NetExec

NetExec (run with the nxc command) sweeps a host or a whole subnet across protocols like SMB, LDAP, WinRM, MSSQL, SSH, and more, then tells you what is reachable, which credentials work, and what each service exposes. It is the tool most people reach for once they have credentials or a hash and want to know, quickly and consistently, where those secrets actually open a door.

You will see NetExec everywhere in Windows and Active Directory work: the credential-spray step in a CTF box, the access map of a homelab domain, and the post-enumeration phase of an authorized internal assessment. It is powerful because it talks many protocols the same way, and easy to misuse for exactly the same reason.

What you will learn#

How to install, update, and verify NetExec
When to use it, and when a quieter or more focused tool fits better
How to enumerate one protocol at a time instead of one giant noisy sweep
How to validate credentials without tripping account lockout
How to read the [+], [-], and Pwn3d! markers without fooling yourself
Realistic examples for SMB, LDAP, WinRM, MSSQL, hashes, and modules
The mistakes that lock out accounts and burn engagements, and how to avoid them
A commented cheat sheet you can paste into your notes

Legal and scope reminder#

Only test systems you own or are explicitly authorized to test. CTF platforms, your own homelab domain, and dedicated practice VMs are all fair game. Anything else needs written permission and an agreed scope. NetExec authenticates against real services, so a careless spray can lock out real accounts; confirm the lockout policy before you send a single credential. Keep a short note of the target, the authorization, the accounts in scope, and the date next to your output. This section is the boring part that keeps the fun part legal.

Prerequisites#

A Linux host is easiest (Kali, Parrot, or any Ubuntu/Debian box). NetExec runs fine in WSL too.
Network reachability to the target services (445/SMB, 389 and 636/LDAP, 5985 and 5986/WinRM, 1433/MSSQL, 22/SSH).
Basic comfort with the terminal, IP addresses, and CIDR ranges like 10.10.10.0/24.
A working understanding of Active Directory basics: domains, users, shares, and the difference between local and domain authentication.
Credentials, a hash, or a Kerberos ticket that you are authorized to use. The examples below use placeholders (USERNAME, PASSWORD) and private IPs only.

Lab setup#

Keep every engagement in its own folder so output, notes, and loot never mix.

# One folder per box or per domain, with room for output and notes
mkdir -p ~/labs/nxc-demo/{loot,notes,wordlists}
cd ~/labs/nxc-demo

Use private ranges for practice targets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Throughout this guide, TARGET_IP means one host you are authorized to test, TARGET_RANGE means a subnet like 192.168.56.0/24, DC_IP means a domain controller, and DOMAIN means a lab domain like lab.local.

NetExec also keeps its own workspace database under ~/.nxc/. That is where it caches credentials, hosts, and loot between runs, which is handy but also means you should keep client and lab data in separate workspaces.

Installation#

Pick the method that matches your environment.

# Debian / Ubuntu / Kali (preferred on most systems)
sudo apt update && sudo apt install -y netexec

# pipx (preferred when you want the latest stable release, isolated)
sudo apt install -y pipx
pipx install netexec
pipx ensurepath

# From source with pipx (bleeding edge from the main branch)
pipx install git+https://github.com/Pennw0rth/NetExec.git

Use the distro package when you just want a working nxc quickly. Use pipx when you want the newest release without polluting your system Python, which matters because protocol modules change between versions. Install from source only when you need a fix or module that has not shipped in a release yet.

Update process#

# Distro package
sudo apt update && sudo apt install --only-upgrade -y netexec

# pipx (stable release)
pipx upgrade netexec

# pipx (reinstall from the main branch for the latest code)
pipx install --force git+https://github.com/Pennw0rth/NetExec.git

Modules, protocol support, and detection signatures change often, so an up-to-date NetExec enumerates more accurately and breaks less against newer Windows builds.

Check if installed and available#

command -v nxc      # prints the path if NetExec is on your PATH
nxc --version       # confirm the version
nxc --help          # list protocols and global options
nxc smb --help      # protocol-specific options (repeat per protocol)

If command -v prints nothing, the package did not install or your shell PATH is stale. After a pipx install, run pipx ensurepath and open a new terminal. The older name crackmapexec/cme may still exist on some boxes, but nxc is the current command.

