NetExec — invoked as nxc — is the community fork of the archived CrackMapExec project, and it is the single most-used tool for sweeping an Active Directory network at scale. One command validates a credential against every host, lists shares, dumps users, sprays passwords, and drops SecretsDump across a whole subnet.
This guide installs it three ways (pipx, Docker, Kali apt), walks the full enumeration-to-post-exploitation workflow across SMB, LDAP and WinRM against a lab domain, and — because CyberHawk is a blue-team shop first — closes with the Windows Event IDs, KQL and SPL that turn every one of these commands into an alert. Everything here is for authorised testing on systems you own or are contracted to assess.
◈ Table of Contents
01 · What NetExec Is & Why It Matters
FoundationNetExec is a network-execution toolkit that speaks the protocols an AD network runs on and does the same thing over every one of them: authenticate, enumerate, and — where you have rights — execute. It began life as CrackMapExec (CME); understanding that lineage matters because half the tutorials still online reference commands that no longer work.
CrackMapExec was created by byt3bl33d3r and became the de-facto AD swiss-army knife. In 2023 the original repository was archived and development stopped. The community forked it, rewrote large parts of the engine, and released it as NetExec under the Pennyw0rth GitHub organisation. The binary changed from crackmapexec/cme to netexec/nxc. If a walkthrough tells you to run cme smb ..., mentally translate it to nxc smb ... — the syntax is deliberately backward-compatible, but the project, bug fixes and new protocols all live in NetExec now.
On Kali the crackmapexec package is now a transitional shim that pulls in NetExec. Standardise on nxc in your notes and scripts — CME will not receive protocol updates such as the newer LDAP channel-binding and SMB signing checks.
NetExec is invoked as nxc <protocol> <target> <options>. The protocol you pick decides the port and the module set available. The table below is the map you will return to constantly.
| Protocol | Port | Primary use |
|---|---|---|
| smb | 445 | Host discovery, shares, users, sessions, spraying, command exec, SecretsDump |
| ldap | 389 / 636 | Domain objects, Kerberoasting, AS-REP roasting, BloodHound ingestor, delegation |
| winrm | 5985 / 5986 | Remote PowerShell execution, credential validation |
| mssql | 1433 | SQL auth, xp_cmdshell exec, linked-server abuse |
| ssh | 22 | Linux credential validation and command exec |
| wmi | 135 | WMI query and exec where SMB exec is blocked |
| rdp / ftp / vnc / nfs | various | Credential validation, screenshotting, share/exports enumeration |
Every protocol shares a common credential engine: pass a username with a password (-p), an NT hash (-H), or a Kerberos ticket (-k), point it at one host or a whole CIDR range, and NetExec marks each result [+] success, [-] failure, or with a (Pwn3d!) tag when the credential grants admin.
Why a defender should care enough to run it in a lab:
SEE YOUR ATTACK SURFACE
The output of nxc smb across your own domain is exactly what an attacker sees on day one: SMB signing gaps, null sessions, over-shared folders.
BUILD DETECTIONS
Running the tool in a lab lets you capture the telemetry it generates so you can write and tune the Sentinel/Splunk rules in Phase 10.
FIND WEAK CREDS
Password-spray auditing against your own AD surfaces the accounts still using Season2026! before a real adversary does.
VALIDATE HARDENING
Re-running the same commands after a hardening sprint proves SMB signing, LDAP binding and LAPS actually took effect.
AUTHORISATION: NetExec authenticates, sprays and executes code on remote hosts. Running it against systems you do not own or lack written permission to test is a criminal offence in most jurisdictions. Build the lab in Phase 2 and stay inside it.
02 · Prerequisites & Lab Requirements
SetupNetExec runs from a Linux attack host against a Windows AD environment. If you followed the CyberHawk Active Directory Home Lab guide you already have everything you need; if not, the minimum viable range is one Domain Controller and one domain-joined workstation.
| Component | Minimum | Notes |
|---|---|---|
| Attack host | Kali 2026.x / Ubuntu 24.04 rec | Physical, VM or WSL2 — needs L2/L3 reach to the target subnet |
| Python | 3.9+ (3.11+ recommended) | NetExec targets modern Python; pipx isolates it cleanly |
| RAM / CPU | 4 GB / 2 vCPU min | 8 GB comfortable when BloodHound/Neo4j also run |
| Lab DC | Windows Server 2019/2022 | Promoted to a domain, e.g. cyberhawk.lab |
| Lab member | Windows 10/11 | Domain-joined; gives you lateral-movement targets |
| Network | Host-only / internal | Isolate the lab; never bridge attack tooling to a production LAN |
Before installing anything, confirm the attack host can see the domain. Identify the DC IP, the domain FQDN, and the subnet. Throughout this guide the lab uses DC 192.168.56.10 (DC01.cyberhawk.lab), a member at 192.168.56.20, and the subnet 192.168.56.0/24.
