> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ldap-discovery/netexec.md).

# NetExec

## BloodHound scan

To perform a BloodHound-scan and collect all data

```bash
nxc ldap $DC_IP --dns-server $DNS_IP -u <user> -p '<password>' --bloodhound -c all
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Machines/Easy_Machines/EscapeTwo]
└─$ nxc ldap sequel.htb --dns-server $TARGET_IP -u ryan -p 'WqSZAF6CysDQbGb3' --bloodhound -c all
LDAP        10.129.232.128  389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:sequel.htb) (signing:None) (channel binding:Never) 
LDAP        10.129.232.128  389    DC01             [+] sequel.htb\ryan:WqSZAF6CysDQbGb3 
LDAP        10.129.232.128  389    DC01             Resolved collection methods: localadmin, objectprops, dcom, trusts, container, rdp, psremote, session, group, acl
LDAP        10.129.232.128  389    DC01             Done in 0M 6S
LDAP        10.129.232.128  389    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.129.232.128_2026-06-26_121221_bloodhound.zip

```

</details>

## Enumeration

### User Enumeration

To enumerate all domain users with `nxc` over LDAP

```bash
nxc ldap $TARGET_IP -u '<username>' -p '<password>' --users
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ nxc ldap $TARGET_IP -u 'stephanie' -p 'LegmanTeamBenzoin!!' --users                            
LDAP        192.168.210.70  389    DC1              [*] Windows Server 2022 Build 20348 (name:DC1) (domain:corp.com) (signing:None) (channel binding:No TLS cert) 
LDAP        192.168.210.70  389    DC1              [+] corp.com\stephanie:LegmanTeamBenzoin!! 
LDAP        192.168.210.70  389    DC1              [*] Enumerated 13 domain users: corp.com
LDAP        192.168.210.70  389    DC1              -Username-                    -Last PW Set-       -BadPW-  -Description-                                               
LDAP        192.168.210.70  389    DC1              Administrator                 2022-08-17 02:27:22 0        Built-in account for administering the computer/domain      
LDAP        192.168.210.70  389    DC1              Guest                         <never>             0        Built-in account for guest access to the computer/domain    
LDAP        192.168.210.70  389    DC1              krbtgt                        2022-09-03 01:10:48 0        Key Distribution Center Service Account                     
LDAP        192.168.210.70  389    DC1              dave                          2022-09-07 18:54:57 0                                                                    
LDAP        192.168.210.70  389    DC1              stephanie                     2022-09-03 01:23:38 0                                                                    
LDAP        192.168.210.70  389    DC1              jeff                          2022-09-03 01:27:20 0                                                                    
LDAP        192.168.210.70  389    DC1              jeffadmin                     2022-09-03 01:26:48 0                                                                    
LDAP        192.168.210.70  389    DC1              iis_service                   2022-09-07 14:38:43 0                                                                    
LDAP        192.168.210.70  389    DC1              pete                          2022-09-06 21:41:54 0                                                                    
LDAP        192.168.210.70  389    DC1              jen                           2022-09-06 21:43:01 0                                                                    
LDAP        192.168.210.70  389    DC1              robert                        2026-04-15 10:30:40 0                                                                    
LDAP        192.168.210.70  389    DC1              christina                     2026-04-15 10:30:40 0                                                                    
LDAP        192.168.210.70  389    DC1              bethany                       2026-04-15 10:30:40 0   
```

</details>

To create a file called `users.txt` with the result we can

```bash
nxc ldap $TARGET_IP -u '<username>' -p '<password>' --users | grep -vE '[+]|[*]|-User' | awk '{print $5}' > users.txt
```

## Usage information

<details>

<summary>nxc -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ nxc -h
usage: nxc [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp]
           [--dns-timeout DNS_TIMEOUT]
           {smb,ftp,rdp,ssh,wmi,winrm,mssql,vnc,nfs,ldap} ...

     .   .
    .|   |.     _   _          _     _____
    ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
    \\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
    .=[ ]=.    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__
   / /˙-˙\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
   ˙ \   / ˙
     ˙   ˙

    The network execution tool
    Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx

    For documentation and usage examples, visit: https://www.netexec.wiki/

    Version : 1.5.1
    Codename: Yippie-Ki-Yay
    Commit  : Kali Linux
    

options:
  -h, --help            show this help message and exit

Generic Options:
  --version             Display nxc version
  -t, --threads THREADS
                        set how many concurrent threads to use
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output Options:
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file
  --verbose             enable verbose output
  --debug               enable debug level information

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds

Available Protocols:
  {smb,ftp,rdp,ssh,wmi,winrm,mssql,vnc,nfs,ldap}
    smb                 own stuff using SMB
    ftp                 own stuff using FTP
    rdp                 own stuff using RDP
    ssh                 own stuff using SSH
    wmi                 own stuff using WMI
    winrm               own stuff using WINRM
    mssql               own stuff using MSSQL
    vnc                 own stuff using VNC
    nfs                 own stuff using NFS
    ldap                own stuff using LDAP

```

</details>

<details>

<summary>nxc ldap -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ nxc ldap -h                                                    
usage: nxc ldap [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT]
                [-u USERNAME [USERNAME ...]] [-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce] [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT]
                [--fail-limit LIMIT] [-k] [--use-kcache] [--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST] [--pfx-cert PFXCERT] [--pfx-base64 PFXB64] [--pfx-pass PFXPASS] [--pem-cert PEMCERT] [--pem-key PEMKEY]
                [-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L [LIST_MODULES]] [--options] [-H HASH [HASH ...] | --simple-bind] [--port PORT] [-d DOMAIN] [--asreproast ASREPROAST] [--kerberoasting KERBEROASTING]
                [--kerberoast-account KERBEROAST_ACCOUNT [KERBEROAST_ACCOUNT ...]] [--no-preauth-targets NO_PREAUTH_TARGETS] [--base-dn BASE_DN] [--query QUERY QUERY] [--find-delegation] [--trusted-for-delegation]
                [--password-not-required] [--admin-count] [--users [USERS ...]] [--users-export USERS_EXPORT] [--groups [GROUPS]] [--computers] [--dc-list] [--get-sid] [--active-users [ACTIVE_USERS ...]] [--pso]
                [--pass-pol] [--gmsa] [--gmsa-convert-id GMSA_CONVERT_ID] [--gmsa-decrypt-lsa GMSA_DECRYPT_LSA] [--bloodhound] [-c COLLECTION]
                target [target ...]

positional arguments:
  target                the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)

options:
  -h, --help            show this help message and exit
  -H, --hash HASH [HASH ...]
                        NTLM hash(es) or file(s) containing NTLM hashes
  --simple-bind         Use simple bind authentication (no signing/sealing)
  --port PORT           LDAP port (default: 389)
  -d DOMAIN             domain to authenticate to

Generic Options:
  --version             Display nxc version
  -t, --threads THREADS
                        set how many concurrent threads to use (default: 256)
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output Options:
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file
  --verbose             enable verbose output
  --debug               enable debug level information

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds (default: 3)

Authentication:
  -u, --username USERNAME [USERNAME ...]
                        username(s) or file(s) containing usernames
  -p, --password PASSWORD [PASSWORD ...]
                        password(s) or file(s) containing passwords
  -id CRED_ID [CRED_ID ...]
                        database credential ID(s) to use for authentication
  --ignore-pw-decoding  Ignore non UTF-8 characters when decoding the password file
  --no-bruteforce       No spray when using file for username and password (user1 => password1, user2 => password2)
  --continue-on-success
                        continues authentication attempts even after successes
  --gfail-limit LIMIT   max number of global failed login attempts
  --ufail-limit LIMIT   max number of failed login attempts per username
  --fail-limit LIMIT    max number of failed login attempts per host

Kerberos Authentication:
  -k, --kerberos        Use Kerberos authentication
  --use-kcache          Use Kerberos authentication from ccache file (KRB5CCNAME)
  --aesKey AESKEY [AESKEY ...]
                        AES key to use for Kerberos Authentication (128 or 256 bits)
  --kdcHost KDCHOST     FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter

Certificate Authentication:
  --pfx-cert PFXCERT    Use certificate authentication from pfx file .pfx
  --pfx-base64 PFXB64   Use certificate authentication from pfx file encoded in base64
  --pfx-pass PFXPASS    Password of the pfx certificate
  --pem-cert PEMCERT    Use certificate authentication from PEM file
  --pem-key PEMKEY      Private key for the PEM format

Modules:
  -M, --module MODULE   module to use
  -o MODULE_OPTION [MODULE_OPTION ...]
                        module options
  -L, --list-modules [LIST_MODULES]
                        list available modules
  --options             display module options

Retrieve hash on the remote DC:
  Options to get hashes from Kerberos

  --asreproast ASREPROAST
                        Output AS_REP response to crack with hashcat to file
  --kerberoasting, --kerberoast KERBEROASTING
                        Output TGS ticket to crack with hashcat to file
  --kerberoast-account KERBEROAST_ACCOUNT [KERBEROAST_ACCOUNT ...]
                        Target specific accounts for kerberoasting (sAMAccountNames or file containing sAMAccountNames)
  --no-preauth-targets NO_PREAUTH_TARGETS
                        Targeted kerberoastable users

Retrieve useful information on the domain:
  --base-dn BASE_DN     base DN for search queries
  --query QUERY QUERY   Query LDAP with a custom filter and attributes
  --find-delegation     Finds delegation relationships within an Active Directory domain. (Enabled Accounts only)
  --trusted-for-delegation
                        Get the list of users and computers with flag TRUSTED_FOR_DELEGATION
  --password-not-required
                        Get the list of users with flag PASSWD_NOTREQD
  --admin-count         Get user that had the value adminCount=1
  --users [USERS ...]   Enumerate domain users
  --users-export USERS_EXPORT
                        Enumerate domain users and export them to the specified file
  --groups [GROUPS]     Enumerate domain groups, if a group is specified than its members are enumerated
  --computers           Enumerate domain computers
  --dc-list             Enumerate Domain Controllers
  --get-sid             Get domain sid
  --active-users [ACTIVE_USERS ...]
                        Get Active Domain Users Accounts
  --pso                 Get Fine Grained Password Policy/PSOs
  --pass-pol            Dump password policy

Retrieve gmsa on the remote DC:
  Options to play with gmsa

  --gmsa                Enumerate GMSA passwords
  --gmsa-convert-id GMSA_CONVERT_ID
                        Get the secret name of specific gmsa or all gmsa if no gmsa provided
  --gmsa-decrypt-lsa GMSA_DECRYPT_LSA
                        Decrypt the gmsa encrypted value from LSA

Bloodhound Scan:
  Options to play with Bloodhoud

  --bloodhound          Perform a Bloodhound scan
  -c, --collection COLLECTION
                        Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by
                        separating them with a comma (default: Default)
                                             
```

</details>

## Resources

NetExec - GitHub: <https://github.com/Pennyw0rth/NetExec>

NetExec - Kali Tools: <https://www.kali.org/tools/netexec/>

NetExec - Wiki: <https://www.netexec.wiki>