You read a walkthrough, you type crackmapexec smb 10.10.10.0/24, and your shell answers with command not found. That is not a broken install. CrackMapExec, the tool that spent nearly a decade as the default way to sweep a Windows network from a single Linux box, was archived by its owner on 6 December 2023 and has not shipped a fix since. Learning how to use CrackMapExec in 2026 means learning NetExec, the fork that inherited the project, the users, and the muscle memory.
Almost nothing you already know is wasted. The syntax, the flags, and the output format carried over nearly unchanged, so a five year old blog post still teaches you something useful as long as you swap the binary name. This guide covers what changed, how to install the replacement, and the specific commands that make the tool worth its reputation in penetration testing work. If you want the theory behind the attacks first, the Active Directory enumeration chapter walks through what each of these commands is actually asking the domain controller.
TL;DR: CrackMapExec is archived and unmaintained. Its successor is NetExec, invoked as nxc, installed on Kali with sudo apt install netexec. The syntax is nxc <protocol> <target> -u user -p pass across ten protocols including SMB, LDAP, WinRM and MSSQL. Start with --shares and --pass-pol, and treat a (Pwn3d!) in the output as your signal that the account has admin rights on that host.
What Happened to CrackMapExec?
CrackMapExec is a post-exploitation tool for auditing Windows and Active Directory networks that is no longer maintained. Its GitHub repository was archived on 6 December 2023 and is now read only. The README states the project stopped because of what the author describes as a hostile fork.
That fork is NetExec, and it won. The Kali Linux package page describes NetExec as the continuation of CrackMapExec, which was maintained by mpgn over the years and discontinued upon mpgn's retirement. Kali dropped the old package and now ships netexec instead, currently at version 1.5.1. When your distribution's security tooling maintainers make that call, the argument is over.
My advice is blunt: do not install CrackMapExec from an archived repo to follow along with an old tutorial. You will fight dependency errors from a Python project frozen in 2023, and you will miss three years of protocol support and bug fixes. Read the old tutorial, run the new binary.
The original tool is documented in MITRE ATT&CK as software S0488, mapped to eighteen techniques covering credential dumping, pass the hash, brute force, and remote command execution. That entry lists five threat groups that used it in real intrusions, including MuddyWater, FIN7 and APT39. It is a genuinely powerful tool, which is exactly why the authorization section further down is not boilerplate.
Installing NetExec
On Kali and Parrot the package is in the standard repositories:
sudo apt update && sudo apt install netexecEverywhere else, the maintainers recommend pipx, which keeps the tool and its dependencies in their own virtual environment instead of your system Python:
sudo apt install pipx git
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExecOpen a new shell afterwards so the updated PATH takes effect. Installation gives you three commands: netexec, the short alias nxc that everyone actually types, and nxcdb for browsing the results database. Confirm it works:
nxc --versionTwo failures come up often enough to name. If the build dies on fatal error: Python.h: No such file or directory, you are missing your distribution's Python development headers, which one of the dependencies needs to compile. And if nxc is still not found after a pipx install, you skipped pipx ensurepath or you are in the same shell session from before.
Keeping it current with pipx is one line. pipx upgrade netexec takes tagged releases, and pipx reinstall netexec pulls the latest commits when you need a fix that has not been released yet.
CrackMapExec Syntax: Protocol, Target, Credentials
Every command follows the same three part shape, which is why the tool is quick to learn and hard to put down:
nxc <protocol> <target(s)> -u <user> -p <password>NetExec supports ten protocols: smb, ldap, winrm, mssql, ssh, ftp, wmi, rdp, vnc and nfs. Each one has its own flag set, so nxc smb --help and nxc ldap --help show genuinely different menus. SMB is where most engagements start.
Target Formats
The target argument accepts more than a single IP, and mixing formats in one command is allowed:
nxc smb 192.168.1.10for a single hostnxc smb 192.168.1.0/24for CIDR notationnxc smb 192.168.1.0-28for a rangenxc smb dc01.corp.localfor a hostnamenxc smb ~/targets.txtfor a file with one target per line
Passwords, Hashes and Local Accounts
Swap -p for -H to authenticate with an NTLM hash instead of a password, which is the pass the hash technique in its most convenient form. Both the full LM:NT pair and a bare NT hash work:
nxc smb 192.168.1.0/24 -u localguy -H 'aad3b435b51404eeaad3b435b51404ee:13b29964cc2480b4ef454c59562e675c' --local-authThat --local-auth flag tells the tool to authenticate against the machine's local SAM rather than the domain. It matters more than beginners expect: a local administrator password reused across fifty workstations is a completely different finding from a domain account, and without the flag you will be testing the wrong thing. A null session is just empty strings, -u '' -p ''.
One shell detail that costs people an hour: wrap credentials in single quotes. A password like October2022! triggers history expansion in bash and you will spend that hour convinced the account is locked.
