> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/smb-discovery/netexec.md).

# NetExec

NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks.

## Available Protocols

Available protocols in NetExec are:

* `ftp`
* `ldap`
* `mssql`
* `nfs`
* `rdp`
* `smb`
* `ssh`
* `vnc`
* `winrm`
* `wmi`
  \\

Note that not all protocols support the same functionality, be sure to check each protocol's options

## Create hosts file

To create hosts file data to put in `/etc/hosts`

```bash
nxc smb ips.txt -u <user> -p '<password>' -d <domain> --generate-hosts-file path/output.txt
```

## Enumeration

### Enumerating Domain Users

To enumerate all domain users (unauthenticated)

```bash
nxc smb $TARGET_IP -u '' -p '' --users 
```

To enumerate all domain users (authenticated)

```bash
nxc smb $TARGET_IP -u <user> -p '<password>' --users 
```

To create a file called `users.txt` with the result we can

```bash
nxc smb $TARGET_IP -u '<user>' -p '<password>' --users | grep -vE '[+]|[*]|-User' | awk '{print $5}' > users.txt
```

### Enumerating Logged-on Users

To enumerate logged-on users

```bash
nxc smb $TARGET_IP -u <user> -p '<password>' --loggedon-users
```

### Enumerating Password Policy

To enumerate the machine's password policy

```bash
nxc smb $TARGET_IP -u <user> -p '<password>' --pass-pol
```

### Enumerating Shares

Enumerating shares of a specific machine with known credentials

```bash
nxc smb $TARGET_IP -u svc-printer -p '1edFg43012!!' --shares
```

Same but in verbose mode

```bash
nxc --verbose smb $TARGET_IP -u svc-printer -p '1edFg43012!!' --shares
```

Enumerating shares with `Guest` user

```bash
nxc smb $TARGET_IP -u Guest -p '' --shares
```

Enumerating shares as Anonymous (Null-session)

```bash
nxc smb $TARGET_IP -u '' -p '' --shares
```

### Spidering Shares

#### `--spider` parameter

Spider the `C$` share for files and folders with `txt` in the file name

```bash
nxc smb $TARGET_IP -u 'user' -p 'pass' --spider 'C$' --pattern txt
```

Spider the `C$` share for files and folders with `password` in the file name or content

```bash
nxc smb $TARGET_IP -u 'user' -p 'pass' --spider 'C$' --pattern password --content
```

All options:

```bash
Spidering Shares:
  --spider SHARE        share to spider
  --spider-folder FOLDER
                        folder to spider (default: .)
  --content             enable file content searching
  --exclude-dirs DIR_LIST
                        directories to exclude from spidering
  --depth DEPTH         max spider recursion depth
  --only-files          only spider files
  --silent              Do not print found files/directories
  --pattern PATTERN [PATTERN ...]
                        pattern(s) to search for in folders, filenames and file content
  --regex REGEX [REGEX ...]
                        regex(s) to search for in folders, filenames and file content
```

#### `spider_plus` module

List all readable files from all readable shares (no downloading)

```bash
nxc smb $TARGET_IP -u 'user' -p 'pass' -M spider_plus
```

Download all files from all readable shares on the target host

```bash
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M spider_plus -o DOWNLOAD_FLAG=True
```

All options:

```bash
┌──(kali㉿kali)-[~]
└─$ nxc smb -M spider_plus --options
[*] spider_plus module options:

List files recursively (excluding `EXCLUDE_FILTER` and `EXCLUDE_EXTS` extensions) and save JSON share-file metadata to the `OUTPUT_FOLDER`.
If `DOWNLOAD_FLAG`=True, download files smaller then `MAX_FILE_SIZE` to the `OUTPUT_FOLDER`.

DOWNLOAD_FLAG     Download all share folders/files (Default: False)
STATS_FLAG        Disable file/download statistics (Default: True)
EXCLUDE_EXTS      Case-insensitive extension filter to exclude (Default: ico,lnk)
EXCLUDE_FILTER    Case-insensitive filter to exclude folders/files (Default: print$,ipc$)
MAX_FILE_SIZE     Max file size to download (Default: 51200)
OUTPUT_FOLDER     Path of the local folder to save files (Default: NXC_PATH/nxc_spider_plus)

```

## Scan for Vulnerabilities <a href="#scan-for-vulnerabilities" id="scan-for-vulnerabilities"></a>

When you start your internal pentest, these are the first modules you should try:

### Unauthenticated

#### All the ones below

```bash
nxc smb <ip> -u '' -p '' -M zerologon -M printnightmare -M smbghost -M ms17-010
```

**ZeroLogon**

```bash
nxc smb <ip> -u '' -p '' -M zerologon
```

**PrintNightmare**

```bash
nxc smb <ip> -u '' -p '' -M printnightmare
```

**SMBGhost**

```bash
nxc smb <ip> -u '' -p '' -M smbghost
```

**MS17-010 (Not tested outside LAB environment)**

```bash
nxc smb <ip> -u '' -p '' -M ms17-010
```

Or, try them all at once! Just list each one: `-M zerologon -M printnightmare`

### **Authenticated**

**noPAC**

```bash
nxc smb <ip> -u 'user' -p 'pass' -M nopac
```

You need a credential for noPAC vulnerability check.

