> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/smb-discovery/crackmapexec.md).

# Crackmapexec

Crackmapexec is a swiss army knife for pentesting Windows/Active Directory environments.

From enumerating logged on users and spidering SMB shares to executing psexec style attacks, auto-injecting Mimikatz/Shellcode/DLL’s into memory using Powershell, dumping the NTDS.dit and more.

The biggest improvements over the above tools are:

* Pure Python script, no external tools required
* Fully concurrent threading
* Uses **ONLY** native WinAPI calls for discovering sessions, users, dumping SAM hashes etc…
* Opsec safe (no binaries are uploaded to dump clear-text credentials, inject shellcode etc…)

Additionally, a database is used to store used/dumped credentals. It also automatically correlates Admin credentials to hosts and vice-versa allowing you to easily keep track of credential sets and gain additional situational awareness in large environments.

Crackmapexec is **no longer maintained** due to the existence of a hostile fork.

## Enumeration

### Enumerating Domain Users

To enumerate all domain users

```bash
crackmapexec smb $TARGET_IP -u <user> -p '<password>' --users 
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Machines/Easy_Machines/Return]
└─$ crackmapexec smb $TARGET_IP -u svc-printer -p '1edFg43012!!' --users         
SMB         10.10.11.108    445    PRINTER          [*] Windows 10 / Server 2019 Build 17763 x64 (name:PRINTER) (domain:return.local) (signing:True) (SMBv1:False)
SMB         10.10.11.108    445    PRINTER          [+] return.local\svc-printer:1edFg43012!! 
SMB         10.10.11.108    445    PRINTER          [+] Enumerated domain user(s)
SMB         10.10.11.108    445    PRINTER          return.local\svc-printer                    badpwdcount: 0 desc: Service Account for Printer
SMB         10.10.11.108    445    PRINTER          return.local\krbtgt                         badpwdcount: 0 desc: Key Distribution Center Service Account
SMB         10.10.11.108    445    PRINTER          return.local\Guest                          badpwdcount: 0 desc: Built-in account for guest access to the computer/domain
SMB         10.10.11.108    445    PRINTER          return.local\Administrator                  badpwdcount: 0 desc: Built-in account for administering the computer/domain

```

</details>

### Enumerating Logged-on Users

To enumerate logged-on users

```bash
crackmapexec smb $TARGET_IP -u <user> -p '<password>' --loggedon-users
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Starting_Point/Tier_1/Tactics]
└─$  crackmapexec smb $TARGET_IP -u Administrator -p '' --loggedon-users
SMB         10.129.23.151   445    TACTICS          [*] Windows 10 / Server 2019 Build 17763 x64 (name:TACTICS) (domain:Tactics) (signing:False) (SMBv1:False)
SMB         10.129.23.151   445    TACTICS          [+] Tactics\Administrator: (Pwn3d!)
SMB         10.129.23.151   445    TACTICS          [+] Enumerated loggedon users
SMB         10.129.23.151   445    TACTICS          TACTICS\Administrator             logon_server: TACTICS

