24 techniquesLinux · Windows · ActiveDirectoryWADComsGPL-3.0
NetExec-Creds-coerce_plus
EnumerationExecutionLinuxWindowsActiveDirectory
"NetExec (a.k.a nxc) is a network pentesting suite that has many modules that can be listed via nxc <protocol> -L. The coerece_plus module will enumarate a target ip, dnsname, list of targets or ip range for different coherence attacks. It will indicate in the output which a target is vulnrable to. Providing you also a means for exploit by adding where your listener/reciving system is(-LISTENER=10.10.10.1) and which exploit you want it to use. The module was recently updated 7 days ago to work on the latest windows build"
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
nxcsmb10.10.10.1-ujohn-ppassword123-Mcoerce_plus
Native
Enumeration, Privilidge Escalation, Exploitation, Laterl movement
"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This command will enumerate domain groups, local groups, users, user descriptions, users trusted for delegation, users without a password, You can also use CIDR notation to target a range of ip addresses (i.e. 10.10.10.0/24).
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This command will enumerate the SMB host using anonymous access.
Command Reference:
Target IP: 10.10.10.1
"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This command will enumerate the SMB host using a null session.
Command Reference:
Target IP: 10.10.10.1
"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. The following command will enumerate a list of SMB hosts with signing not enforced, allowing you to relay credentials to them using ntlmrelayx.py.
Command Reference:
SMB Hosts: smb_hosts.txt
"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This command will enumerate domain groups, local groups, logged on users, relative identifiers (RIDs), sessions, domain users, SMB shares/permissions, and get the domain password policy. You can also use CIDR notation to target a range of ip addresses (i.e. 10.10.10.0/24).
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This command will execute a powershell command on the target machine if the user has Administrator privileges. using "-x" will execute from cmd.
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
NetExec (formerly CrackMapExec) performs an AS-REP Roasting attack via the LDAP service.
This command attempts to enumerate domain accounts that do not require pre-authentication
and requests Kerberos AS-REP responses for them. The extracted encrypted ticket-granting
ticket (TGT) hashes are saved into the specified file and can later be cracked offline
to recover plaintext credentials.
Command Reference:
Target IP: 10.10.10.1
Domain: test.local
Username List: users.txt
Password: (empty string)
Output File: output.txt
NetExec (formerly CrackMapExec) performs a Kerberoasting attack via the LDAP service.
This command authenticates with the given domain account, enumerates Service Principal Name (SPN) accounts,
and extracts their Kerberos ticket hashes, saving them into the specified file.
The obtained hashes can later be cracked offline using brute force or wordlists.
Command Reference:
Target IP: 10.10.10.1
Domain: test.local
Username: john
Password: password123
Output File: output.txt
"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This command will perform password spraying over SMB against the domain controller.
Command Reference:
Domain Controller IP: 10.10.10.1
Username List: users.txt
Password: password123
NetExec (formerly CrackMapExec) performs a Timeroasting attack via the SMB service.
This command targets the remote Windows host and abuses the Kerberos protocol by
manipulating ticket lifetimes or requesting renewable service tickets.
It can help attackers obtain long-lived Kerberos tickets for offline cracking
or later lateral movement.
Command Reference:
Target IP: 10.10.10.1
Module: timeroast
The NetExec (nxc) ldap module -M adcs enumerates Active Directory Certificate Services by querying the Configuration partition over LDAP, listing the Enterprise CAs and the certificate templates published in the domain. It is a quick way to confirm AD CS is present and to gather CA and template names before running Certipy to hunt for vulnerable (ESC) configurations. Requires any valid domain account.
Command Reference:
Username: john
Password: password123
Target DC IP: 10.10.10.1
# Enumerate Enterprise CAs and certificate templates over LDAPnxcldap10.10.10.1-ujohn-ppassword123-Madcs
The NetExec (nxc) ldap module -M maq reads the ms-DS-MachineAccountQuota attribute, revealing how many computer accounts an authenticated user is allowed to create (default 10). A non-zero quota is a prerequisite for attacks that need a controlled computer object, such as Resource-Based Constrained Delegation (RBCD) and Shadow Credentials. The -M whoami module confirms the authenticated context and domain SID. Both need only a valid low-privileged account.
Command Reference:
Username: john
Password: password123
Target DC IP: 10.10.10.1
# Read ms-DS-MachineAccountQuota (how many computer accounts this user may add)nxcldap10.10.10.1-ujohn-ppassword123-Mmaq# Confirm the authenticated identity / domain SIDnxcldap10.10.10.1-ujohn-ppassword123-Mwhoami
NetExec's mssql -x runs an operating-system command through xp_cmdshell (it will enable the option automatically if the login is sysadmin), returning stdout. Use -X instead to execute a PowerShell command block. Command execution runs as the SQL Server service account and requires sysadmin; enabling xp_cmdshell is a high-signal event.
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
# OS command via xp_cmdshellnxcmssql10.10.10.1-ujohn-ppassword123-x"whoami /all"# PowerShell commandnxcmssql10.10.10.1-ujohn-ppassword123-X"$PSVersionTable"
With --local-auth, NetExec authenticates the SQL Server login as a local (mixed-mode) account instead of a domain principal — the classic case being the sa account or a recovered application login. This is useful for password spraying a reused sa password across many hosts, or logging into an instance that is not domain-joined. Combine with -q, -x, or a module once authenticated.
