netexec

No entries match these filters. Clear filters

1. advisory CVE-2026-27884 Feb 25, 2026 · issue 128
   • CVE-2026-27884: Arbitrary file write via path traversal in spider_plus module (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 1.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
2. v1.5.1 Feb 23, 2026 · release notes

   NetExec v1.5.1 adds shadow copy snapshot listing for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. & WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. and allows password changes on locked pre-2k accounts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.5.1 https://github.com/Pennyw0rth/NetExec.git
   # already have the repo? check out this version:
   $ git checkout v1.5.1

   • Adds list-snapshots function to the ShadowCopy module, supporting both SMB and WMI transports.
   • Enables password changes for locked pre-Windows-2000 (pre2k) accounts.

   2 details in Everything

3. v1.5.0 Dec 24, 2025 · release notes

   NetExec v1.5.0 adds 15+ new modules including BadSuccessor, AWS creds, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. sync, raw NTDS copy, and unauthenticated KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access..

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.5.0 https://github.com/Pennyw0rth/NetExec.git
   # already have the repo? check out this version:
   $ git checkout v1.5.0

   └──▷ TRY IT
   Extract SAM/LSALSALocal Security Authority — a Windows subsystem that handles authentication, enforces local security policy, and stores credential material, making it a frequent target for credential-harvesting cyber tools./NTDS secrets by mounting the raw disk — useful when AV blocks registry hive access.
   copy

   $ nxc smb <target> -u <user> -p <password> -M raw-ntds-copy

   Hunt for credentials stored in the info attribute of Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. user objects.
   copy

   $ nxc ldap <dc_ip> -u <user> -p <password> -M get-info-users

   Locate the Entra ID sync server to pivot into Azure AD and dump its sync credentials.
   copy

   $ nxc ldap <dc_ip> -u <user> -p <password> -M entra-id

   • New change-password SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. module resets accounts stuck in STATUS_PASSWORD_MUST_CHANGE without lockout.
   • Upgraded schtask_as module now supports uploading and executing custom binaries with custom flags via scheduled tasks.
   • New recyclebin module spiders the Windows Recycle Bin for deleted files (e.g., credentials) that were not emptied.
   • New mssql > enable_cmdshell module to enable xp_cmdshell on MSSQL targets.
   • New eventlog_creds module extracts credentials from Windows event logs when process creation auditing is enabled.

   +25 more show less

   • New BadSuccessor LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. module checks for the BadSuccessor privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. condition.
   • BloodHound Community Edition (CE) ZIP collector now supported; legacy collector selectable via config.
   • --dc-list flag now enumerates DCs across trusted domains.
   • Built-in LDAP signing and channel binding requirements now displayed in the host banner (replacing the removed ldap checker module).
   • AS-REP roastingAS-REP roastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline. now works with anonymous LDAP logins (no credentials required).
   • Kerberoasting now supported using a no-pre-auth account — no valid credentials needed.
   • New smb > presence module detects artifacts indicating admins violating tier infrastructure separation.
   • New SMB module extracts GPO-deployed privilege assignments.
   • New efsr_spray module added.
   • New AWS Credentials Finder module discovers AWS credentials on target hosts.
   • New SMB notepad module extracts contents of unsaved Notepad files.
   • New entra-id LDAP module finds the Entra ID (Azure AD Connect) sync server.
   • New Entra ID sync credentials extractor module dumps sync credentials from the discovered server.
   • New --taskkill option kills remote processes by name or PID.
   • Process filtering added to --tasklist for targeted process enumeration.
   • --qwinsta now supports filtering output for a specific user.
   • New get-info-users LDAP module queries the info attribute of user objects for embedded passwords.
   • New ldap > dump-computers module dumps computer objects via LDAP.
   • New raw-ntds-copy module mounts the disk and parses raw content to extract SAM, LSA, and NTDS secrets — bypasses AV blocks on registry hive access; also available for WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. and WINRM protocols.
   • Password Fine-Grained Policy (PSO) enumeration promoted from module to core LDAP feature.
   • LDAP parsing support added to the daclread module.
   • XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. Base Directory specification now supported for nxc configuration paths.
   • base_dn option added to the subnet module.
   • WCC module gains LLMNR check and improved NBTNS check.
   • slinky module now supports setting a custom LNK target path.