First safe test#

Point NetExec at one host you are authorized to test, with no credentials. This proves the tool works and only fingerprints the SMB service.

nxc smb TARGET_IP

Expected: a single line showing the host, the OS, the hostname, the domain, and whether SMB signing is required, for example:

SMB  192.168.56.20  445  DC01  [*] Windows Server 2022 (name:DC01) (domain:lab.local) (signing:True) (SMBv1:False)

Success looks like that [*] info line. Failure looks like command not found (install problem), Connection refused/timeout (SMB not reachable or wrong IP), or a clean line with no extra detail (host up, but giving little away).

Core concepts#

Protocols are the first argument and decide everything else: smb, ldap, winrm, mssql, ssh, ftp, rdp, wmi, vnc, and more.
Targets can be one IP, a CIDR range, a hostname, or a file of targets.
Authentication is the heart of the tool: -u/-p for password, -u/-H for an NTLM hash (pass-the-hash), and --local-auth for local accounts instead of domain accounts.
Result markers drive your reading: [*] is info, [+] is a successful auth, [-] is a failed auth, and (Pwn3d!) means the account can execute code (usually local admin).
Modules (-M name) extend a protocol, for example dumping SAM, listing logged-on users, or checking for specific misconfigurations.
Spidering and shares (--shares, --spider) read what an account can see on SMB without changing anything.
The workspace database under ~/.nxc/ stores hosts, credentials, and loot so later commands can reuse them.
Lockout risk is the concept beginners miss: every failed login counts, so validate small and confirm policy first.

When this tool is useful#

CTFs and labs: turn a single found credential or hash into a map of where it works across the network.
Homelab inventory: see which hosts in your own domain expose shares, accept WinRM, or have SMB signing disabled.
Authorized assessments: validate credential reuse and access scope after initial access, without manual per-host testing.
Defensive validation: confirm a hardening change actually disabled SMBv1, enforced signing, or closed WinRM.
Triage: quickly answer “does this account work here, and is it admin?”.

When not to use this tool#

For initial recon before you have a target list; run port discovery first.
For blind password brute force; that is loud, locks accounts, and is rarely in scope. Validate known credentials instead.
When stealth matters and you have not throttled; authentication attempts land in security logs immediately.
On fragile or production-adjacent hosts where modules that touch the registry or services could disrupt something.
When one protocol against one host is all you need; a focused tool like smbclient or evil-winrm is cleaner for hands-on work.

Command anatomy#

nxc [protocol] [target] [auth] [action] [options]
#    smb        IP/file   -u -p   --shares  -M, --threads

protocol: which service to talk to (smb, ldap, winrm, …). Always first.
target: one IP, a CIDR range, a hostname, or a file of targets.
auth: how you log in (-u USERNAME -p PASSWORD, -H HASH, --local-auth, Kerberos with -k).
action: what to enumerate or do (--shares, --users, --sam, -x, -M module).
options: tuning like --threads, --timeout, output, and continue-on- success behavior.

Common flags and options#

Option	Meaning	When to use it	Example
`-u`	Username (or user file)	Any authenticated check	`nxc smb TARGET_IP -u USERNAME -p PASSWORD`
`-p`	Password (or password file)	Password auth	`nxc smb TARGET_IP -u USERNAME -p PASSWORD`
`-H`	NTLM hash (pass-the-hash)	When you have a hash, not a password	`nxc smb TARGET_IP -u USERNAME -H HASH`
`--local-auth`	Authenticate as a local account	Standalone hosts or local admin checks	`nxc smb TARGET_IP -u USERNAME -p PASSWORD --local-auth`
`-d`	Domain to authenticate against	Domain accounts	`nxc smb TARGET_IP -u USERNAME -p PASSWORD -d DOMAIN`
`--shares`	List shares and access	After SMB auth succeeds	`nxc smb TARGET_IP -u USERNAME -p PASSWORD --shares`
`--users`	Enumerate users	Authorized LDAP/SMB enumeration	`nxc ldap DC_IP -u USERNAME -p PASSWORD --users`
`-M`	Run a module	Extra checks beyond defaults	`nxc smb TARGET_IP -u USERNAME -p PASSWORD -M spider_plus`
`--threads`	Concurrency across hosts	Tune speed vs noise	`nxc smb TARGET_RANGE -u USERNAME -p PASSWORD --threads 25`
`--continue-on-success`	Keep going after a valid login	Spray validation across a list	`nxc smb TARGET_RANGE -u users.txt -p PASSWORD --continue-on-success`
`-k`	Use Kerberos auth	Ticket-based access	`nxc smb DC_IP -k --use-kcache`

Practical examples#

Each command below explains what it does and what to expect. All targets are placeholders or private IPs you are authorized to test.

