netexec
NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks.
Details
Category: Network
Publisher: trickest-mhmdiaa
Created Date: 7/18/2024
Container: quay.io/trickest/netexec:3a5c109
Source URL: https://github.com/Pennyw0rth/NetExec
Parameters
id
string
Command:
-id
- database credential ID(s) to use for authenticationls
string
Command:
--ls
- List files in the directorylsa
boolean
Command:
--lsa
- dump LSA secrets from target systemspvk
file
Command:
--pvk
- DPAPI option. File with domain backupkeysam
boolean
Command:
--sam
- dump SAM hashes from target systemswmi
string
Command:
--wmi
- issues the specified WMI querygmsa
boolean
Command:
--gmsa
- Enumerate GMSA passwordshash
string
Command:
--hash
- NTLM hash(es)ipv6
boolean
Command:
-6
- Enable force IPv6ntds
string
Command:
--ntds
- dump the NTDS.dit from target DCs using the specifed method (drsuapi,vss)port
string
Command:
--port
- Target portsccm
string
Command:
--sccm
- dump SCCM secrets from target systems (wmi,disk)user
string
Command:
--user
- Dump selected user from DCcodec
string
Command:
--codec
- Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec (default: utf-8)debug
boolean
Command:
--debug
- enable debug level informationdepth
string
Command:
--depth
- max spider recursion depthdisks
boolean
Command:
--disks
- enumerate disksdpapi
string
Command:
--dpapi
- dump DPAPI secrets from target systems, can dump cookies if you add 'cookies', will not dump SYSTEM dpapi if you add nosystem (cookies,nosystem)query
string
Command:
--query
- execute the specfied query against the targetregex
string
Command:
--regex
- regex(s) to search for in folders, filenames and file contentusers
string
Command:
--users
- enumerate domain users, if a user is specified than only its information is queried.domain
string
Command:
-d
- domain to authenticate togroups
string
Command:
--groups
- enumerate domain groups, if a group is specified than its members are enumeratedhashes
file
Command:
--hash
- file containing NTLM hashesjitter
string
Command:
--jitter
- sets a random delay between each authenticationmkfile
file
Command:
--mkfile
- DPAPI option. File with masterkeys in form of {GUID}:SHA1module
string
Command:
--module
- module to useno-smb
boolean
Command:
--no-smb
- No smb connectionserver
string
Command:
--server
- use the selected server (default: https)shares
boolean
Command:
--shares
- enumerate shares and accessspider
string
Command:
--spider
- share to spidertarget
string
requiredCommand:
- the target IP, range, CIDR, hostname, or FQDNaes-key
string
Command:
--aesKey
- AES key to use for Kerberos Authentication (128 or 256 bits)command
string
Command:
-x
- execute the specified commandcontent
boolean
Command:
--content
- enable file content searchingdns-tcp
boolean
Command:
--dns-tcp
- Use TCP instead of UDP for DNS queriesenabled
boolean
Command:
--enabled
- Only dump enabled targets from DCget-sid
boolean
Command:
--get-sid
- Get domain sidpattern
string
Command:
--pattern
- pattern(s) to search for in folders, filenames and file contenttargets
file
requiredCommand:
- a list of target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), NMap XML or .Nessus file(s)'threads
string
Command:
--threads
- set how many concurrent threads to usetimeout
string
Command:
--timeout
- max timeout in seconds of each threadverbose
boolean
Command:
--verbose
- enable verbose outputkerberos
boolean
Command:
--kerberos
- Use Kerberos authenticationpass-pol
boolean
Command:
--pass-pol
- dump password policypassword
string
Command:
--password
- passwordprotocol
string
requiredCommand:
- the network protocol to assess (available protocols: ldap, mssql, smb, wmi, ssh, vnc, ftp, winrm, rdp)sessions
boolean
Command:
--sessions
- enumerate active sessionsusername
string
Command:
--username
- usernamecomputers
string
Command:
--computers
- enumerate computer userpasswords
file
Command:
--password
- file containing passwordsusernames
file
Command:
--username
- file containing usernamesbloodhound
boolean
Command:
--bloodhound
- Perform a Bloodhound scancollection
string
Command:
--collection
- Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by separating them with a comma (default: Default)dns-server
string
Command:
--dns-server
- Specify DNS server (default: Use hosts file & System DNS)force-ps32
boolean
Command:
--force-ps32
- Force the PowerShell command to run in a 32-bit process via a job; WARNING: depends on the job completing quickly, so you may have to increase the timeoutinterfaces
boolean
Command:
--interfaces
- enumerate network interfaceslocal-auth
boolean
Command:
--local-auth
- authenticate locally to each targetonly-files
boolean
Command:
--only-files
- only spider filesuse-kcache
boolean
Command:
--use-kcache
- Use Kerberos authentication from ccache file (KRB5CCNAME)admin-count
boolean
Command:
--admin-count
- Get objets that had the value adminCount=1amsi-bypass
file
Command:
--amsi-bypass
- File with a custom AMSI bypassdns-timeout
string
Command:
--dns-timeout
- DNS query timeout in secondsdump-method
string
Command:
--dump-method
- Select shell type in hashes dump (default: cmd) (cmd,powershell)exec-method
string
Command:
--exec-method
- method to execute the command. Ignored if in MSSQL mode (default: wmiexec) (smbexec,wmiexec,atexec,mmcexec)no-progress
boolean
Command:
--no-progress
- do not displaying progress bar during scanserver-host
string
Command:
--server-host
- IP to bind the server to (default: 0.0.0.0)server-port
string
Command:
--server-port
- start the server on the specified portactive-users
string
Command:
--active-users
- Get Active Domain Users Accountsdcom-timeout
string
Command:
--dcom-timeout
- DCOM connection timeout (default: 5)exclude-dirs
string
Command:
--exclude-dirs
- directories to exclude from spideringlist-modules
boolean
Command:
--list-modules
- list available moduleslocal-groups
string
Command:
--local-groups
- enumerate local groups, if a group is specified then its members are enumeratedfilter-shares
string
Command:
--filter-shares
- Filter share by access, option 'read' 'write' or 'read,write'mssql-timeout
string
Command:
--mssql-timeout
- SQL server connection timeout (default: 5)no-bruteforce
boolean
Command:
--no-bruteforce
- No spray when using file for username and password (user1 => password1, user2 => password2)rid-brute-max
string
Command:
--rid-brute
- specify max RID to enumerate users by bruteforcing RIDsspider-folder
string
Command:
--spider-folder
- folder to spider (default: .)wmi-namespace
string
Command:
--wmi-namespace
- WMI Namespace (default: rootcimv2)loggedon-users
boolean
Command:
--loggedon-users
- enumerate logged on usersmodule-options
string
Command:
-o
- module optionsno-write-check
boolean
Command:
--no-write-check
- Skip write check on shares (avoid leaving traces when missing delete permissions)gmsa-convert-id
string
Command:
--gmsa-convert-id
- Get the secret name of specific gmsa or all gmsa if no gmsa providedhost-fail-limit
string
Command:
--fail-limit
- max number of failed login attempts per hostconnectback-host
string
Command:
--connectback-host
- IP for the remote system to connect back toget-output-tries
string
Command:
--get-output-tries
- Number of times atexec/smbexec/mmcexec tries to get results (default: 10)gmsa-decrypt-lsa
string
Command:
--gmsa-decrypt-lsa
- Decrypt the gmsa encrypted value from LSAglobal-fail-limit
string
Command:
--gfail-limit
- max number of global failed login attemptsno-command-output
boolean
Command:
--no-output
- do not retrieve command outputignore-pw-decoding
boolean
Command:
--ignore-pw-decoding
- Ignore non UTF-8 characters when decoding the password filepowershell-command
string
Command:
-X
- execute the specified PowerShell commandcontinue-on-success
boolean
Command:
--continue-on-success
- continues authentication attempts even after successesusername-fail-limit
string
Command:
--ufail-limit
- max number of failed login attempts per usernameno-powershell-encode
boolean
Command:
--no-encode
- Do not encode the PowerShell command ran on targetobfuscate-powershell
boolean
Command:
--obfs
- Obfuscate PowerShell ran on target; WARNING: Defender will almost certainly trigger on thisdisply-module-options
boolean
Command:
--options
- display module optionsloggedon-users-filter
string
Command:
--loggedon-users-filter
- only search for specific user, works with regexpassword-not-required
boolean
Command:
--password-not-required
- Get the list of users with flag PASSWD_NOTREQDtrusted-for-delegation
boolean
Command:
--trusted-for-delegation
- Get the list of users and computers with flag TRUSTED_FOR_DELEGATIONdomain-controllers-list
boolean
Command:
--dc-list
- Enumerate Domain Controllersclear-obfuscated-scripts
boolean
Command:
--clear-obfscripts
- Clear all cached obfuscated PowerShell scriptskerberos-domain-controller-host
string
Command:
--kdcHost
- FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter