offensive-netexec

NetExec (nxc) — Reference Skill

Global Syntax & Options

nxc <protocol> <target(s)> [auth options] [action options] [global options]

Available Protocols

smb ssh ldap ftp wmi winrm rdp vnc mssql nfs

Target Formats

nxc smb 192.168.1.0/24          # CIDR
nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs
nxc smb 192.168.1.1-28          # IP range
nxc smb dc01.corp.local         # Hostname
nxc smb ~/targets.txt           # File

Global Flags

Flag	Description
-t THREADS	Concurrent threads (default: 100)
--timeout TIMEOUT	Per-thread timeout in seconds
--jitter INTERVAL	Random delay between connections (e.g. 3, 2-5, 4-4)
--no-progress	Suppress progress bar
--verbose	Verbose output
--debug	Debug-level output

---

Authentication

Core Auth Flags

-u USERNAME          # Single username
-u user1 user2       # Multiple usernames
-u ~/users.txt       # Username file

-p PASSWORD          # Plaintext password
-p 'P@ss!'           # Always quote special chars
-p='-P@ss'           # Use = for passwords starting with -

-H 'NTHASH'          # NT hash only
-H 'LM:NT'           # Full NTLM hash
-H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

-id <cred_id>        # Use credential from nxcdb

--local-auth         # Authenticate as local user (not domain)

Domain Auth (SMB example)

nxc smb 192.168.1.0/24 -u Administrator -p 'Password123'
nxc smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

Local Auth

nxc smb 192.168.1.0/24 -u localadmin -p 'Password123' --local-auth

Kerberos Auth

# Auto-handle TGT using password
nxc smb dc01.corp.local -u user -p pass -k

# Use existing ccache ticket
export KRB5CCNAME=/path/to/ticket.ccache
nxc smb dc01.corp.local --use-kcache

# Specify KDC explicitly
nxc ldap dc01.corp.local -u user -p pass -k --kdcHost dc01.corp.local