Tool Documentation:

Practical SMB enumeration

NetExec can identify SMB hosts and enumerate share access using the credentials available to the assessor. Start with a basic SMB connection check against a host inside the authorized assessment scope:

nxc smb <target>

To enumerate shares with an authorized domain or local account:

nxc smb <target> -u '<user>' -p '<password>' --shares

The output reports the discovered shares and the access level available to the supplied account. To focus on shares with particular permissions, use the share filters documented by NetExec:

# Shares that are readable and writable
nxc smb <target> -u '<user>' -p '<password>' --shares READ,WRITE

# Shares that are readable
nxc smb <target> -u '<user>' -p '<password>' --shares READ

# Shares that are writable
nxc smb <target> -u '<user>' -p '<password>' --shares WRITE

Use --local-auth when the supplied account is local to each target rather than a domain account. Keep target addresses within the approved scope, and prefer known credentials over password-guessing during initial enumeration.

Keeping assessment data organized

NetExec stores collected information in its local database. The nxcdb utility can separate data between engagements using workspaces:

nxcdb

Create a workspace and select it with the options shown by nxcdb -h:

nxcdb -cw client-audit
nxcdb -sw client-audit

Consult the NetExec documentation for the current database commands and the SMB enumeration reference for protocol-specific options.

Packages and Binaries:

netexec

Network Execution Tool
NetExec (AKA nxc) is a network service exploitation tool that helps automate assessing the security of large networks.

NetExec is the continuation of CrackMapExec, which was maintained by mpgn over the years, but discontinued upon mpgn’s retirement.

Installed size: 3.60 MB
How to install: sudo apt install netexec

Dependencies:

bloodhound.py
certipy-ad
libkrb5-dev
python3
python3-aardwolf
python3-aioconsole
python3-aiosqlite
python3-argcomplete
python3-asyauth
python3-bs4
python3-dateutil
python3-dploot
python3-dsinternals
python3-impacket
python3-jwt
python3-libnmap
python3-lsassy
python3-masky
python3-minikerberos
python3-msgpack
python3-msldap
python3-neo4j
python3-oscrypto
python3-paramiko
python3-pefile
python3-poetry-core
python3-poetry-dynamic-versioning
python3-pyasn1-modules
python3-pylnk3
python3-pynfsclient
python3-pypsrp
python3-pypykatz
python3-pytest
python3-pywerview
python3-requests
python3-rich
python3-sqlalchemy
python3-termcolor
python3-terminaltables3
python3-xmltodict

netexec

root@kali:~# netexec -h
usage: netexec [-h] [--version] [-t THREADS] [--timeout TIMEOUT]
               [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose |
               --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp]
               [--dns-timeout DNS_TIMEOUT]
               {nfs,ldap,mssql,smb,ftp,vnc,ssh,rdp,wmi,winrm} ...

     .   .
    .|   |.     _   _          _     _____
    ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
    \\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
    .=[ ]=.    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__
   / /˙-˙\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
   ˙ \   / ˙
     ˙   ˙

    The network execution tool
    Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx

    For documentation and usage examples, visit: https://www.netexec.wiki/

    Version : 1.5.1
    Codename: Yippie-Ki-Yay
    Commit  : Kali Linux
    

options:
  -h, --help            show this help message and exit

Generic Options:
  --version             Display nxc version
  -t, --threads THREADS
                        set how many concurrent threads to use
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output Options:
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file
  --verbose             enable verbose output
  --debug               enable debug level information

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds

Available Protocols:
  {nfs,ldap,mssql,smb,ftp,vnc,ssh,rdp,wmi,winrm}
    nfs                 own stuff using NFS
    ldap                own stuff using LDAP
    mssql               own stuff using MSSQL
    smb                 own stuff using SMB
    ftp                 own stuff using FTP
    vnc                 own stuff using VNC
    ssh                 own stuff using SSH
    rdp                 own stuff using RDP
    wmi                 own stuff using WMI
    winrm               own stuff using WINRM

nxc

root@kali:~# nxc -h
usage: nxc [-h] [--version] [-t THREADS] [--timeout TIMEOUT]
           [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose |
           --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp]
           [--dns-timeout DNS_TIMEOUT]
           {nfs,ldap,mssql,smb,ftp,vnc,ssh,rdp,wmi,winrm} ...

     .   .
    .|   |.     _   _          _     _____
    ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
    \\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
    .=[ ]=.    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__
   / /˙-˙\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
   ˙ \   / ˙
     ˙   ˙

    The network execution tool
    Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx

    For documentation and usage examples, visit: https://www.netexec.wiki/

    Version : 1.5.1
    Codename: Yippie-Ki-Yay
    Commit  : Kali Linux
    

options:
  -h, --help            show this help message and exit

Generic Options:
  --version             Display nxc version
  -t, --threads THREADS
                        set how many concurrent threads to use
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output Options:
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file
  --verbose             enable verbose output
  --debug               enable debug level information

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds

Available Protocols:
  {nfs,ldap,mssql,smb,ftp,vnc,ssh,rdp,wmi,winrm}
    nfs                 own stuff using NFS
    ldap                own stuff using LDAP
    mssql               own stuff using MSSQL
    smb                 own stuff using SMB
    ftp                 own stuff using FTP
    vnc                 own stuff using VNC
    ssh                 own stuff using SSH
    rdp                 own stuff using RDP
    wmi                 own stuff using WMI
    winrm               own stuff using WINRM

nxcdb

root@kali:~# nxcdb -h
usage: nxcdb [-h] [-gw] [-cw CREATE_WORKSPACE] [-sw SET_WORKSPACE]

NXCDB is a database navigator for NXC

options:
  -h, --help            show this help message and exit
  -gw, --get-workspace  get the current workspace
  -cw, --create-workspace CREATE_WORKSPACE
                        create a new workspace
  -sw, --set-workspace SET_WORKSPACE
                        set the current workspace

Updated on: 2026-Nov-10

Edit this page

Kali Tools sharphound