# Fingerprint SMB on one host (no credentials, low noise)
nxc smb TARGET_IP
# Output: one [*] info line with OS, hostname, domain, and signing status.

# Fingerprint SMB across a subnet to find live, in-scope hosts
nxc smb TARGET_RANGE
# Output: one line per responsive host. Use it to build a target list.

# Validate a single credential and check admin (watch for "Pwn3d!")
nxc smb TARGET_IP -u USERNAME -p PASSWORD
# Output: [+] DOMAIN\USERNAME:PASSWORD and (Pwn3d!) if the account is local admin.

# List shares and the account's access to each
nxc smb TARGET_IP -u USERNAME -p PASSWORD --shares
# Output: share names with READ/WRITE flags. Read-only and safe to run.

# Local-account auth (standalone host or local admin), no domain assumptions
nxc smb TARGET_IP -u USERNAME -p PASSWORD --local-auth
# Output: [+] HOSTNAME\USERNAME and access markers for that local account.

# Pass-the-hash instead of a password when you only have the NTLM hash
nxc smb TARGET_IP -u USERNAME -H HASH --local-auth
# Output: same as a password login; useful after dumping a local hash.

# Enumerate domain users over LDAP (authorized, credentialed)
nxc ldap DC_IP -u USERNAME -p PASSWORD --users
# Output: account names, descriptions, and last-logon hints from the directory.

# Check WinRM access with known credentials
nxc winrm TARGET_IP -u USERNAME -p PASSWORD
# Output: [+] on success and (Pwn3d!) if a remote shell is available.

# Validate credentials across a host list, keep going after the first hit
nxc smb TARGET_RANGE -u USERNAME -p PASSWORD --continue-on-success
# Output: one line per host so you can see exactly where the account works.

# Run a module: spider readable shares for interesting files (read-only)
nxc smb TARGET_IP -u USERNAME -p PASSWORD -M spider_plus
# Output: a per-share file listing saved under the nxc workspace for review.

# MSSQL: validate a SQL login and check for sysadmin
nxc mssql TARGET_IP -u USERNAME -p PASSWORD --local-auth
# Output: [+] on success; flags whether the login is a sysadmin.

# Save loot to a clean folder and tee a copy to your notes
nxc smb TARGET_IP -u USERNAME -p PASSWORD --shares 2>&1 \
  | tee notes/smb-shares.txt
# Output: the same result on screen and in a file you can paste into a report.

Example workflow#

A realistic beginning-to-end pass against one authorized domain.

# 1. Prepare and confirm scope
mkdir -p ~/labs/lab01/{loot,notes} && cd ~/labs/lab01
echo "scope: TARGET_RANGE + DOMAIN, authorized $(date -I)" > notes/scope.txt
echo "lockout policy CONFIRMED before any spray" >> notes/scope.txt

# 2. Map in-scope SMB hosts (no credentials yet)
nxc smb TARGET_RANGE 2>&1 | tee notes/smb-hosts.txt

# 3. Validate the one credential you have, on one host first
nxc smb TARGET_IP -u USERNAME -p PASSWORD 2>&1 | tee notes/cred-check.txt

# 4. If valid, list shares the account can read (read-only enumeration)
nxc smb TARGET_IP -u USERNAME -p PASSWORD --shares 2>&1 | tee notes/shares.txt

# 5. See where that same credential works across the subnet
nxc smb TARGET_RANGE -u USERNAME -p PASSWORD --continue-on-success \
  2>&1 | tee notes/cred-spread.txt

# 6. Enumerate the directory over LDAP for context
nxc ldap DC_IP -u USERNAME -p PASSWORD --users 2>&1 | tee notes/ad-users.txt

From here, the findings decide the next tool: a writable share or a (Pwn3d!) WinRM host leads to hands-on access with evil-winrm, and a rich LDAP dump leads to BloodHound for attack-path analysis.