Kerberos is time-sensitive. If clock skew between your attack host and the DC exceeds five minutes, ticket-based auth (-k) and roasting will silently fail. Sync with sudo ntpdate 192.168.56.10 or sudo timedatectl set-ntp true.
03 · Method 1 — pipx (Recommended)
Install Apipx is the officially recommended install path. It drops NetExec into its own isolated virtual environment while exposing the nxc command globally, so it never collides with system Python packages — the classic cause of a broken CrackMapExec install.
NetExec compiles a couple of native crypto dependencies, so install the build toolchain first, then pipx itself, then make sure pipx's bin directory is on your PATH.
Installing straight from Git gives you the latest tagged release with all current protocol modules. The first run also seeds the config directory.
Keep it current with a single command: pipx upgrade netexec. NetExec ships fixes frequently — re-run this before any engagement so signing/binding detection logic is up to date.
The first time you run any protocol, NetExec creates ~/.nxc/ containing the config file, the workspace SQLite databases, logs, and downloaded loot. Confirm it exists — this is where all your enumeration results are persisted.
nxc --versionprints a version without a tracebacknxc smb 192.168.56.10returns a host line with the OS and domain~/.nxc/exists with nxc.conf inside
04 · Method 2 — Docker & Compose
Install BDocker is the cleanest option when you do not want any Python toolchain on the host, or you are running NetExec from a jump box / CI runner. The project ships a Dockerfile based on a slim Python image; you build it once and run disposable containers.
Clone the repository and build. The build installs the native crypto and Rust dependencies inside the image so your host stays clean.
Two flags matter: bind-mount ~/.nxc so your workspace database and dumped hashes survive the container, and use host networking so scans see the lab subnet directly.
If you run NetExec routinely, a compose file pins the build context, volume and network so a teammate reproduces your exact setup with one command. Save this as docker-compose.yml.
Host networking is required for subnet sweeps but exposes the container to your host's network stack. On a shared box, drop --network host, publish nothing, and target single IPs over a routed bridge instead.
05 · Method 3 — Kali apt & Building from Source
Install CIf you are on Kali or Parrot, the distro packages NetExec directly — the fastest possible install. Building from source with Poetry is the path for contributors or anyone who needs an unreleased fix from the main branch.
One command on Kali/Parrot. The package name is netexec; the legacy crackmapexec package now pulls it in as a dependency.
Distro packages can lag the upstream release by weeks. For anything time-sensitive (fresh protocol module, LDAP signing fix), prefer the pipx-from-git install in Method 1 and keep apt as a fallback.
Poetry manages the project's dependencies in a virtualenv and lets you run the exact checked-out code. Use this when you want the bleeding-edge main branch or intend to write your own module.
nxcresolves on your PATH (or via the alias / poetry run)- a plain
nxc smb <DC-IP>returns the host banner line - you have chosen ONE method and will not mix them (avoids PATH confusion)
06 · First Run & Core Concepts
FundamentalsBefore firing commands at the domain, internalise four things: the command grammar, how targets are specified, how credentials are supplied, and how NetExec stores what it finds. Get these right and every later command is just a variation on a theme.
The target argument accepts a single IP, a hostname, a CIDR range, a dashed range, or a file of targets — one per line. Sweeping the whole subnet in a single command is the entire point of the tool.
Supply local or domain creds with -u plus one of: -p (password), -H (NT hash, for pass-the-hash), or -k (Kerberos). Add -d cyberhawk.lab for domain auth, or --local-auth for local accounts. When a credential is a local administrator on the target, NetExec appends the coveted (Pwn3d!) tag.
-u users.txt -p passwords.txt tries every combination by default. To spray one password across many users instead — the safe, lockout-aware pattern — add --no-bruteforce so NetExec pairs line 1 with line 1, line 2 with line 2.
