https://cybertoolchain.io/tools/netexec New releases and features in netexec, tracked by The Cyber Toolchain. en Mon, 23 Feb 2026 14:52:17 GMT https://github.com/Pennyw0rth/NetExec/releases/tag/v1.5.1 https://github.com/Pennyw0rth/NetExec/releases/tag/v1.5.1 Mon, 23 Feb 2026 14:52:17 GMT NetExec v1.5.1 adds shadow copy snapshot listing for SMB & WMI and allows password changes on locked pre-2k accounts. • Adds `list-snapshots` function to the ShadowCopy module, supporting both SMB and WMI transports. • Enables password changes for locked pre-Windows-2000 (pre2k) accounts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netexec https://github.com/Pennyw0rth/NetExec/releases/tag/v1.5.0 https://github.com/Pennyw0rth/NetExec/releases/tag/v1.5.0 Wed, 24 Dec 2025 16:34:29 GMT NetExec v1.5.0 adds 15+ new modules including BadSuccessor, AWS creds, Entra ID sync, raw NTDS copy, and unauthenticated Kerberoasting. • New `change-password` SMB module resets accounts stuck in `STATUS_PASSWORD_MUST_CHANGE` without lockout. • Upgraded `schtask_as` module now supports uploading and executing custom binaries with custom flags via scheduled tasks. • New `recyclebin` module spiders the Windows Recycle Bin for deleted files (e.g., credentials) that were not emptied. • New `mssql > enable_cmdshell` module to enable xp_cmdshell on MSSQL targets. • New `eventlog_creds` module extracts credentials from Windows event logs when process creation auditing is enabled. • New `BadSuccessor` LDAP module checks for the BadSuccessor privilege escalation condition. • BloodHound Community Edition (CE) ZIP collector now supported; legacy collector selectable via config. • `--dc-list` flag now enumerates DCs across trusted domains. • Built-in LDAP signing and channel binding requirements now displayed in the host banner (replacing the removed ldap checker module). • AS-REP roasting now works with anonymous LDAP logins (no credentials required). • Kerberoasting now supported using a no-pre-auth account — no valid credentials needed. • New `smb > presence` module detects artifacts indicating admins violating tier infrastructure separation. • New SMB module extracts GPO-deployed privilege assignments. • New `efsr_spray` module added. • New `AWS Credentials Finder` module discovers AWS credentials on target hosts. • New SMB `notepad` module extracts contents of unsaved Notepad files. • New `entra-id` LDAP module finds the Entra ID (Azure AD Connect) sync server. • New Entra ID sync credentials extractor module dumps sync credentials from the discovered server. • New `--taskkill` option kills remote processes by name or PID. • Process filtering added to `--tasklist` for targeted process enumeration. • `--qwinsta` now supports filtering output for a specific user. • New `get-info-users` LDAP module queries the `info` attribute of user objects for embedded passwords. • New `ldap > dump-computers` module dumps computer objects via LDAP. • New `raw-ntds-copy` module mounts the disk and parses raw content to extract SAM, LSA, and NTDS secrets — bypasses AV blocks on registry hive access; also available for WMI and WINRM protocols. • Password Fine-Grained Policy (PSO) enumeration promoted from module to core LDAP feature. • LDAP parsing support added to the `daclread` module. • XDG Base Directory specification now supported for `nxc` configuration paths. • `base_dn` option added to the `subnet` module. • WCC module gains LLMNR check and improved NBTNS check. • `slinky` module now supports setting a custom LNK target path. Breaking changes: • The `--opsec` flag has been removed (`deprecation: remove the horrible opsec flag`). • The multiple-hosts option has been removed (`Removing the horrible multiple hosts option`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netexec https://github.com/Pennyw0rth/NetExec/releases/tag/v1.3.0 https://github.com/Pennyw0rth/NetExec/releases/tag/v1.3.0 Sun, 13 Oct 2024 20:40:15 GMT NetExec v1.3.0 adds NFS protocol support, SCCM LDAP recon, coerce_plus, BitLocker dumping, and 8 new modules. • New NFS protocol support: detect NFS servers, enumerate shares and privileges, recursive file enumeration with UID detection, and upload/download files. • New SCCM LDAP reconnaissance: enumerate SCCM Site-Servers, Sites, Management Points, and associated users, computers, and groups (with recursive group search). • New `coerce_plus` SMB module: combines DFSCoerce, PetitPotam, PrinterBug, ShadowCoerce, and MSEven coercion techniques into a single module. • New `BitLocker` SMB/WMI module to retrieve BitLocker recovery information. • New `security-questions` module queries Windows local user security questions, which may contain plaintext passwords. • New `hyperv-host` LDAP module to look up the hostname of a Hyper-V host. • New `smbghost` scanning module to detect CVE-2020-0796 (SMBGhost) vulnerability. • New network interfaces module to retrieve network interface information from remote hosts. • New SMB module to collect PowerShell command history for all users on a target. • Adds SMB file-write check to test write access on shares. • Adds EnumAV detection for Cortex XDR and Trellix EDR in the `enum_av` module. • Identifies Pre-Created Computer Accounts via LDAP and saves a ccache for each vulnerable account. • Displays a distinct Guest-privileges label when authentication succeeds via a guest account. • Adds domain name output to `--users` when enumerating via SAMR. • Improves OS detection accuracy. • Improves `schtask_as` module with options for custom task name, file, and location. • Adds `wcc` module checks for additional Windows Defender configuration items. • Increases plaintext and hash login speeds. • Adds NXCDB support for CTRL-D to exit the interactive database shell. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netexec https://github.com/Pennyw0rth/NetExec/releases/tag/v1.2.0 https://github.com/Pennyw0rth/NetExec/releases/tag/v1.2.0 Thu, 30 May 2024 21:10:00 GMT NetExec v1.2.0 adds `--active-users`, workspace management commands, multi-file SMB operations, and new modules for ADCS, PuTTY, and LDAP enumeration. • Adds `--active-users` flag to the LDAP protocol to filter out deactivated accounts from user listings • Adds `--get-workspace`, `--create-workspace`, and `--set-workspace` commands (short flags `-gw`, `-cw`, `-sw`) to `nxcdb` for managing databases outside the interactive console • Adds LDAP enumeration modules for querying `userPassword` and `unixUserPassword` attributes which may contain cleartext passwords • Adds `enum_adcs` module to query Certificate Authority information without credentials • Adds PuTTY module to query for saved private keys and detect saved proxy credentials • Adds Winlogon Autologon module to detect autologon configurations • Updates `[winrm]` to no longer require SMB for gathering NTLM info • Removes the `--no-smb` flag as MSSQL protocol no longer requires SMB • Adds `--mssql-timeout` option for MSSQL operations • Adds bash/zsh completion support via argcomplete when installed with pipx Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netexec https://github.com/Pennyw0rth/NetExec/releases/tag/v1.1.0 https://github.com/Pennyw0rth/NetExec/releases/tag/v1.1.0 Sun, 12 Nov 2023 22:41:07 GMT NetExec v1.1.0 adds schtask module, S4U abuse flag, and FTP --get/--put flags. • `schtask` module added to impersonate logged-on users and run commands on their behalf • `--s4u` option implements full S4U abuse (S4U2Self + S4U2Proxy) for automated post-exploitation • FTP `--ls`, `--get`, and `--put` flags allow directory listing, file downloading, and file uploading Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netexec