```

</details>

### Enumerating Password Policy

To enumerate the machine's password policy

```bash
crackmapexec smb $TARGET_IP -u <user> -p '<password>' --pass-pol
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Starting_Point/Tier_1/Tactics]
└─$  crackmapexec smb $TARGET_IP -u Administrator -p '' --pass-pol
SMB         10.129.23.151   445    TACTICS          [*] Windows 10 / Server 2019 Build 17763 x64 (name:TACTICS) (domain:Tactics) (signing:False) (SMBv1:False)
SMB         10.129.23.151   445    TACTICS          [+] Tactics\Administrator: (Pwn3d!)
SMB         10.129.23.151   445    TACTICS          [+] Dumping password info for domain: TACTICS
SMB         10.129.23.151   445    TACTICS          Minimum password length: None
SMB         10.129.23.151   445    TACTICS          Password history length: None
SMB         10.129.23.151   445    TACTICS          Maximum password age: 41 days 23 hours 53 minutes 
SMB         10.129.23.151   445    TACTICS          
SMB         10.129.23.151   445    TACTICS          Password Complexity Flags: 000000
SMB         10.129.23.151   445    TACTICS              Domain Refuse Password Change: 0
SMB         10.129.23.151   445    TACTICS              Domain Password Store Cleartext: 0
SMB         10.129.23.151   445    TACTICS              Domain Password Lockout Admins: 0
SMB         10.129.23.151   445    TACTICS              Domain Password No Clear Change: 0
SMB         10.129.23.151   445    TACTICS              Domain Password No Anon Change: 0
SMB         10.129.23.151   445    TACTICS              Domain Password Complex: 0
SMB         10.129.23.151   445    TACTICS          
SMB         10.129.23.151   445    TACTICS          Minimum password age: None
SMB         10.129.23.151   445    TACTICS          Reset Account Lockout Counter: 30 minutes 
SMB         10.129.23.151   445    TACTICS          Locked Account Duration: 30 minutes 
SMB         10.129.23.151   445    TACTICS          Account Lockout Threshold: None
SMB         10.129.23.151   445    TACTICS          Forced Log off Time: Not Set

```

</details>

### Enumerating Shares

Enumerating shares of a specific machine with known credentials

```bash
crackmapexec smb $TARGET_IP -u svc-printer -p '1edFg43012!!' --shares
```

Same but in verbose mode

```bash
crackmapexec --verbose smb $TARGET_IP -u svc-printer -p '1edFg43012!!' --shares
```

Enumerating shares with `Guest` user

```bash
crackmapexec smb $TARGET_IP -u Guest -p '' --shares
```

Enumerating shares as Anonymous (Null-session)

```bash
crackmapexec smb $TARGET_IP -u '' -p '' --shares
```

## Usage information

<details>

<summary>crackmapexec -h</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Cources]
└─$ crackmapexec -h                                                                         
usage: crackmapexec [-h] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--darrell] [--verbose] {smb,ftp,rdp,ssh,winrm,mssql,ldap} ...

      ______ .______           ___        ______  __  ___ .___  ___.      ___      .______    _______ ___   ___  _______   ______
     /      ||   _  \         /   \      /      ||  |/  / |   \/   |     /   \     |   _  \  |   ____|\  \ /  / |   ____| /      |
    |  ,----'|  |_)  |       /  ^  \    |  ,----'|  '  /  |  \  /  |    /  ^  \    |  |_)  | |  |__    \  V  /  |  |__   |  ,----'
    |  |     |      /       /  /_\  \   |  |     |    <   |  |\/|  |   /  /_\  \   |   ___/  |   __|    >   <   |   __|  |  |
    |  `----.|  |\  \----. /  _____  \  |  `----.|  .  \  |  |  |  |  /  _____  \  |  |      |  |____  /  .  \  |  |____ |  `----.
     \______|| _| `._____|/__/     \__\  \______||__|\__\ |__|  |__| /__/     \__\ | _|      |_______|/__/ \__\ |_______| \______|

                                                A swiss army knife for pentesting networks
                                    Forged by @byt3bl33d3r and @mpgn_x64 using the powah of dank memes

                                           Exclusive release for Porchetta Industries users
                                                       https://porchetta.industries/