Everything NetExec learns — hosts, credentials, shares, dumped hashes — is written to a per-workspace SQLite database under ~/.nxc/workspaces/. Create one workspace per engagement so results never bleed between clients, and query them later with nxcdb.
07 · SMB Enumeration
Core ReconSMB is where every AD assessment starts. Even with no credentials you can map the network, and with a single low-privileged account you can enumerate the entire directory. Work through these in order.
A bare nxc smb against a range fingerprints every live host: hostname, OS build, domain, SMB version, and — critically — whether SMB signing is required. Hosts with signing disabled are relay targets.
--gen-relay-list writes a ready-made target file for ntlmrelayx. That single flag is why SMB signing "not required" is a finding worth flagging in every report.
Before you have any credentials, test whether the target allows anonymous (null) or guest access. A permissive null session can leak the user list and password policy — everything you need to build a spray.
With a valid credential, list every share and the READ/WRITE permission your account holds on each. Over-shared folders (finance, IT, backups) are where credentials and sensitive data leak.
Pull the domain user list, group memberships and the password policy over SMB. The policy tells you the lockout threshold — the number that decides how aggressively you can spray without locking accounts.
--users shows the badPwdCount per account. If you see counts already climbing, someone else is spraying — or your own earlier attempts are stacking. Read the lockout threshold from --pass-pol BEFORE you spray or you will lock the domain.
08 · LDAP, AD & Password Spraying
Deep ADThe LDAP protocol unlocks the richest Active Directory data: Kerberoastable service accounts, AS-REP-roastable users, delegation misconfigurations, and a one-command BloodHound ingest. This is where NetExec turns from a scanner into an attack-path finder.
Take the user list from Phase 7, pick one likely password below the lockout threshold, and spray it across all of them. --continue-on-success keeps going after the first hit so you find every reused password, not just the first.
Spraying is the single most common way to lock out a production domain and trigger a SOC callout. Space attempts across the observation window, stay two attempts below the lockout threshold, and never spray more than one password per window.
NetExec asks the DC for service tickets on every account with an SPN (--kerberoasting) and for AS-REP hashes on every account with pre-auth disabled (--asreproast). Both output hashes ready for offline cracking with Hashcat.
See the CyberHawk Kerberoasting Explained and Hashcat guides for the cracking and defence side. NetExec is the collection step; Hashcat is the crack step.
Three high-value LDAP checks feed classic escalation paths: accounts trusted for delegation, readable gMSA passwords, and the domain's machine-account quota (a non-zero MachineAccountQuota enables the noPac / RBCD chains).
The built-in BloodHound ingestor collects the whole graph over LDAP without dropping SharpHound on a host — quieter and cross-platform. Feed the resulting JSON straight into BloodHound CE.
Pair this with the CyberHawk BloodHound CE Setup guide: nxc collects, BloodHound maps the shortest path from jdoe to Domain Admin.
09 · Credentials, Execution & Modules
Post-ExploitOnce a credential returns (Pwn3d!) on a host, NetExec becomes a post-exploitation platform: dump secrets, execute commands, and load modules for specific attacks — all across the whole subnet at once.
With local admin, dump the local SAM hashes, LSA secrets, and cached domain logons. Do it across the whole subnet in one command to harvest every local-admin hash for reuse.
Dumping SAM/LSA touches LSASS and the registry hives — this is the loudest thing NetExec does and the easiest for EDR to catch. Expect Microsoft Defender for Endpoint to fire on --lsa against a monitored host.
With Domain Admin (or equivalent) rights on the DC, --ntds extracts every domain credential hash from the directory database. This is game-over for the domain and the highest-severity action in this guide.
The hashes from step 23 don't need cracking. Feed an NT hash back with -H and spray it across the network to find every host where that local-admin hash is reused — the essence of lateral movement.
Reused local-admin hashes are exactly what Microsoft LAPS eliminates. If this sweep lights up multiple hosts, "deploy LAPS" writes itself as the top report remediation.
On a Pwn3d host, run commands with -x (cmd) or -X (PowerShell). NetExec picks an execution method (wmiexec, smbexec, atexec) automatically, or you can force one with --exec-method.
Modules extend each protocol. List them with -L, then load one with -M. Several map to well-known, NVD-tracked vulnerabilities and safely check exposure before any exploitation.
| Module | Vulnerability | Severity |
|---|---|---|
| zerologon | CVE-2020-1472 — Netlogon EoP | CVSS 10.0 |
| ms17-010 | CVE-2017-0144 — EternalBlue SMBv1 RCE | CVSS 8.8 |
| nopac | CVE-2021-42278 — SAM name spoofing | AD EoP |
| spider_plus | Recursive share content discovery | recon |
The exploitation forms of zerologon and nopac can leave the target in a broken state (Zerologon resets the DC machine password). Use the check-only mode in a lab you can rebuild — never the destructive path on anything you cannot restore.
10 · Detection & Troubleshooting
Blue TeamEverything above generates telemetry. This is the section that matters most to a SOC: the Windows events NetExec leaves behind, the KQL and SPL to catch them, and the errors you will hit along the way.
Password spraying, remote exec and credential dumping each produce distinct Windows Security events. Learn these IDs and the tool's default fingerprints become trivial to alert on.
| Event ID | Signal | Which NetExec action |
|---|---|---|
| 4625 | Failed logon (bursts) | Password spray — many users, one source, tight window |
| 4624 (Type 3) | Network logon success | Successful auth / PtH across many hosts from one IP |
| 4672 | Special privileges assigned | Admin logon preceding a dump or exec |
| 7045 / 4697 | Service installed | smbexec / atexec creates a temporary service |
| 4768 / 4769 | Kerberos TGT / TGS request | Kerberoasting (4769 with RC4) & AS-REP roasting |
The clearest NetExec fingerprint is one source IP failing to authenticate against many distinct accounts inside a short window. Alert on the distinct-user count, not the raw failure count.
NetExec's exec methods install a short-lived service (event 7045) with a randomised name and a cmd.exe /c or PowerShell command line. That service-creation pattern is a high-fidelity signal.
Correlate a 4625 spray, a following 4624 Type 3 from the same IP, and a 7045 on the target within minutes — that triad is a NetExec lateral-movement chain and deserves an incident, not just an alert.
Most NetExec failures come down to name resolution, clock skew, or protocol hardening rather than the tool itself. Work this table top to bottom.
| Symptom | Likely cause | Fix |
|---|---|---|
| STATUS_NOT_SUPPORTED on auth | NTLM disabled / SMB signing or sealing mismatch | Use Kerberos (-k) with a resolvable FQDN target |
| KRB_AP_ERR_SKEW | Clock skew > 5 min vs DC | sudo ntpdate <DC-IP> then retry |
| Roasting returns nothing | Using IP instead of FQDN; DNS not set to DC | Target DC01.cyberhawk.lab, add DC to /etc/hosts & resolv.conf |
| nxc: command not found | pipx bin dir not on PATH | pipx ensurepath then re-open the shell |
| Connection refused / timeout | Host firewall or wrong subnet | Confirm port with nc -zv; check host-only network routing |
| LDAP bind fails, SMB works | LDAP channel binding / signing enforced | Use ldaps (636) or Kerberos; note it as a hardening win |
Add --verbose (or --debug) to any command to see the raw protocol exchange. It turns a cryptic one-line failure into the exact packet that broke.
- Require SMB signing everywhere — kills the relay-list generation and relay attacks
- Deploy LAPS — kills the pass-the-hash reuse sweep in step 25
- Disable NTLM where possible; enforce LDAP signing + channel binding
- Alert on the 4625 spray → 4624 Type3 → 7045 triad in your SIEM
- Patch Zerologon (CVE-2020-1472), noPac (CVE-2021-42278) and retire SMBv1 (CVE-2017-0144)
11 · Sources & References
VerifyPrimary documentation and the CVE records for every module referenced above. Always cross-check tool behaviour against the current upstream docs — NetExec ships changes frequently.
Run it against your own domain first. The fastest way to understand what an attacker sees is to point nxc smb at your lab and read the output like a report. Then head to the CyberHawk Blog for the companion guides — Active Directory Home Lab, BloodHound CE, Kerberoasting and Hashcat — and turn this enumeration workflow into a full attack-path exercise.
Need the detections production-ready? The CyberHawk SOPs cover NTLM relay, LDAP enumeration and lateral-movement response with tuned KQL and SPL.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."