Details

Category: Network

Publisher: trickest-mhmdiaa

Created Date: 7/18/2024

Container: quay.io/trickest/netexec:3a5c109

Source URL: https://github.com/Pennyw0rth/NetExec

Parameters

id
string
Command: -id - database credential ID(s) to use for authentication
ls
string
Command: --ls - List files in the directory
lsa
boolean
Command: --lsa - dump LSA secrets from target systems
pvk
file
Command: --pvk - DPAPI option. File with domain backupkey
sam
boolean
Command: --sam - dump SAM hashes from target systems
wmi
string
Command: --wmi - issues the specified WMI query
gmsa
boolean
Command: --gmsa - Enumerate GMSA passwords
hash
string
Command: --hash - NTLM hash(es)
ipv6
boolean
Command: -6 - Enable force IPv6
ntds
string
Command: --ntds - dump the NTDS.dit from target DCs using the specifed method (drsuapi,vss)
port
string
Command: --port - Target port
sccm
string
Command: --sccm - dump SCCM secrets from target systems (wmi,disk)
user
string
Command: --user - Dump selected user from DC
codec
string
Command: --codec - Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec (default: utf-8)
debug
boolean
Command: --debug - enable debug level information
depth
string
Command: --depth - max spider recursion depth
disks
boolean
Command: --disks - enumerate disks
dpapi
string
Command: --dpapi - dump DPAPI secrets from target systems, can dump cookies if you add 'cookies', will not dump SYSTEM dpapi if you add nosystem (cookies,nosystem)
query
string
Command: --query - execute the specfied query against the target
regex
string
Command: --regex - regex(s) to search for in folders, filenames and file content
users
string
Command: --users - enumerate domain users, if a user is specified than only its information is queried.
domain
string
Command: -d - domain to authenticate to
groups
string
Command: --groups - enumerate domain groups, if a group is specified than its members are enumerated
hashes
file
Command: --hash - file containing NTLM hashes
jitter
string
Command: --jitter - sets a random delay between each authentication
mkfile
file
Command: --mkfile - DPAPI option. File with masterkeys in form of {GUID}:SHA1
module
string
Command: --module - module to use
no-smb
boolean
Command: --no-smb - No smb connection
server
string
Command: --server - use the selected server (default: https)
shares
boolean
Command: --shares - enumerate shares and access
spider
string
Command: --spider - share to spider
target
string
required
Command: - the target IP, range, CIDR, hostname, or FQDN
aes-key
string
Command: --aesKey - AES key to use for Kerberos Authentication (128 or 256 bits)
command
string
Command: -x - execute the specified command
content
boolean
Command: --content - enable file content searching
dns-tcp
boolean
Command: --dns-tcp - Use TCP instead of UDP for DNS queries
enabled
boolean
Command: --enabled - Only dump enabled targets from DC
get-sid
boolean
Command: --get-sid - Get domain sid
pattern
string
Command: --pattern - pattern(s) to search for in folders, filenames and file content
targets
file
required
Command: - a list of target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), NMap XML or .Nessus file(s)'
threads
string
Command: --threads - set how many concurrent threads to use
timeout
string
Command: --timeout - max timeout in seconds of each thread
verbose
boolean
Command: --verbose - enable verbose output
kerberos
boolean
Command: --kerberos - Use Kerberos authentication
pass-pol
boolean
Command: --pass-pol - dump password policy
password
string
Command: --password - password
protocol
string
required
Command: - the network protocol to assess (available protocols: ldap, mssql, smb, wmi, ssh, vnc, ftp, winrm, rdp)
sessions
boolean
Command: --sessions - enumerate active sessions
username
string
Command: --username - username
computers
string
Command: --computers - enumerate computer user
passwords
file
Command: --password - file containing passwords
usernames
file
Command: --username - file containing usernames
bloodhound
boolean
Command: --bloodhound - Perform a Bloodhound scan
collection
string
Command: --collection - Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by separating them with a comma (default: Default)
dns-server
string
Command: --dns-server - Specify DNS server (default: Use hosts file & System DNS)
force-ps32
boolean
Command: --force-ps32 - Force the PowerShell command to run in a 32-bit process via a job; WARNING: depends on the job completing quickly, so you may have to increase the timeout
