arsenal/netexec

netexec

network exec swiss-army · BSD-2-Clause

The maintained successor to crackmapexec: sprays and executes across SMB, WinRM, and LDAP to find and use valid credentials at scale.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Credentials against a whole network at once

netexec (nxc, the maintained continuation of crackmapexec) takes a credential and a range of hosts and tells you, fast, everywhere it works and what it can do there. Point it at a subnet with a username and password and it reports which machines accept them, which grant admin, and then, on request, dumps hashes, runs commands, or enumerates shares across all of them. Where impacket acts on one host at a time, netexec operates at network scale, which is exactly how an attacker turns one credential into many machines.

↑ contents

02Install

$ pipx install netexec # any distro (PyPI, recommended)

$ sudo apt install netexec # Debian / Kali (if packaged)

03Checking a credential across hosts

The core move: a protocol, a target range, a username, a password. netexec marks each host with whether the credential worked and, crucially, whether it grants admin (the Pwn3d! marker). This single command maps where a credential is powerful.

$ nxc smb 10.0.0.0/24 -u alice -p 'Summer2026!'

04Password spraying

Spraying inverts brute force: one likely password against many users, which avoids lockouts because each account sees only one attempt. netexec does this across the domain in a line. --continue-on-success keeps going to find every hit. Spraying one seasonal password across a company is depressingly effective, which is the lesson.

$ nxc smb 10.0.0.10 -u users.txt -p 'Summer2026!' --continue-on-success

$ nxc smb 10.0.0.10 -u users.txt -H ntlm-hashes.txt # spray hashes (pass-the-hash)

» Spraying is quieter than brute force by design. Detecting it needs correlation across accounts, not just per-account failure counts.

05Enumerating with a working credential

Once a credential works, netexec enumerates what it can reach: shares, logged-on users, password policy, domain users and groups via LDAP. This is the reconnaissance that turns access into a plan, all from one tool.

$ nxc smb 10.0.0.20 -u alice -p 'Summer2026!' --shares

$ nxc smb 10.0.0.20 -u alice -p 'Summer2026!' --users --loggedon-users

$ nxc ldap 10.0.0.10 -u alice -p 'Summer2026!' --password-policy

↑ contents

06Execution and credential dumping at scale

Where the credential grants admin (Pwn3d!), netexec runs commands and dumps secrets, across every such host at once with modules. This is the step that must stay in your own lab; dumping SAM or LSASS from a fleet is maximal impact and maximal risk.

$ nxc smb 10.0.0.0/24 -u alice -p 'Summer2026!' -x 'whoami'

$ nxc smb 10.0.0.0/24 -u alice -p 'Summer2026!' --sam

$ nxc smb 10.0.0.0/24 -u alice -p 'Summer2026!' -M lsassy

07Reading netexec output as a blue teamer

Run netexec against your own range and the output is a map of credential sprawl, the thing that lets a single compromise become a domain-wide one. Every extra Pwn3d! is a host where that one credential is admin, and that is the risk to drive down.

» Minimise where any one account is local admin; LAPS for unique local passwords and tiered admin stop one credential from owning the fleet.

» Spraying is the top detection to build: alert on one source attempting many accounts, even with low per-account failures.

» Enforce a password policy and ban seasonal and breached passwords so a spray finds nothing.

» Restrict SMB and WinRM reachability between workstations; they rarely need to talk to each other, and blocking it stops lateral movement.

» Re-run after changes to confirm the Pwn3d! count dropped.

↑ contents