSA secrets from target systems --ntds [{vss,drsuapi}] dump the NTDS.dit from target DCs using the specifed method --kerberos-keys Also dump Kerberos AES and DES keys from target DC (NTDS.dit) --history Also retrieve password history from target DC (NTDS.dit) --enabled Only dump enabled targets from DC (NTDS.dit) --user USERNTDS Dump selected user from DC (NTDS.dit) --dpapi [{nosystem,cookies} ...] dump DPAPI secrets from target systems, can dump cookies if you add 'cookies', will not dump SYSTEM dpapi if you add nosystem --sccm [{disk,wmi}] dump SCCM secrets from target systems --mkfile MKFILE DPAPI option. File with masterkeys in form of {GUID}:SHA1 --pvk PVK DPAPI option. File with domain backupkey --list-snapshots [LIST_SNAPSHOTS] Lists the VSS snapshots (default: ADMIN$) Mapping/Enumeration: --shares [SHARES] Enumerate shares and access, filter on specified argument (read ; write ; read,write) --exclude-shares EXCLUDE_SHARES [EXCLUDE_SHARES ...] List of shares to exclude from enumeration (e.g., C$ Admin$ IPC$) --dir [DIR] List the content of a path (default path: '') --interfaces Enumerate network interfaces --no-write-check Skip write check on shares (avoid leaving traces when missing delete permissions) --filter-shares FILTER_SHARES [FILTER_SHARES ...] Filter share by access, option 'READ' 'WRITE' or 'READ,WRITE' --disks Enumerate disks --users [USER ...] Enumerate domain users, if a user is specified than only its information is queried. --users-export USERS_EXPORT Enumerate domain users and export them to the specified file --groups [GROUP] Enumerate domain groups, if a group is specified than its members are Enumerated --local-groups [GROUP] Enumerate local groups, if a group is specified then its members are Enumerated --computers [COMPUTER] Enumerate computer users --pass-pol dump password policy --rid-brute [MAX_RID] Enumerate users by bruteforcing RIDs --smb-sessions Enumerate active smb sessions --reg-sessions [REG_SESSIONS] Enumerate users sessions using the Remote Registry. If a username is given, filter for it. If a file is given, filter for listed usernames. If no value is given, list all. --loggedon-users [LOGGEDON_USERS] Enumerate logged on users, if a user is specified than a regex filter is applied. --loggedon-users-filter LOGGEDON_USERS_FILTER only search for specific user, works with regex --qwinsta [QWINSTA] Enumerate user sessions. If a username is given, filter for it; if a file is given, filter for listed usernames. If no value is given, list all. --tasklist [TASKLIST] Enumerate running processes and filter for the specified one if specified --taskkill TASKKILL Kills a specific PID or a proces name's PID's WMI Queries: --wmi-query QUERY Issues the specified WMI query --wmi-namespace NAMESPACE WMI Namespace (default: root\cimv2) Spidering Shares: --spider SHARE share to spider --spider-folder FOLDER folder to spider (default: .) --content enable file content searching --exclude-dirs DIR_LIST directories to exclude from spidering --depth DEPTH max spider recursion depth --only-files only spider files --silent Do not print found files/directories --pattern PATTERN [PATTERN ...] pattern(s) to search for in folders, filenames and file content --regex REGEX [REGEX ...] regex(s) to search for in folders, filenames and file content File Operations: --put-file FILE FILE Put a local file into remote target, ex: whoami.txt \\Windows\\Temp\\whoami.txt --get-file FILE FILE Get a remote file, ex: \\Windows\\Temp\\whoami.txt whoami.txt --append-host append the host to the get-file filename Command Execution: --exec-method {wmiexec,atexec,smbexec,mmcexec} method to execute the command. Ignored if in MSSQL mode (default: wmiexec) --dcom-timeout DCOM_TIMEOUT DCOM connection timeout (default: 5) --get-output-tries GET_OUTPUT_TRIES Number of times atexec/smbexec/mmcexec tries to get results (default: 10) --codec CODEC Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec (default: utf-8) --no-output do not retrieve command output -x COMMAND execute the specified CMD command -X PS_COMMAND execute the specified PowerShell command Powershell Script Obfuscation: --obfs Obfuscate PowerShell scripts --amsi-bypass FILE File with a custom AMSI bypass --clear-obfscripts Clear all cached obfuscated PowerShell scripts --force-ps32 force PowerShell commands to run in a 32-bit process (may not apply to modules) --no-encode Do not encode the PowerShell command ran on target ```