**NTLM reflection (CVE-2025-33073)**

```bash
nxc smb <ip> -u 'user' -p 'pass' -M ntlm_reflection
```

You need credentials for CVE-2025-33073 vulnerability check.

## Usage information

<details>

<summary>nxc -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ nxc -h
usage: nxc [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp]
           [--dns-timeout DNS_TIMEOUT]
           {smb,ftp,rdp,ssh,wmi,winrm,mssql,vnc,nfs,ldap} ...

     .   .
    .|   |.     _   _          _     _____
    ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
    \\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
    .=[ ]=.    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__
   / /˙-˙\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
   ˙ \   / ˙
     ˙   ˙

    The network execution tool
    Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx

    For documentation and usage examples, visit: https://www.netexec.wiki/

    Version : 1.5.1
    Codename: Yippie-Ki-Yay
    Commit  : Kali Linux
    

options:
  -h, --help            show this help message and exit

Generic Options:
  --version             Display nxc version
  -t, --threads THREADS
                        set how many concurrent threads to use
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output Options:
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file
  --verbose             enable verbose output
  --debug               enable debug level information

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds

Available Protocols:
  {smb,ftp,rdp,ssh,wmi,winrm,mssql,vnc,nfs,ldap}
    smb                 own stuff using SMB
    ftp                 own stuff using FTP
    rdp                 own stuff using RDP
    ssh                 own stuff using SSH
    wmi                 own stuff using WMI
    winrm               own stuff using WINRM
    mssql               own stuff using MSSQL
    vnc                 own stuff using VNC
    nfs                 own stuff using NFS
    ldap                own stuff using LDAP

```

</details>

<details>

<summary>nxc smb -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ nxc smb -h
usage: nxc smb [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp]
               [--dns-timeout DNS_TIMEOUT] [-u USERNAME [USERNAME ...]] [-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce]
               [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT] [--fail-limit LIMIT] [-k] [--use-kcache] [--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST]
               [--pfx-cert PFXCERT] [--pfx-base64 PFXB64] [--pfx-pass PFXPASS] [--pem-cert PEMCERT] [--pem-key PEMKEY] [-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L [LIST_MODULES]]
               [--options] [-H HASH [HASH ...]] [--delegate DELEGATE] [--delegate-spn DELEGATE_SPN] [--generate-st GENERATE_ST] [--self] [-d DOMAIN | --local-auth] [--port PORT]
               [--share SHARE] [--smb-server-port SMB_SERVER_PORT] [--no-smbv1] [--no-admin-check] [--gen-relay-list OUTPUT_FILE] [--smb-timeout SMB_TIMEOUT] [--laps [LAPS]]
               [--generate-hosts-file GENERATE_HOSTS_FILE] [--generate-krb5-file GENERATE_KRB5_FILE] [--generate-tgt GENERATE_TGT] [--sam [{secdump,regdump}]] [--lsa [{secdump,regdump}]]
               [--ntds [{vss,drsuapi}]] [--kerberos-keys] [--history | --enabled] [--user USERNTDS] [--dpapi [{nosystem,cookies} ...]] [--sccm [{disk,wmi}]] [--mkfile MKFILE] [--pvk PVK]
               [--list-snapshots [LIST_SNAPSHOTS]] [--shares [SHARES]] [--exclude-shares EXCLUDE_SHARES [EXCLUDE_SHARES ...]] [--dir [DIR]] [--interfaces] [--no-write-check]
               [--filter-shares FILTER_SHARES [FILTER_SHARES ...]] [--disks] [--users [USER ...]] [--users-export USERS_EXPORT] [--groups [GROUP]] [--local-groups [GROUP]]
               [--computers [COMPUTER]] [--pass-pol] [--rid-brute [MAX_RID]] [--smb-sessions] [--reg-sessions [REG_SESSIONS]] [--loggedon-users [LOGGEDON_USERS]]
               [--loggedon-users-filter LOGGEDON_USERS_FILTER] [--qwinsta [QWINSTA]] [--tasklist [TASKLIST]] [--taskkill TASKKILL] [--wmi-query QUERY] [--wmi-namespace NAMESPACE]
               [--spider SHARE] [--spider-folder FOLDER] [--content] [--exclude-dirs DIR_LIST] [--depth DEPTH] [--only-files] [--silent] [--pattern PATTERN [PATTERN ...] |
               --regex REGEX [REGEX ...]] [--put-file FILE FILE] [--get-file FILE FILE] [--append-host] [--exec-method {wmiexec,atexec,smbexec,mmcexec}] [--dcom-timeout DCOM_TIMEOUT]
               [--get-output-tries GET_OUTPUT_TRIES] [--codec CODEC] [--no-output] [-x COMMAND | -X PS_COMMAND] [--obfs] [--amsi-bypass FILE] [--clear-obfscripts] [--force-ps32] [--no-encode]
               target [target ...]

positional arguments:
  target                the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)

options:
  -h, --help            show this help message and exit