Command Reference:
Target IP: 10.10.10.1
Username: sa
Password: password123
# Local SQL login (e.g. sa) rather than domain authnxcmssql10.10.10.1-usa-ppassword123--local-auth# Spray a local sa password across a subnetnxcmssql10.10.10.0/24-usa-ppassword123--local-auth
The mssql_priv NetExec module enumerates and abuses privilege-escalation paths inside a SQL Server instance — principals the login can impersonate (EXECUTE AS / IMPERSONATE), and db_owner membership on databases owned by a high-privileged principal. Run it with no options to enumerate available paths; run it with ACTION=privesc to walk the chain and grant the current login sysadmin. Add ACTION=rollback to undo the change afterwards.
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
# Enumerate impersonation / db_owner privesc pathsnxcmssql10.10.10.1-ujohn-ppassword123-Mmssql_priv# Escalate the current login to sysadminnxcmssql10.10.10.1-ujohn-ppassword123-Mmssql_priv-oACTION=privesc
NetExec's mssql protocol authenticates to SQL Server and runs an arbitrary T-SQL statement with -q/--query, printing the result set. It is the quickest way to fingerprint an instance (@@version), enumerate databases, or check the effective privileges of the login. Add -windows-auth to authenticate the domain account over NTLM rather than SQL auth.
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
The NetExec/nxc smb 'nopac' module automates the CVE-2021-42278 + CVE-2021-42287 sAMAccountName spoofing chain from a single authenticated SMB connection. It confirms the DC is vulnerable, creates and renames a machine account, and requests an impersonating service ticket, saving the resulting ccache to disk for reuse with impacket tools. Requires MachineAccountQuota > 0 and a DC missing the November 2021 patches; it is a fast way to validate the primitive during an engagement.
Command Reference:
Domain / DC IP: 10.10.10.1
Username: john
Password: password123
The gpp_autologin module parses Registry.xml files pushed through Group Policy Preferences in SYSVOL and extracts autologon credentials (DefaultUserName / DefaultPassword) configured for interactive logon. Unlike cpassword these values are stored in cleartext, so no decryption is needed. Any domain account can read SYSVOL, making this a fast credential-hunting check against the domain controller alongside gpp_password.
Command Reference:
DC IP: 10.10.10.1
Username: john
Password: password123
The gpp_password module searches SYSVOL for Group Policy Preferences XML files (Groups.xml, Services.xml, ScheduledTasks.xml, etc.) that contain a cpassword attribute, then decrypts it using the AES key Microsoft published in MSDN. Any authenticated domain user can read SYSVOL, so this is a classic quick win for recovering local admin or service account passwords set via GPP. Microsoft patched (MS14-025) the ability to create new GPP passwords but did not remove existing ones, so legacy cpassword values still linger in many domains.
Command Reference:
DC IP: 10.10.10.1
Username: john
Password: password123
The keepass_discover module remotely enumerates a target for running KeePass processes and for KeePass.config.xml configuration files, reporting the paths it finds. This is the reconnaissance step before keepass_trigger: you need the config file path to plant a malicious export trigger. Requires local admin on the target so the module can inspect processes and the user's AppData. No database is opened or modified at this stage.
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
The keepass_trigger module abuses KeePass's trigger system: it edits KeePass.config.xml (path found via keepass_discover) to add a malicious export trigger, so the next time the victim unlocks their database KeePass silently exports every entry in cleartext to a location the operator can read. The default ACTION=ALL adds the trigger, waits, retrieves and parses the export, then cleans up. Requires local admin on the host and that the user actually opens their vault; it is noisier and higher-risk than passive hunting, so restore the config afterward.
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
KeePass config path: C:\Users\john\AppData\Roaming\KeePass\KeePass.config.xml
The spider_plus module walks every share the authenticated user can read and writes a per-host JSON inventory of file metadata (path, size, ctime/mtime/atime) to the output folder, giving you a fast triage map of what exists before you pull anything down. By default it only catalogs; setting DOWNLOAD_FLAG=True makes it copy files under MAX_FILE_SIZE to the loot folder. Prefer the metadata-only run first to stay quiet and avoid mass file reads. Good starting point for share enumeration at scale with a single low-priv credential.
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123
# JSON share/file inventory only (metadata, no downloads)nxcsmb10.10.10.1-ujohn-ppassword123-Mspider_plus# Download every readable file under the size limitnxcsmb10.10.10.1-ujohn-ppassword123-Mspider_plus-oDOWNLOAD_FLAG=True
The veeam module locates a Veeam Backup & Replication configuration database on the target, reads the stored credential records and decrypts them, recovering the accounts Veeam uses for backups (often domain or local admin). Because backup servers are commonly configured with highly privileged service accounts, this is a frequent path to escalation. Requires local admin on the Veeam server so the module can reach the backing SQL database and DPAPI material.
Command Reference:
Target IP: 10.10.10.1
Username: john
Password: password123