crackmapexec: Post-exploitation and penetration testing tool

Any time I’m dropped into an internal Windows domain during an authorized assessment, CrackMapExec (CME) is one of the first tools I reach for. It’s often described as “the Metasploit for Active Directory,” and once you understand its module system, you’ll see why. Note: the original CrackMapExec project has been succeeded by NetExec (nxc), maintained by the community after the original repo was taken down — I’ll cover both since much of the syntax carries over directly.

What Is CrackMapExec?

CrackMapExec is a post-exploitation and network reconnaissance tool designed to automate the assessment of large Active Directory (AD) networks. It combines functionality you’d otherwise need multiple separate tools for: credential validation, share enumeration, command execution, hash dumping, and lateral movement — all from one interface.

Architecture and Internal Working

CME is built on Python and Impacket libraries, giving it native support for SMB, WinRM, MSSQL, LDAP, SSH, and RDP protocols. Internally:

• Protocol handlers – separate modules for smb, winrm, mssql, ldap, ssh, and rdp, each exposing protocol-specific options.
• Credential engine – accepts single credentials, credential lists, hash values (pass-the-hash), or Kerberos tickets, and tests them across an entire subnet in parallel.
• Module system – extensible Python modules (like --module mimikatz or --module spider_plus) that run additional actions once authentication succeeds.
• Database backend – stores discovered hosts, credentials, and shares in a local SQLite database so you can query results later without re-scanning.

Installation

On Kali Linux (CME is included, or install the successor NetExec):

sudo apt install crackmapexec

Or install NetExec (actively maintained fork):

pipx install git+https://github.com/Pennyw0rth/NetExec

Verify installation:

crackmapexec --version
# or
nxc --version

Basic Syntax

crackmapexec <protocol> <target> -u <username> -p <password> [options]

Practical Command Examples (Authorized AD Lab Only)

1. SMB host discovery across a subnet:

crackmapexec smb 192.168.56.0/24

Sample output:

SMB  192.168.56.10   445    DC01    [*] Windows Server 2019 (name:DC01) (domain:LAB.LOCAL) (signing:True)
SMB  192.168.56.20   445    WKS01   [*] Windows 10 (name:WKS01) (domain:LAB.LOCAL) (signing:False)

2. Validating credentials across all discovered hosts:

crackmapexec smb 192.168.56.0/24 -u administrator -p 'P@ssw0rd123'

Output on success:

SMB  192.168.56.20   445    WKS01   [+] LAB.LOCAL\administrator:P@ssw0rd123 (Pwn3d!)

3. Pass-the-hash authentication:

crackmapexec smb 192.168.56.20 -u administrator -H 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'

4. Enumerating SMB shares:

crackmapexec smb 192.168.56.20 -u administrator -p 'P@ssw0rd123' --shares

5. Dumping SAM hashes (requires admin privileges):

crackmapexec smb 192.168.56.20 -u administrator -p 'P@ssw0rd123' --sam

6. Executing a command remotely:

crackmapexec smb 192.168.56.20 -u administrator -p 'P@ssw0rd123' -x "whoami /all"

7. Spidering shares for sensitive files:

crackmapexec smb 192.168.56.20 -u administrator -p 'P@ssw0rd123' -M spider_plus

8. LDAP enumeration for AD users:

crackmapexec ldap 192.168.56.10 -u administrator -p 'P@ssw0rd123' --users

Configuration

CME’s local workspace database lives at ~/.cme/workspaces/ (or ~/.nxc/workspaces/ for NetExec). You can switch workspaces per engagement:

crackmapexec workspace create client-A
crackmapexec workspace list

This keeps discovered credentials/hosts cleanly separated between different authorized engagements.

Real-World Use Cases

• Internal penetration tests: Rapidly validating a leaked or guessed credential across an entire domain to measure “blast radius.”
• Red team lateral movement: Chaining pass-the-hash across multiple hosts after an initial foothold.
• Incident response: Verifying which hosts a compromised credential could have accessed, to scope a breach during containment.
• AD hardening reviews: Identifying hosts with SMB signing disabled or weak local admin password reuse.

Integration with Other Tools

• Impacket suite: CME shares its underlying protocol libraries with tools like secretsdump.py and psexec.py, so output/credentials flow naturally between them.
• BloodHound: Use LDAP enumeration from CME to feed data into BloodHound for AD attack-path visualization.
• Metasploit: Once you gain code execution via CME, pivot into a Meterpreter session for deeper post-exploitation.
• Responder: Capture hashes with Responder on the network, then validate them against hosts using CME’s pass-the-hash support.

Performance Optimization

• Use --threads to control concurrency when scanning large subnets (default is usually sufficient, but tune down on noisy/monitored networks).
• Filter by protocol/port first (smb, winrm) before running heavier modules to avoid wasted time on unreachable hosts.
• Use the workspace database to avoid re-scanning hosts you’ve already enumerated in the same engagement.

Troubleshooting

• “STATUS_LOGON_FAILURE” errors: Confirm domain vs. local account context; try prefixing with the domain (-u LAB\\administrator).
• SMB signing errors blocking execution modules: Some hosts enforce SMB signing, which blocks certain relay-based techniques — switch to WinRM or straightforward pass-the-hash instead.
• Module not found: Update CME/NetExec, as modules are added and modified frequently across releases.

Best Practices

• Always scope your target subnet precisely — avoid scanning ranges outside the signed engagement rules of engagement.
• Rotate through low-risk protocols (SMB share listing) before attempting execution modules that touch endpoint security tooling.
• Log all credential validation attempts for your final pentest report, including which hosts responded as “Pwn3d!”

Common Mistakes

1. Running credential spraying too aggressively, triggering account lockouts on a production domain.
2. Forgetting --local-auth when testing local admin credentials instead of domain credentials, causing false negatives.
3. Not clearing/rotating workspaces between different clients, mixing up sensitive credential data.

FAQ

Is CrackMapExec still maintained? The original CrackMapExec repository was taken down; the community-maintained fork NetExec (nxc) continues active development with largely compatible syntax.

Does CME exploit vulnerabilities? Not directly — it’s primarily a post-exploitation/enumeration tool that operates using valid or captured credentials, not a vulnerability exploitation framework like Metasploit.

Can CME be detected by EDR/AV? Yes, especially execution modules (-x, -X) and modules like mimikatz, which are heavily signatured by modern endpoint detection tools.

Lab Example

1. Build a small AD lab: one Windows Server domain controller, one or two Windows 10/11 workstations, all in an isolated virtual network.
2. Create a known local admin account with a shared password across machines (a common real-world misconfiguration).
3. Run the SMB discovery and credential validation commands above.
4. Use --sam to dump local hashes, then attempt pass-the-hash against a second machine to simulate lateral movement.

Summary

CrackMapExec (and its actively maintained successor, NetExec) remains one of the most efficient tools for assessing Active Directory environments at scale. From credential validation to lateral movement simulation, it consolidates workflows that would otherwise require juggling several separate Impacket scripts. Used within a properly scoped and authorized engagement, it dramatically speeds up internal network assessments.

References

• NetExec GitHub (active fork): https://github.com/Pennyw0rth/NetExec
• Original CrackMapExec wiki (archived): https://mpgn.gitbook.io/crackmapexec/
• Impacket project: https://github.com/fortra/impacket