  -H, --hash HASH [HASH ...]
                        NTLM hash(es) or file(s) containing NTLM hashes
  --delegate DELEGATE   Impersonate user with S4U2Self + S4U2Proxy
  --delegate-spn DELEGATE_SPN
                        SPN to use for S4U2Proxy, if not specified the SPN used will be cifs/<target>
  --generate-st GENERATE_ST
                        Store the S4U Service Ticket in the specified file
  --self                Only do S4U2Self, no S4U2Proxy (use with delegate)
  -d, --domain DOMAIN   domain to authenticate to
  --local-auth          authenticate locally to each target
  --port PORT           SMB port (default: 445)
  --share SHARE         specify a share (default: C$)
  --smb-server-port SMB_SERVER_PORT
                        specify a server port for SMB (default: 445)
  --no-smbv1            Force to disable SMBv1 in connection
  --no-admin-check      Avoid checking admin which queries the Service Control Manager
  --gen-relay-list OUTPUT_FILE
                        outputs all hosts that don't require SMB signing to the specified file
  --smb-timeout SMB_TIMEOUT
                        SMB connection timeout (default: 2)
  --laps [LAPS]         LAPS authentification
  --generate-hosts-file GENERATE_HOSTS_FILE
                        Generate a hosts file like from a range of IP
  --generate-krb5-file GENERATE_KRB5_FILE
                        Generate a krb5 file like from a range of IP
  --generate-tgt GENERATE_TGT
                        Generate a tgt ticket

Generic Options:
  --version             Display nxc version
  -t, --threads THREADS
                        set how many concurrent threads to use (default: 256)
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output Options:
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file
  --verbose             enable verbose output
  --debug               enable debug level information

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds (default: 3)

Authentication:
  -u, --username USERNAME [USERNAME ...]
                        username(s) or file(s) containing usernames
  -p, --password PASSWORD [PASSWORD ...]
                        password(s) or file(s) containing passwords
  -id CRED_ID [CRED_ID ...]
                        database credential ID(s) to use for authentication
  --ignore-pw-decoding  Ignore non UTF-8 characters when decoding the password file
  --no-bruteforce       No spray when using file for username and password (user1 => password1, user2 => password2)
  --continue-on-success
                        continues authentication attempts even after successes
  --gfail-limit LIMIT   max number of global failed login attempts
  --ufail-limit LIMIT   max number of failed login attempts per username
  --fail-limit LIMIT    max number of failed login attempts per host

Kerberos Authentication:
  -k, --kerberos        Use Kerberos authentication
  --use-kcache          Use Kerberos authentication from ccache file (KRB5CCNAME)
  --aesKey AESKEY [AESKEY ...]
                        AES key to use for Kerberos Authentication (128 or 256 bits)
  --kdcHost KDCHOST     FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter

Certificate Authentication:
  --pfx-cert PFXCERT    Use certificate authentication from pfx file .pfx
  --pfx-base64 PFXB64   Use certificate authentication from pfx file encoded in base64
  --pfx-pass PFXPASS    Password of the pfx certificate
  --pem-cert PEMCERT    Use certificate authentication from PEM file
  --pem-key PEMKEY      Private key for the PEM format

Modules:
  -M, --module MODULE   module to use
  -o MODULE_OPTION [MODULE_OPTION ...]
                        module options
  -L, --list-modules [LIST_MODULES]
                        list available modules
  --options             display module options

Credential Gathering:
  --sam [{secdump,regdump}]
                        dump SAM hashes from target systems
  --lsa [{secdump,regdump}]
                        dump LSA secrets from target systems
  --ntds [{vss,drsuapi}]
                        dump the NTDS.dit from target DCs using the specifed method
  --kerberos-keys       Also dump Kerberos AES and DES keys from target DC (NTDS.dit)
  --history             Also retrieve password history from target DC (NTDS.dit)
  --enabled             Only dump enabled targets from DC (NTDS.dit)
  --user USERNTDS       Dump selected user from DC (NTDS.dit)
  --dpapi [{nosystem,cookies} ...]
                        dump DPAPI secrets from target systems, can dump cookies if you add 'cookies', will not dump SYSTEM dpapi if you add nosystem
  --sccm [{disk,wmi}]   dump SCCM secrets from target systems
  --mkfile MKFILE       DPAPI option. File with masterkeys in form of {GUID}:SHA1
  --pvk PVK             DPAPI option. File with domain backupkey
  --list-snapshots [LIST_SNAPSHOTS]
