NetExec — Network Service Exploitation and Enumeration Framework

Introduction

NetExec (nxc) is the actively maintained successor to CrackMapExec (CME), providing network service exploitation and enumeration capabilities for authorized penetration testers. It validates credentials, enumerates shares and users, executes commands, and performs post-exploitation tasks across multiple protocols including SMB, WinRM, LDAP, SSH, MSSQL, RDP, and FTP.

What NetExec Does

• Validates credentials against multiple targets simultaneously to identify password reuse and weak accounts
• Enumerates SMB shares, LDAP users, group memberships, and Active Directory objects across a domain
• Executes commands remotely via SMB, WinRM, SSH, and MSSQL for post-exploitation operations
• Dumps credentials from SAM, LSA secrets, NTDS.dit, and in-memory processes on compromised hosts
• Supports pass-the-hash, Kerberos ticket, and certificate-based authentication methods

Architecture Overview

NetExec is built in Python with a modular protocol-handler architecture. Each supported protocol (SMB, WinRM, LDAP, SSH, MSSQL, RDP, FTP) has its own connection module that implements authentication, enumeration, and execution methods. A plugin system allows community-contributed modules for specialized tasks. The tool uses Impacket under the hood for SMB and MSRPC operations, and paramiko for SSH. Targets can be specified as individual IPs, CIDR ranges, or files for network-wide operations.

Self-Hosting & Configuration

• Install via pipx for isolated dependency management: pipx install netexec
• Requires Python 3.8+ with pip or pipx for dependency resolution
• Configuration stored in ~/.nxc/ including a database of discovered hosts, credentials, and shares
• The built-in database tracks credential validations across engagements for correlation
• Proxy support routes traffic through SOCKS proxies for pivoting through compromised networks

Key Features

• Multi-protocol support covers the most common enterprise services in a single tool
• Credential spraying with configurable timing and lockout awareness for safe testing
• Built-in credential database tracks successful authentications across targets and protocols
• Module system provides specialized functions like Bloodhound data collection, GPP password extraction, and ADCS enumeration
• Color-coded output instantly shows successful (green) vs failed (red) authentication attempts

Comparison with Similar Tools

• CrackMapExec — the predecessor project now unmaintained; NetExec is the community-maintained fork with active development
• Impacket — provides the underlying protocol libraries; NetExec adds multi-target automation and a module ecosystem on top
• Evil-WinRM — specializes in WinRM shell access; NetExec covers WinRM plus five additional protocols with enumeration capabilities
• Metasploit — a broader exploitation framework; NetExec excels at rapid credential validation and network-wide enumeration

FAQ

Q: What happened to CrackMapExec? A: CrackMapExec development stopped after the original maintainer moved on. NetExec is the community-maintained fork that continues active development with new features and protocol support.

Q: Can NetExec be used for credential spraying safely? A: Yes, NetExec supports configurable delays between attempts and can be combined with lockout-aware strategies. Always coordinate with the target organization to avoid account lockouts.

Q: Does NetExec support Kerberos authentication? A: Yes, NetExec supports Kerberos authentication using tickets, keytabs, and PKINIT certificate-based authentication for stealthier operations.

Q: How does the built-in database work? A: NetExec maintains a SQLite database in ~/.nxc/ that stores discovered hosts, valid credentials, shares, and other findings. Use nxc smb --export to export results for reporting.

Sources

• https://github.com/Pennyw0rth/NetExec
• https://www.netexec.wiki/