interfaces
boolean
Command: --interfaces - enumerate network interfaces
local-auth
boolean
Command: --local-auth - authenticate locally to each target
only-files
boolean
Command: --only-files - only spider files
use-kcache
boolean
Command: --use-kcache - Use Kerberos authentication from ccache file (KRB5CCNAME)
admin-count
boolean
Command: --admin-count - Get objets that had the value adminCount=1
amsi-bypass
file
Command: --amsi-bypass - File with a custom AMSI bypass
dns-timeout
string
Command: --dns-timeout - DNS query timeout in seconds
dump-method
string
Command: --dump-method - Select shell type in hashes dump (default: cmd) (cmd,powershell)
exec-method
string
Command: --exec-method - method to execute the command. Ignored if in MSSQL mode (default: wmiexec) (smbexec,wmiexec,atexec,mmcexec)
no-progress
boolean
Command: --no-progress - do not displaying progress bar during scan
server-host
string
Command: --server-host - IP to bind the server to (default: 0.0.0.0)
server-port
string
Command: --server-port - start the server on the specified port
active-users
string
Command: --active-users - Get Active Domain Users Accounts
dcom-timeout
string
Command: --dcom-timeout - DCOM connection timeout (default: 5)
exclude-dirs
string
Command: --exclude-dirs - directories to exclude from spidering
list-modules
boolean
Command: --list-modules - list available modules
local-groups
string
Command: --local-groups - enumerate local groups, if a group is specified then its members are enumerated
filter-shares
string
Command: --filter-shares - Filter share by access, option 'read' 'write' or 'read,write'
mssql-timeout
string
Command: --mssql-timeout - SQL server connection timeout (default: 5)
no-bruteforce
boolean
Command: --no-bruteforce - No spray when using file for username and password (user1 => password1, user2 => password2)
rid-brute-max
string
Command: --rid-brute - specify max RID to enumerate users by bruteforcing RIDs
spider-folder
string
Command: --spider-folder - folder to spider (default: .)
wmi-namespace
string
Command: --wmi-namespace - WMI Namespace (default: rootcimv2)
loggedon-users
boolean
Command: --loggedon-users - enumerate logged on users
module-options
string
Command: -o - module options
no-write-check
boolean
Command: --no-write-check - Skip write check on shares (avoid leaving traces when missing delete permissions)
gmsa-convert-id
string
Command: --gmsa-convert-id - Get the secret name of specific gmsa or all gmsa if no gmsa provided
host-fail-limit
string
Command: --fail-limit - max number of failed login attempts per host
connectback-host
string
Command: --connectback-host - IP for the remote system to connect back to
get-output-tries
string
Command: --get-output-tries - Number of times atexec/smbexec/mmcexec tries to get results (default: 10)
gmsa-decrypt-lsa
string
Command: --gmsa-decrypt-lsa - Decrypt the gmsa encrypted value from LSA
global-fail-limit
string
Command: --gfail-limit - max number of global failed login attempts
no-command-output
boolean
Command: --no-output - do not retrieve command output
ignore-pw-decoding
boolean
Command: --ignore-pw-decoding - Ignore non UTF-8 characters when decoding the password file
powershell-command
string
Command: -X - execute the specified PowerShell command
continue-on-success
boolean
Command: --continue-on-success - continues authentication attempts even after successes
username-fail-limit
string
Command: --ufail-limit - max number of failed login attempts per username
no-powershell-encode
boolean
Command: --no-encode - Do not encode the PowerShell command ran on target
obfuscate-powershell
boolean
Command: --obfs - Obfuscate PowerShell ran on target; WARNING: Defender will almost certainly trigger on this
disply-module-options
boolean
Command: --options - display module options
loggedon-users-filter
string
Command: --loggedon-users-filter - only search for specific user, works with regex
password-not-required
boolean
Command: --password-not-required - Get the list of users with flag PASSWD_NOTREQD
trusted-for-delegation
boolean
Command: --trusted-for-delegation - Get the list of users and computers with flag TRUSTED_FOR_DELEGATION
domain-controllers-list
boolean
Command: --dc-list - Enumerate Domain Controllers
clear-obfuscated-scripts
boolean
Command: --clear-obfscripts - Clear all cached obfuscated PowerShell scripts
kerberos-domain-controller-host
string
Command: --kdcHost - FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter