NetExec Network ExecutorStep-by-step reference: audit lab networks with NetExec SMB, WinRM & credential checks. Lab only.FAQ

What is NetExec?

NetExec is a free, open-source network exploitation toolkit and the maintained successor to CrackMapExec. It audits SMB, WinRM, SSH, LDAP, MSSQL, RDP, and more — testing credentials, enumerating shares, and running modules at subnet scale.

Is using NetExec legal?

NetExec itself is legitimate auditing software. Authenticating against systems without explicit written permission is illegal, and spraying can lock accounts. Use it only in isolated labs or signed engagements with agreed lockout limits.

How do I install NetExec?

Run pipx install netexec on Python 3.8 or newer. Verify with nxc --help and let the first run create its workspace database.

How do I check credentials across a subnet?

Run nxc smb against your lab range with -u and -p plus --shares. Hosts accepting the credential list their shares — the foundation of lateral movement mapping.

How do I spray safely?

Use --no-bruteforce with small lists, confirm the lockout policy first, and stop at agreed thresholds. One password per user per round is the safe pattern.

What is the difference between NetExec and CrackMapExec?

NetExec is the actively maintained fork with new protocols, modules, and a workspace database. CrackMapExec is unmaintained — all new work happens in NetExec.

Which protocol should I start with?

SMB: it reveals shares, sessions, and admin rights — the core internal attack surface. Expand to WinRM for command execution and LDAP for directory enumeration.

Why are accounts locking out?

Too many bad guesses tripped the policy. Stop, verify the threshold, shrink lists, slow down, and resume only inside the agreed window.

All tools · Sitemap · Games