   30 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --opsec flag has been removed (deprecation: remove the horrible opsec flag).
   • !The multiple-hosts option has been removed (Removing the horrible multiple hosts option).
4. v1.4.0 Apr 13, 2025 · release notes

   NetExec v1.4.0 adds certificate auth, 10+ new modules, LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. channel binding, SSH file transfer, and NFS root escape.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.4.0 https://github.com/Pennyw0rth/NetExec.git
   # already have the repo? check out this version:
   $ git checkout v1.4.0

   └──▷ TRY IT
   Authenticate to a domain controller using a stolen PFXPFXA binary file format (PKCS#12) that bundles a private key and its certificate chain into a single password-protected file, letting cyber tools load credentials without managing separate key and cert files. certificate (pass-the-cert) to dump secrets without a password.
   copy

   $ nxc smb <dc_ip> --pfx-cert admin.pfx --pfx-pass 'P@ssw0rd' --ntds

   Enumerate all running sessions on a target host using native Windows protocols to avoid AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. detection.
   copy

   $ nxc smb <target> -u <user> -p <pass> --qwinsta

   Collect NTP-based computer account hashes from an unauthenticated position for offline cracking.
   copy

   $ nxc smb <dc_ip> -M timeroast

   Upload and execute a file over SSH, or pull back a file of interest during post-exploitation.
   copy

   $ nxc ssh <target> -u <user> -p <pass> --put-file /tmp/payload.sh /tmp/payload.sh

   • Adds certificate authentication (pass-the-cert) via --pfx-cert/--pfx-base64/--pfx-pass for PFX and --pem-cert/--pem-key for PEM certificates across protocols.
   • New SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. --dir flag lists contents of any SMB share, optionally combined with --share to target a specific share.
   • New SMB --qwinsta flag enumerates RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely./console sessions including connected user IPv4 addresses using native Windows protocols (no command execution).
   • New SMB --tasklist flag enumerates all running processes on the target using native Windows protocols.
   • New LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. --find-delegation flag enumerates all configured KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. delegations in the domain.

   +21 more show less

   • New --generate-hosts-file <path> flag for the SMB protocol auto-generates /etc/hosts entries for AD lab environments.
   • New --rid-brute flag for the MSSQL protocol enumerates domain users via RID cycling.
   • SSH protocol now supports --put-file and --get-file for uploading and downloading files over SSH.
   • New timeroast module retrieves all computer account password hashes in Windows-NTP-hash format from an unauthenticated perspective.
   • New wam module dumps Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and Microsoft 365 access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. from the Windows Token Broker Cache via DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves..
   • --dpapi now also loots Firefox cookies in addition to existing DPAPI loot.
   • New mssql_coerce module enables NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. coercion attacks via the MSSQL protocol.
   • New MSSQL modules: enum_impersonate (lists users with impersonation privileges), enum_logins (active login sessions), enum_links (linked MSSQL servers), exec_on_link (execute commands on linked servers), link_xpcmd (enable/disable xp_cmdshell on linked servers).
   • New SMB notepad_plus_plus module dumps unsaved files backed up by Notepad++ from Appdata\Roaming\Notepad++\Backup.
   • New SMB snippet module automatically downloads all screenshots captured by Snipping Tool from the target.
   • New remove-mic module checks for CVE-2019-1040 (Drop the Mic) vulnerability.
   • New backup_operators module automates privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. from the Backup Operators group to Domain Admin including NTDS.dit dump.
   • New dpapi_hash module dumps users' hashed passwords from DPAPI.
   • New remote-uac module enables or disables remote UAC on the target.
   • NFS protocol gains automatic root filesystem escape technique, allowing compromise of many Linux hosts via NFS export misconfigurations.
   • New --generate-krb5-file option generates a Kerberos krb5 configuration file.
   • LDAP protocol now supports LDAPS channel binding, enabling compatibility with hardened environments.
   • Adds official Python 3.13 support.
   • coerce_plus module now supports DCERPC for the PrinterBug coercion technique.
   • New MSSQL query for linked server configuration when running as local admin.
   • Default SMB connection switched from SMBv1 to SMBv3.