                                                   Version : 5.4.0
                                                   Codename: Indestructible G0thm0g

options:
  -h, --help            show this help message and exit
  -t THREADS            set how many concurrent threads to use (default: 100)
  --timeout TIMEOUT     max timeout in seconds of each thread (default: None)
  --jitter INTERVAL     sets a random delay between each connection (default: None)
  --darrell             give Darrell a hand
  --verbose             enable verbose output

protocols:
  available protocols

  {smb,ftp,rdp,ssh,winrm,mssql,ldap}
    smb                 own stuff using SMB
    ftp                 own stuff using FTP
    rdp                 own stuff using RDP
    ssh                 own stuff using SSH
    winrm               own stuff using WINRM
    mssql               own stuff using MSSQL
    ldap                own stuff using LDAP

```

</details>

<details>

<summary>crackmapexec smb -h</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Cources]
└─$ crackmapexec smb -h
usage: crackmapexec smb [-h] [-id CRED_ID [CRED_ID ...]] [-u USERNAME [USERNAME ...]] [-p PASSWORD [PASSWORD ...]] [-k] [--use-kcache] [--export EXPORT [EXPORT ...]]
                        [--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST] [--gfail-limit LIMIT | --ufail-limit LIMIT | --fail-limit LIMIT] [-M MODULE]
                        [-o MODULE_OPTION [MODULE_OPTION ...]] [-L] [--options] [--server {http,https}] [--server-host HOST] [--server-port PORT] [--connectback-host CHOST]
                        [-H HASH [HASH ...]] [--no-bruteforce] [-d DOMAIN | --local-auth] [--port {139,445}] [--share SHARE] [--smb-server-port SMB_SERVER_PORT]
                        [--gen-relay-list OUTPUT_FILE] [--continue-on-success] [--smb-timeout SMB_TIMEOUT] [--laps [LAPS]] [--sam | --lsa | --ntds [{vss,drsuapi}]] [--enabled]
                        [--user USERNTDS] [--shares] [--sessions] [--disks] [--loggedon-users-filter LOGGEDON_USERS_FILTER] [--loggedon-users] [--users [USER]]
                        [--groups [GROUP]] [--computers [COMPUTER]] [--local-groups [GROUP]] [--pass-pol] [--rid-brute [MAX_RID]] [--wmi QUERY] [--wmi-namespace NAMESPACE]
                        [--spider SHARE] [--spider-folder FOLDER] [--content] [--exclude-dirs DIR_LIST] [--pattern PATTERN [PATTERN ...] | --regex REGEX [REGEX ...]]
                        [--depth DEPTH] [--only-files] [--put-file FILE FILE] [--get-file FILE FILE] [--exec-method {smbexec,atexec,wmiexec,mmcexec}] [--codec CODEC]
                        [--force-ps32] [--no-output] [-x COMMAND | -X PS_COMMAND] [--obfs] [--amsi-bypass FILE] [--clear-obfscripts]
                        [target ...]

positional arguments:
  target                the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)

options:
  -h, --help            show this help message and exit
  -id CRED_ID [CRED_ID ...]
                        database credential ID(s) to use for authentication
  -u USERNAME [USERNAME ...]
                        username(s) or file(s) containing usernames
  -p PASSWORD [PASSWORD ...]
                        password(s) or file(s) containing passwords
  -k, --kerberos        Use Kerberos authentication
  --use-kcache          Use Kerberos authentication from ccache file (KRB5CCNAME)
  --export EXPORT [EXPORT ...]
                        Export result into a file, probably buggy
  --aesKey AESKEY [AESKEY ...]
                        AES key to use for Kerberos Authentication (128 or 256 bits)
  --kdcHost KDCHOST     FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
  --gfail-limit LIMIT   max number of global failed login attempts
  --ufail-limit LIMIT   max number of failed login attempts per username
  --fail-limit LIMIT    max number of failed login attempts per host
  -M, --module MODULE   module to use
  -o MODULE_OPTION [MODULE_OPTION ...]
                        module options
  -L, --list-modules    list available modules
  --options             display module options
  --server {http,https}
                        use the selected server (default: https)
  --server-host HOST    IP to bind the server to (default: 0.0.0.0)
  --server-port PORT    start the server on the specified port
  --connectback-host CHOST
                        IP for the remote system to connect back to (default: same as server-host)