Reading the Output
Results are one line per host. [*] is the host banner with OS build, domain and SMB signing status, [+] means authentication succeeded, and [-] means it failed. The line you are hunting for looks like this:
SMB 192.168.1.101 445 HOSTNAME [+] DOMAIN\Username:Password (Pwn3d!)That (Pwn3d!) marker means the credentials can execute code on the host. Its exact meaning shifts by protocol, and the difference is worth knowing: on SMB and WMI it means the account is most likely a local administrator, on WinRM and RDP it means code execution at minimum, and on LDAP it means the account has a path to domain admin. On FTP there is no check at all.
SMB Enumeration Commands Worth Memorizing
Authentication is the appetizer. The reason this tool earned its place is that a single valid low privilege account, pointed at a whole subnet, returns a map of the domain in about a minute.
| Flag | What it returns |
|---|---|
--shares | Every share on every host, with your read and write access to each |
--users | Domain user accounts, with --users-export file.txt to save the list |
--rid-brute | User and group names recovered by walking RIDs, useful when --users is blocked |
--pass-pol | Domain password policy: length, complexity, and the lockout threshold |
--loggedon-users | Who is currently signed in to a host, which is how you find where admins sit |
--disks | Disks attached to the target |
The share sweep is the one to run first, and the documentation calls it the most useful feature in the tool. You can filter to only the shares that matter:
nxc smb 192.168.1.0/24 -u user -p 'Password123' --shares READ,WRITEIn practice, a writable share on a file server is where a routine internal test turns into a report finding. Backup folders holding a domain join script with a plaintext password, an IT share with a spreadsheet of local admin credentials, a deployment directory nobody has audited since the server was built: the pattern repeats across organizations of every size, and one --shares sweep surfaces all of it.
Run --pass-pol before you touch anything that guesses passwords. It costs one command and it tells you the lockout threshold, which is the number that decides whether the next section is safe.
Password Spraying Without Locking Out the Domain
Password spraying tries one password against many accounts, rather than many passwords against one account. It stays under the lockout threshold because each account only sees a single failed login per round. Get this backwards and you lock out a few hundred employees before lunch, which ends engagements and burns client relationships.
The default behaviour when you pass a user list and a password is a full cross product of every user against every password. For a spray you want one password across the list:
nxc smb 192.168.1.101 -u users.txt -p 'Summer2026!' --continue-on-success--continue-on-success is the flag people forget. Without it the run stops at the first valid credential, and you learn about one account instead of the six that share that password.
When you have paired credentials rather than a list to spray, --no-bruteforce matches line one of the user file to line one of the password file instead of testing every combination:
nxc smb 192.168.1.101 -u users.txt -p passwords.txt --no-bruteforce --continue-on-successTwo habits keep this from going wrong. Check --pass-pol first so you know the threshold and the observation window. And spray once, then wait, rather than firing three rounds in ten minutes because the first found nothing.
From Valid Credentials to Domain Admin
Once a set of credentials comes back with (Pwn3d!), the tool switches from enumeration to collection. These commands require administrative rights on the target.
Dumping Credential Material
nxc smb 192.168.1.0/24 -u Admin -p 'Password' --sam
nxc smb 192.168.1.0/24 -u Admin -p 'Password' --lsa
nxc smb 192.168.1.100 -u Admin -p 'Password' --ntds --enabled--sam pulls local account hashes, --lsa pulls LSA secrets including cached domain credentials and service account passwords, and --ntds extracts the domain database from a domain controller. Add --enabled to skip disabled accounts, which on an old domain can cut the output in half and keeps the noise out of your report.
Hashes are not passwords. Everything --sam and --ntds return still has to go through a cracking pass, which is where our Hashcat walkthrough picks up the workflow.
Kerberoasting Over LDAP
Service accounts with a registered SPN can hand you a crackable ticket hash from any authenticated domain user, no special privileges required:
nxc ldap 192.168.1.100 -u user -p pass --kerberoasting output.txtThe file fills with Kerberos 5 TGS-REP hashes ready for offline cracking. Service accounts are a reliable target because their passwords are set once at install time and frequently never rotated.
Running Commands
nxc smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -x whoami
nxc smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -X '$PSVersionTable'Lowercase -x runs a command through cmd, uppercase -X runs PowerShell. Underneath, three execution methods are tried in order: wmiexec over WMI, then atexec through the task scheduler, then smbexec by creating a service. If one fails the tool falls through to the next, which is why a command sometimes works on one host and not its identical neighbour. Pin the method with --exec-method when you need consistent behaviour for a report.
--sam dump is actually worth.