Reading and interpreting output#

[*] info: service fingerprint (OS, hostname, domain, signing). No auth was attempted; this is just context.
[+] success: the credential or hash authenticated. Record host, protocol, and account.
[-] failure: the login failed. Remember every one of these counts toward lockout.
(Pwn3d!): the account can execute code on that host, usually local admin. This is your highest-value finding, so verify it before acting on it.
Share lines (READ/WRITE): what the account can actually see. WRITE on a share is often more interesting than the count of shares.
STATUS_LOGON_FAILURE: wrong username or password, or wrong --local-auth choice.
STATUS_ACCOUNT_LOCKED_OUT: stop immediately; you have hit lockout. Do not keep spraying.
Empty or quiet output: the host may be filtered, the protocol may not be listening, or the target IP is wrong.

Common mistakes#

Spraying passwords without checking the account lockout policy first, then locking out real users.
Forgetting --local-auth when testing a local account, so it tries the domain and fails for the wrong reason.
Running modules before basic enumeration is done, which adds noise and confuses the picture.
Treating a (Pwn3d!) line as permission to run arbitrary commands instead of confirming it stays within scope.
Pointing a domain spray at the domain controller and amplifying lockout risk across the whole domain.
Cranking --threads high on a fragile network and getting unreliable, partial results.
Mixing up password and hash flags (-p versus -H), or pasting a hash with the wrong format.
Assuming old crackmapexec flags and module names still work unchanged in nxc.

Troubleshooting#

Problem	Likely cause	Fix
`command not found`	Not installed / PATH	Reinstall; run `pipx ensurepath` and open a fresh shell
`STATUS_LOGON_FAILURE`	Wrong creds or wrong auth scope	Recheck credential; add or remove `--local-auth`
`STATUS_ACCOUNT_LOCKED_OUT`	Too many failed attempts	Stop, wait for lockout window, confirm policy
`Connection refused` / timeout	Service not listening or wrong IP	Verify the port with a port scan; recheck the target
`STATUS_ACCESS_DENIED` on `--shares`	Account lacks share access	Expected; note it and move on, the auth still proved valid
Module not found	Wrong name or old version	Run `nxc smb -L` to list modules; update NetExec
Kerberos errors	Clock skew or wrong realm	Sync time (`ntpdate`/`chrony`); set `-d DOMAIN` correctly
Results differ from a tutorial	Renamed flags/modules since `cme`	Check `nxc --version` and current NetExec docs

Tools that pair well#

nmap / rustscan: find which hosts and ports are live before NetExec authenticates against them.
smbclient: browse and pull files from a share by hand once --shares shows WRITE or interesting READ access.
ldapsearch: run focused LDAP queries when you want detail beyond --users.
BloodHound / SharpHound: turn LDAP enumeration into visual attack paths.
Impacket (secretsdump, psexec): protocol-specific actions after NetExec confirms where a credential works.
evil-winrm: get an interactive shell on a host NetExec marked (Pwn3d!) over WinRM.
tee / grep / awk: capture and filter results into tidy, greppable notes.

Automation and note taking#

# Timestamped, saved, and echoed to the terminal in one shot
nxc smb TARGET_RANGE -u USERNAME -p PASSWORD --shares 2>&1 \
  | tee "notes/shares-$(date +%Y%m%d-%H%M).txt"

NetExec already keeps a workspace database and exports under ~/.nxc/, so use --export-style module output and the loot folder for files, but still keep a one-line scope note per engagement and a markdown summary of valid credentials and (Pwn3d!) hosts. Screenshot anything you will reference in a report, and never paste real credentials into shared notes.

Blue-team visibility#

Defenders see NetExec clearly because it authenticates against real services. SMB and WinRM logins generate Windows Security Event Logs: 4624 for successful logons, 4625 for failures, and 4768/4771 for Kerberos activity. A spray shows up as a burst of 4625 events across many accounts or hosts in a short window, which is one of the most reliable detections defenders have. Modules that touch the registry, services, or SAM can trigger EDR alerts and leave service- creation events (7045). Knowing this helps both sides: as a defender, alert on clustered failed logons and unusual remote-exec events; as a tester, it explains why an unthrottled spray gets you noticed and why account lockout fires.

Safer or lower-noise usage#

Confirm the account lockout policy before sending any credential, and keep attempts well under the threshold.
Validate on one host before running across a range.
Prefer read-only actions (--shares, --users, spidering) over modules that change state.
Keep --threads modest on fragile or high-latency networks.
Use a small, explicit target file instead of a broad CIDR when you can.
Avoid brute force entirely unless it is written into scope; validate known credentials instead.
Save output explicitly so you do not re-run noisy checks.