  -H, --hash HASH [HASH ...]
                        NTLM hash(es) or file(s) containing NTLM hashes
  --no-bruteforce       No spray when using file for username and password (user1 => password1, user2 => password2
  -d DOMAIN             domain to authenticate to
  --local-auth          authenticate locally to each target
  --port {139,445}      SMB port (default: 445)
  --share SHARE         specify a share (default: C$)
  --smb-server-port SMB_SERVER_PORT
                        specify a server port for SMB
  --gen-relay-list OUTPUT_FILE
                        outputs all hosts that don't require SMB signing to the specified file
  --continue-on-success
                        continues authentication attempts even after successes
  --smb-timeout SMB_TIMEOUT
                        SMB connection timeout, default 2 secondes
  --laps [LAPS]         LAPS authentification

Credential Gathering:
  Options for gathering credentials

  --sam                 dump SAM hashes from target systems
  --lsa                 dump LSA secrets from target systems
  --ntds [{vss,drsuapi}]
                        dump the NTDS.dit from target DCs using the specifed method (default: drsuapi)

Credential Gathering:
  Options for gathering credentials

  --enabled             Only dump enabled targets from DC
  --user USERNTDS       Dump selected user from DC

Mapping/Enumeration:
  Options for Mapping/Enumerating

  --shares              enumerate shares and access
  --sessions            enumerate active sessions
  --disks               enumerate disks
  --loggedon-users-filter LOGGEDON_USERS_FILTER
                        only search for specific user, works with regex
  --loggedon-users      enumerate logged on users
  --users [USER]        enumerate domain users, if a user is specified than only its information is queried.
  --groups [GROUP]      enumerate domain groups, if a group is specified than its members are enumerated
  --computers [COMPUTER]
                        enumerate computer users
  --local-groups [GROUP]
                        enumerate local groups, if a group is specified then its members are enumerated
  --pass-pol            dump password policy
  --rid-brute [MAX_RID]
                        enumerate users by bruteforcing RID's (default: 4000)
  --wmi QUERY           issues the specified WMI query
  --wmi-namespace NAMESPACE
                        WMI Namespace (default: root\cimv2)

Spidering:
  Options for spidering shares

  --spider SHARE        share to spider
  --spider-folder FOLDER
                        folder to spider (default: root share directory)
  --content             enable file content searching
  --exclude-dirs DIR_LIST
                        directories to exclude from spidering
  --pattern PATTERN [PATTERN ...]
                        pattern(s) to search for in folders, filenames and file content
  --regex REGEX [REGEX ...]
                        regex(s) to search for in folders, filenames and file content
  --depth DEPTH         max spider recursion depth (default: infinity & beyond)
  --only-files          only spider files

Files:
  Options for put and get remote files

  --put-file FILE FILE  Put a local file into remote target, ex: whoami.txt \\Windows\\Temp\\whoami.txt
  --get-file FILE FILE  Get a remote file, ex: \\Windows\\Temp\\whoami.txt whoami.txt

Command Execution:
  Options for executing commands

  --exec-method {smbexec,atexec,wmiexec,mmcexec}
                        method to execute the command. Ignored if in MSSQL mode (default: wmiexec)
  --codec CODEC         Set encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with
                        https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec
  --force-ps32          force the PowerShell command to run in a 32-bit process
  --no-output           do not retrieve command output
  -x COMMAND            execute the specified command
  -X PS_COMMAND         execute the specified PowerShell command

Powershell Obfuscation:
  Options for PowerShell script obfuscation

  --obfs                Obfuscate PowerShell scripts
  --amsi-bypass FILE    File with a custom AMSI bypass
  --clear-obfscripts    Clear all cached obfuscated PowerShell scripts

```

</details>

## Resources

CrackMapExec - GitHub: <https://github.com/byt3bl33d3r/CrackMapExec>

CrackMapExec - Kali Tools: <https://www.kali.org/tools/crackmapexec/>