   26 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.8 and 3.9 are no longer supported; a Python 3.10+ runtime is required.
   • !The LDAP protocol no longer initiates an SMB connection alongside LDAP; setups relying on implicit SMB within the LDAP protocol will no longer work.
   • !The default SMB connection dialect is now SMBv3 instead of SMBv1; environments that relied on the SMBv1 default may need explicit configuration.
   • !The --pem-cert flag was renamed from --cert-pem to match PFX syntax; any scripts using --cert-pem will break.
5. v1.3.0 Oct 13, 2024 · release notes

   NetExec v1.3.0 adds NFS protocol support, SCCM LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. recon, coerce_plus, BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. dumping, and 8 new modules.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.3.0 https://github.com/Pennyw0rth/NetExec.git
   # already have the repo? check out this version:
   $ git checkout v1.3.0

   └──▷ TRY IT
   Enumerate NFS shares and their access privileges on a target host after authenticating.
   copy

   $ nxc nfs <target> --shares

   • New NFS protocol support: detect NFS servers, enumerate shares and privileges, recursive file enumeration with UID detection, and upload/download files.
   • New SCCM LDAP reconnaissance: enumerate SCCM Site-Servers, Sites, Management Points, and associated users, computers, and groups (with recursive group search).
   • New coerce_plus SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. module: combines DFSCoerce, PetitPotam, PrinterBug, ShadowCoerce, and MSEven coercion techniques into a single module.
   • New BitLocker SMB/WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. module to retrieve BitLocker recovery information.
   • New security-questions module queries Windows local user security questions, which may contain plaintext passwords.

   +14 more show less

   • New hyperv-host LDAP module to look up the hostname of a Hyper-V host.
   • New smbghost scanning module to detect CVE-2020-0796 (SMBGhost) vulnerability.
   • New network interfaces module to retrieve network interface information from remote hosts.
   • New SMB module to collect PowerShell command history for all users on a target.
   • Adds SMB file-write check to test write access on shares.
   • Adds EnumAV detection for Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. and Trellix EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. in the enum_av module.
   • Identifies Pre-Created Computer Accounts via LDAP and saves a ccache for each vulnerable account.
   • Displays a distinct Guest-privileges label when authentication succeeds via a guest account.
   • Adds domain name output to --users when enumerating via SAMR.
   • Improves OS detection accuracy.
   • Improves schtask_as module with options for custom task name, file, and location.
   • Adds wcc module checks for additional Windows Defender configuration items.
   • Increases plaintext and hash login speeds.
   • Adds NXCDB support for CTRL-D to exit the interactive database shell.

   19 details in Everything

6. v1.2.0 May 30, 2024 · release notes

   NetExec v1.2.0 adds --active-users, workspace management commands, multi-file SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. operations, and new modules for ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise., PuTTY, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. enumeration.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.2.0 https://github.com/Pennyw0rth/NetExec.git
   # already have the repo? check out this version:
   $ git checkout v1.2.0

   └──▷ USE IT
   Create and switch to a new workspace in nxcdb without opening the interactive console
   shell copy

   nxcdb --create-workspace <workspace_name>
   nxcdb --set-workspace <workspace_name>

   • Adds --active-users flag to the LDAP protocol to filter out deactivated accounts from user listings
   • Adds --get-workspace, --create-workspace, and --set-workspace commands (short flags -gw, -cw, -sw) to nxcdb for managing databases outside the interactive console
   • Adds LDAP enumeration modules for querying userPassword and unixUserPassword attributes which may contain cleartext passwords
   • Adds enum_adcs module to query Certificate Authority information without credentials
   • Adds PuTTY module to query for saved private keys and detect saved proxy credentials

   +5 more show less

   • Adds Winlogon Autologon module to detect autologon configurations
   • Updates [winrm] to no longer require SMB for gathering NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. info
   • Removes the --no-smb flag as MSSQL protocol no longer requires SMB
   • Adds --mssql-timeout option for MSSQL operations
   • Adds bash/zsh completion support via argcomplete when installed with pipx

   10 details in Everything

7. v1.1.0 Nov 12, 2023 · release notes

   NetExec v1.1.0 adds schtask module, S4U abuse flag, and FTP --get/--put flags.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.1.0 https://github.com/Pennyw0rth/NetExec.git
   # already have the repo? check out this version:
   $ git checkout v1.1.0

   └──▷ TRY IT
   Run a command as the currently logged-in user on a target via scheduled tasks.
   copy

   $ nxc smb <target_ip> -u <user> -p <pass> -M schtask

   Download a file from an FTP server to the current working directory.
   copy

   $ nxc ftp <target_ip> -u <user> -p <pass> --get <remote_filename>

   • schtask module added to impersonate logged-on users and run commands on their behalf
   • --s4u option implements full S4U abuse (S4U2Self + S4U2Proxy) for automated post-exploitation
   • FTP --ls, --get, and --put flags allow directory listing, file downloading, and file uploading

   3 details in Everything