Identity
NetExec
Network execution and enumeration suite for SMB, LDAP, WinRM, and related Windows services.
What it is
NetExec (nxc) is the maintained successor mindset to CrackMapExec: spray-cautious enumeration, share listing, signing checks, and authenticated module runs against Windows estates. Treat every module as potentially state-changing and read it before you fire it.
Reach for it when
Internal Windows/AD work for signing checks, share maps, and authenticated enum after you have in-scope creds.
Watch-outs
Password spraying locks accounts. Set fail-limit from the client's lockout policy and pause between attempts. Do not run SAM/LSA dump modules unless the RoE names them. Skip DCs for anything except read-only LDAP/SMB checks.
Typical invocation
nxc smb 10.20.4.0/24 -u jdoe -k --signing
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Impacket
Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.
- BloodHound
Graph analysis of Active Directory and hybrid identity attack paths from authorized collection.
- Nmap
Network mapper for host discovery, port scans, and service/version detection on in-scope ranges.
- Responder
LLMNR/NBT-NS/mDNS analysis and poisoning for authorized internal identity assessments.