Tool Spotlight: NetExec for Active Directory Exploitation

When CrackMapExec's repository was suddenly archived, a lot of penetration testers panicked. The tool that glued together half of our Active Directory assessments was dead in the water, leaving a massive void for anyone trying to spray credentials or execute code across hundreds of endpoints efficiently.

Enter NetExec (also known as nxc).

Born as a community-driven fork, NetExec didn't just keep the lights on—it overhauled the engine. It dropped outdated dependencies, integrated new modules, and refined the way we abuse protocols like SMB, WMI, and LDAP. If you've been clinging to your decaying installation of CME, it's time to let it go.

Let's look at what NetExec actually does, where it fits into your workflow, and why it's the undisputed king of AD post-exploitation right now.

The Job to Be Done

Imagine you're the on-call internal pentester and you've just captured a cleartext password for a low-privileged service account. Your next immediate question is: Where exactly does this account have local admin rights?

Manually checking each workstation via RDP or PowerShell remoting is out of the question. You need a tool that can take that single credential pair, spray it across an entire subnet using SMB, and definitively tell you where you can execute code. That is exactly what NetExec solves. It automates network service exploitation by leveraging native protocols, ensuring you "live off the land" and avoid dropping unnecessary binaries.

A typical lateral movement flow using NetExec to target Domain Controllers and workstations.

Where It Fits in the Workflow

NetExec shines immediately after your initial foothold. Once you have a valid set of credentials—or even just a hash—you feed it to nxc.

It handles:

1. Enumeration: Pulling domain password policies, listing shares, and identifying active sessions.
2. Credential Stuffing/Spraying: Testing known passwords against multiple accounts or endpoints.
3. Execution: Running arbitrary commands on target machines where you hold administrative rights (via WMI, SMBexec, or atexec).
4. Credential Dumping: Extracting SAM hashes or LSA secrets from compromised endpoints.