Alternatives#

CrackMapExec (cme): the predecessor NetExec forked from. Many workflows have moved to nxc because it is actively maintained; cme is largely legacy.
Impacket scripts: more precise for a single protocol action (for example secretsdump.py or psexec.py), but you wire each step yourself. Use Impacket when you want surgical control; use NetExec when you want breadth across hosts and protocols.
enum4linux-ng: stronger for deep, unauthenticated SMB/RPC enumeration of a single host. Use it for detail; use NetExec for credential validation at scale.
NetExec is the best all-rounder for “where does this credential work, and is it admin”, which is exactly the question that comes up most in AD testing.

Deprecated and legacy notes#

NetExec is the maintained fork of CrackMapExec. The old crackmapexec/cme command still appears in many tutorials, but the current command is nxc.
Some flags and module names changed during the rename, so a command copied from an old CrackMapExec guide may fail or behave differently. Check nxc <proto> -L for the current module list and nxc <proto> --help for current flags.
Hash formats and Kerberos options have shifted between releases, so verify syntax against the version you are running.

Quick reference cheat sheet#

# --- Fingerprint (no credentials) ---
nxc smb TARGET_IP                 # one host: OS, name, domain, signing
nxc smb TARGET_RANGE              # subnet sweep to build an in-scope list

# --- Validate credentials ---
nxc smb TARGET_IP -u USERNAME -p PASSWORD            # domain account, check Pwn3d!
nxc smb TARGET_IP -u USERNAME -p PASSWORD --local-auth  # local account
nxc smb TARGET_IP -u USERNAME -H HASH --local-auth      # pass-the-hash

# --- Enumerate (read-only) ---
nxc smb TARGET_IP -u USERNAME -p PASSWORD --shares   # share names + access
nxc ldap DC_IP -u USERNAME -p PASSWORD --users       # domain users over LDAP
nxc smb TARGET_IP -u USERNAME -p PASSWORD -M spider_plus  # spider readable shares

# --- Other protocols ---
nxc winrm TARGET_IP -u USERNAME -p PASSWORD          # WinRM access check
nxc mssql TARGET_IP -u USERNAME -p PASSWORD --local-auth  # SQL login + sysadmin
nxc ssh TARGET_IP -u USERNAME -p PASSWORD            # SSH credential check

# --- Spread a known credential across a list ---
nxc smb TARGET_RANGE -u USERNAME -p PASSWORD --continue-on-success

# --- Tuning ---
nxc smb TARGET_RANGE -u USERNAME -p PASSWORD --threads 25   # concurrency
nxc smb -L                                            # list SMB modules

# --- Save + echo for notes ---
nxc smb TARGET_IP -u USERNAME -p PASSWORD --shares 2>&1 | tee notes/shares.txt

Mini decision tree#

One credential, many hosts: validate on one host, then spread with --continue-on-success.
You have a hash, not a password: use -H HASH instead of -p PASSWORD.
Testing a standalone or local account: add --local-auth.
Login fails for the wrong reason: toggle --local-auth and confirm -d DOMAIN.
You see (Pwn3d!): confirm scope, then hand off to evil-winrm or Impacket.
You hit ACCOUNT_LOCKED_OUT: stop immediately and check the policy.
Need low noise: shrink the target list, drop --threads, stick to read-only actions.

Final checklist#

Scope, authorization, and account lockout policy noted before any auth
Fingerprinted hosts before sending credentials
Validated on one host before any spread across a range
Used --local-auth correctly for local vs domain accounts
Stuck to read-only actions unless modules were in scope
(Pwn3d!) findings verified, not assumed
Output saved and credentials kept out of shared notes
No real third-party targets or real credentials used

Final summary#

NetExec is best when you use it in layers: fingerprint hosts, validate one credential carefully, enumerate read-only, then spread only where the results justify it. The fastest way to start is nxc smb TARGET_IP -u USERNAME -p PASSWORD --shares against one authorized host. The most expensive mistake is spraying credentials without checking the lockout policy and locking out real accounts. Learn BloodHound next, since a clean LDAP enumeration is the most useful thing NetExec will hand you for mapping where to go.