Modules Are Where nxc Gets Interesting
Beyond the built in flags, each protocol carries its own module library. List what is available and read a module's options before you run it:
nxc smb -L
nxc smb -M spider_plus --options
nxc smb 10.10.10.10 -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=TrueOptions use -o KEY=value, and you can stack several -M flags in one command. The module worth learning first is spider_plus, which crawls every readable share and builds a JSON inventory of the files it finds. Point it at a file server with the download flag off, read the inventory, then go back for the handful of files that matter. Blindly downloading a share is how you fill a disk and learn nothing.
Results also land in a local database you can query later with nxcdb. On an engagement spanning several days, that beats scrolling terminal history.
What These Commands Look Like to Defenders
Anyone running this tool on an assessment should know how visible it is, and anyone defending a network should know what to look for. Both sides read the same MITRE ATT&CK entry.
- Authentication volume. One source address authenticating to hundreds of hosts inside a minute has no legitimate equivalent. Event ID 4625 failures fanned across many accounts from a single IP is the spray signature.
- Service creation. The
smbexecmethod creates and runs a Windows service on the target. Event ID 7045 on a workstation is unusual and worth alerting on. - Scheduled task churn. The
atexecmethod registers a task, runs it, and deletes it. A task that appears and vanishes within seconds is a strong indicator. - Domain controller reads. A single non privileged account requesting service tickets for every SPN in the domain is Kerberoasting, and it is one of the easier attacks to catch if anyone is watching Event ID 4769.
Endpoint security products flag this tool by name, and Microsoft publishes a detection signature for it. On a real engagement expect the client's tooling to alert. That is the correct outcome in a protected environment, and a test that quietly succeeds against a mature network usually means the detection stack is misconfigured, which is itself a finding worth writing up. Our guide to network penetration testing covers how that reporting conversation fits into the wider engagement.
Legal and Ethical Considerations
Critical reminder: Always get explicit written authorization before testing any system. Password spraying against a domain you do not have permission to test is unauthorized access under computer misuse law in most jurisdictions, whether or not a single login succeeds.
This tool differs from a scanner in one important way: it authenticates. Nmap knocks on doors, NetExec tries the keys. That crosses a legal line that reconnaissance does not, and the failed attempts are logged with your source address either way.
Where This Is Fair Game
- Your own lab domain, built from evaluation copies of Windows Server on hardware you own
- Engagements covered by a signed scope document naming the target ranges and the accounts you may test
- Networks you administer, with your employer's documented approval
- Purpose built training environments and CTF platforms
Scope creep is the specific risk here. A CIDR range one digit wider than agreed can sweep a network belonging to a different business unit or a shared hosting neighbour. Read the target argument out loud before pressing enter, every time.
Frequently Asked Questions
Is CrackMapExec still maintained?
No. The CrackMapExec repository was archived by its owner on 6 December 2023 and is read only, so it receives no fixes or new features. NetExec is the maintained continuation, and Kali Linux replaced the old package with the netexec package.
What is the difference between CrackMapExec and NetExec?
NetExec is a community maintained fork of CrackMapExec that took over after the original project stopped. The command changed from crackmapexec to nxc, and the fork added protocols, modules and fixes. Core syntax and output format stayed close enough that old tutorials still apply.
How do I install NetExec on Kali Linux?
Run sudo apt update && sudo apt install netexec. Kali ships it in the standard repositories, currently at version 1.5.1, and installs the netexec, nxc and nxcdb commands. On other distributions use pipx to install from the project's GitHub repository.
What does Pwn3d! mean in the output?
It means the credentials can execute code on that host. On SMB and WMI the account is most likely a local administrator, on WinRM and RDP it indicates code execution at minimum, and on LDAP it indicates a path to domain admin. FTP performs no such check.
Which protocols does NetExec support?
Ten: SMB, LDAP, WinRM, MSSQL, SSH, FTP, WMI, RDP, VNC and NFS. Each has its own flags and modules, so nxc smb --help and nxc ldap --help return different option sets. SMB is the usual starting point on a Windows network.
Can I still find CrackMapExec tutorials useful?
Yes. Replace crackmapexec with nxc and most commands run unchanged, because flags like --shares, --pass-pol and --ntds carried over. Check the current documentation for anything that errors, since some options moved between protocols.
Your Next Steps
Learning how to use CrackMapExec today means installing NetExec, typing nxc, and applying the same three part syntax the original made famous. Get comfortable with four commands and you have covered most of what the tool does on an engagement: --shares to map what you can reach, --pass-pol to know your limits, a spray with --continue-on-success, and --ntds once an account comes back with (Pwn3d!). The NetExec wiki is the reference for everything past that.
Reading commands is not the same as running them against something that answers back. Get a foothold on a real internal network in the Internal lab, then build the surrounding methodology with the network penetration testing course. Both run in the browser on HackerDNA's free tier, no credit card and no lab VM required.
Part of the Penetration Testing series
Related articles:
