search
githubEdit

NetExec

hashtag
SSH

  • attempt ssh authentication to multiple hosts with one set of credentials 

./nxc ssh targets.txt -u james -p password123
./nxc ssh targets.txt -u balthazar -p 'password123'
./nxc ssh targets.txt -u root -p asdfghjkl

  • attempt ssh auth to any host in a subnet with one set of credentials 

./nxc ssh 172.16.1.0/24 -u james -p password123

hashtag
WINRM

  • attempt winrm authentication to multiple hosts with one set of credentials 

./nxc winrm targets.txt -u balthazar -p 'abc123!!!'
# domain authentication
./nxc winrm targets.txt -u 'HTB.local\balthazar' -p 'abc123!!!' 
./nxc winrm targets.txt -u 'HTB.local\james' -p password123

  • attempt winrm authentication to a domain with a username and hash

./nxc winrm targets.txt -d HTB.local -u blake -H 12f18eteb6f8187fa52f3f729896bbb7
./nxc winrm targets.txt -u Administrator -H b99ed3c3d34c4576bcd33c76420be934

  • winrm with a single username and a password wordlist

./nxc winrm 172.16.1.101 -u dan.hard -p 172.16.1.101/passwordlist.txt

hashtag
SMB

  • attempt smb authentication to multiple hosts with one set of credentials

  • attempt ssh authentication with a keyfile instead of a password

  • attempt smb auth to any host in a subnet with anonymous logon

  • smb authentication to a domain with a specific username and attempt a password wordlist

  • attempt to authenticate with a known/potential password against a username list

hashtag
MSSQL

  • MSSQL Enumeration with netexec

  • Permissions enumeration

  • Attempt to enumerate user impersonation

  • enumerate users with active login sessions

  • attempt to priv esc with mssql

  • Access MSSQL and run a command with a password

  • kick off a sliver implant in the background

hashtag
Put file

hashtag
LDAP

  • attempt authentication to ldap with a username list and a valid password

  • list of users and computers with flag TRUSTED_FOR_DELEGATION

  • get admin count and their usernames

  • get users on the box, passwords can be in the comment field

  • get groups on the machine via ldap

  • enumerate domain controllers

  • get active users (non expired) via ldap

  • get bloodhound scan via ldap remote with net-exec

hashtag
Execution of Commands

  • execute cmd.exe command

  • execute powershell command

hashtag
mmcexec Execution

  • cmd.exe and powershell.exe

hashtag
atexec Scheduled task execution

  • cmd.exe and powershell.exe

hashtag
smbexec command execution

  • cmd.exe and powershell.exe

hashtag
wmiexec command execution

  • cmd.exe and powershell.exe

PreviousferoxbusterNextgs-netcat

Last updated