                        Lists the VSS snapshots (default: ADMIN$)

Mapping/Enumeration:
  --shares [SHARES]     Enumerate shares and access, filter on specified argument (read ; write ; read,write)
  --exclude-shares EXCLUDE_SHARES [EXCLUDE_SHARES ...]
                        List of shares to exclude from enumeration (e.g., C$ Admin$ IPC$)
  --dir [DIR]           List the content of a path (default path: '')
  --interfaces          Enumerate network interfaces
  --no-write-check      Skip write check on shares (avoid leaving traces when missing delete permissions)
  --filter-shares FILTER_SHARES [FILTER_SHARES ...]
                        Filter share by access, option 'READ' 'WRITE' or 'READ,WRITE'
  --disks               Enumerate disks
  --users [USER ...]    Enumerate domain users, if a user is specified than only its information is queried.
  --users-export USERS_EXPORT
                        Enumerate domain users and export them to the specified file
  --groups [GROUP]      Enumerate domain groups, if a group is specified than its members are Enumerated
  --local-groups [GROUP]
                        Enumerate local groups, if a group is specified then its members are Enumerated
  --computers [COMPUTER]
                        Enumerate computer users
  --pass-pol            dump password policy
  --rid-brute [MAX_RID]
                        Enumerate users by bruteforcing RIDs
  --smb-sessions        Enumerate active smb sessions
  --reg-sessions [REG_SESSIONS]
                        Enumerate users sessions using the Remote Registry. If a username is given, filter for it. If a file is given, filter for listed usernames. If no value is given, list
                        all.
  --loggedon-users [LOGGEDON_USERS]
                        Enumerate logged on users, if a user is specified than a regex filter is applied.
  --loggedon-users-filter LOGGEDON_USERS_FILTER
                        only search for specific user, works with regex
  --qwinsta [QWINSTA]   Enumerate user sessions. If a username is given, filter for it; if a file is given, filter for listed usernames. If no value is given, list all.
  --tasklist [TASKLIST]
                        Enumerate running processes and filter for the specified one if specified
  --taskkill TASKKILL   Kills a specific PID or a proces name's PID's

WMI Queries:
  --wmi-query QUERY     Issues the specified WMI query
  --wmi-namespace NAMESPACE
                        WMI Namespace (default: root\cimv2)

Spidering Shares:
  --spider SHARE        share to spider
  --spider-folder FOLDER
                        folder to spider (default: .)
  --content             enable file content searching
  --exclude-dirs DIR_LIST
                        directories to exclude from spidering
  --depth DEPTH         max spider recursion depth
  --only-files          only spider files
  --silent              Do not print found files/directories
  --pattern PATTERN [PATTERN ...]
                        pattern(s) to search for in folders, filenames and file content
  --regex REGEX [REGEX ...]
                        regex(s) to search for in folders, filenames and file content

File Operations:
  --put-file FILE FILE  Put a local file into remote target, ex: whoami.txt \\Windows\\Temp\\whoami.txt
  --get-file FILE FILE  Get a remote file, ex: \\Windows\\Temp\\whoami.txt whoami.txt
  --append-host         append the host to the get-file filename

Command Execution:
  --exec-method {wmiexec,atexec,smbexec,mmcexec}
                        method to execute the command. Ignored if in MSSQL mode (default: wmiexec)
  --dcom-timeout DCOM_TIMEOUT
                        DCOM connection timeout (default: 5)
  --get-output-tries GET_OUTPUT_TRIES
                        Number of times atexec/smbexec/mmcexec tries to get results (default: 10)
  --codec CODEC         Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with
                        https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec (default: utf-8)
  --no-output           do not retrieve command output
  -x COMMAND            execute the specified CMD command
  -X PS_COMMAND         execute the specified PowerShell command

Powershell Script Obfuscation:
  --obfs                Obfuscate PowerShell scripts
  --amsi-bypass FILE    File with a custom AMSI bypass
  --clear-obfscripts    Clear all cached obfuscated PowerShell scripts
  --force-ps32          force PowerShell commands to run in a 32-bit process (may not apply to modules)
  --no-encode           Do not encode the PowerShell command ran on target
                                                                               
```

</details>

## Resources

NetExec - GitHub: <https://github.com/Pennyw0rth/NetExec>

NetExec - Kali Tools: <https://www.kali.org/tools/netexec/>

NetExec - Wiki: <https://www.netexec.wiki>