nxc ssh -h ```bash ┌──(kali㉿kali)-[~] └─$ nxc ssh -h usage: nxc ssh [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT] [-u USERNAME [USERNAME ...]] [-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce] [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT] [--fail-limit LIMIT] [-k] [--use-kcache] [--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST] [--pfx-cert PFXCERT] [--pfx-base64 PFXB64] [--pfx-pass PFXPASS] [--pem-cert PEMCERT] [--pem-key PEMKEY] [-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L [LIST_MODULES]] [--options] [--key-file KEY_FILE] [--port PORT] [--ssh-timeout SSH_TIMEOUT] [--sudo-check] [--sudo-check-method {mkfifo,sudo-stdin}] [--get-output-tries GET_OUTPUT_TRIES] [--put-file FILE FILE] [--get-file FILE FILE] [--codec CODEC] [--no-output] [-x COMMAND] target [target ...] positional arguments: target the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s) options: -h, --help show this help message and exit --key-file KEY_FILE Authenticate using the specified private key. Treats the password parameter as the key's passphrase. --port PORT SSH port (default: 22) --ssh-timeout SSH_TIMEOUT SSH connection timeout (default: 15) --sudo-check Check user privilege with sudo --sudo-check-method {mkfifo,sudo-stdin} method to do with sudo check (mkfifo is non-stable, probably you need to execute once again if it failed)' (default: sudo-stdin) --get-output-tries GET_OUTPUT_TRIES Number of times with sudo command tries to get results (default: 5) Generic Options: --version Display nxc version -t, --threads THREADS set how many concurrent threads to use (default: 256) --timeout TIMEOUT max timeout in seconds of each thread --jitter INTERVAL sets a random delay between each authentication Output Options: --no-progress do not displaying progress bar during scan --log LOG export result into a custom file --verbose enable verbose output --debug enable debug level information DNS: -6 Enable force IPv6 --dns-server DNS_SERVER Specify DNS server (default: Use hosts file & System DNS) --dns-tcp Use TCP instead of UDP for DNS queries --dns-timeout DNS_TIMEOUT DNS query timeout in seconds (default: 3) Authentication: -u, --username USERNAME [USERNAME ...] username(s) or file(s) containing usernames -p, --password PASSWORD [PASSWORD ...] password(s) or file(s) containing passwords -id CRED_ID [CRED_ID ...] database credential ID(s) to use for authentication --ignore-pw-decoding Ignore non UTF-8 characters when decoding the password file --no-bruteforce No spray when using file for username and password (user1 => password1, user2 => password2) --continue-on-success continues authentication attempts even after successes --gfail-limit LIMIT max number of global failed login attempts --ufail-limit LIMIT max number of failed login attempts per username --fail-limit LIMIT max number of failed login attempts per host Kerberos Authentication: -k, --kerberos Use Kerberos authentication --use-kcache Use Kerberos authentication from ccache file (KRB5CCNAME) --aesKey AESKEY [AESKEY ...] AES key to use for Kerberos Authentication (128 or 256 bits) --kdcHost KDCHOST FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter Certificate Authentication: --pfx-cert PFXCERT Use certificate authentication from pfx file .pfx --pfx-base64 PFXB64 Use certificate authentication from pfx file encoded in base64 --pfx-pass PFXPASS Password of the pfx certificate --pem-cert PEMCERT Use certificate authentication from PEM file --pem-key PEMKEY Private key for the PEM format Modules: -M, --module MODULE module to use -o MODULE_OPTION [MODULE_OPTION ...] module options -L, --list-modules [LIST_MODULES] list available modules --options display module options File Operations: --put-file FILE FILE Put a local file into remote target, ex: whoami.txt /tmp/whoami.txt --get-file FILE FILE Get a remote file, ex: /tmp/whoami.txt whoami.txt Command Execution: --codec CODEC Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec (default: utf-8) --no-output do not retrieve command output -x COMMAND execute the specified command ```
## Resources NetExec - GitHub: NetExec - Kali Tools: NetExec - Wiki: