domains / families / security / moving-laterally-with-netexec

moving-laterally-with-netexec

separate

Use NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout thresholds, execute commands, and dump SAM/LSA/NTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules. Use during authorized internal penetration tests to find lateral-movement paths after obtaining credentials or hashes, or to conduct controlled password spraying and post-exploitation on in-scope hosts.

When to use

• During an internal network penetration test after obtaining one or more valid credentials/hashes, to identify every host where those credentials grant admin access.
• To perform controlled password spraying against a domain while respecting lockout thresholds.
• To enumerate SMB shares, domain users, password policy, and loggedon sessions across a subnet in one sweep.
• To execute commands or dump SAM/LSA/NTDS credentials on authorized targets during post-exploitation.
• To collect BloodHound data or LAPS passwords using NetExec modules instead of separate tooling.

When not to use

• unauthorized systems
• systems without explicit written authorization

Skill page

Source