offensive-netexec

# NetExec (nxc) — Reference Skill ## Global Syntax & Options ``` nxc <protocol> <target(s)> [auth options] [action options] [global options] ``` ### Available Protocols `smb` `ssh` `ldap` `ftp` `wmi` `winrm` `rdp` `vnc` `mssql` `nfs` ### Target Formats ```bash nxc smb 192.168.1.0/24 # CIDR nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs nxc smb 192.168.1.1-28 # IP range nxc smb dc01.corp.local # Hostname nxc smb ~/targets.txt # File ``` ### Global Flags | Flag | Description | |------|-------------| | `-t THREADS` | Concurrent threads (default: 100) | | `--timeout TIMEOUT` | Per-thread timeout in seconds | | `--jitter INTERVAL` | Random delay between connections (e.g. `3`, `2-5`, `4-4`) | | `--no-progress` | Suppress progress bar | | `--verbose` | Verbose output | | `--debug` | Debug-level output | --- ## Authentication ### Core Auth Flags ```bash -u USERNAME # Single username -u user1 user2 # Multiple usernames -u ~/users.txt # Username file -p PASSWORD # Plaintext password -p 'P@ss!' # Always quote special chars -p='-P@ss' # Use = for passwords starting with - -H 'NTHASH' # NT hash only -H 'LM:NT' # Full NTLM hash -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH' -id <cred_id> # Use credential from nxcdb --local-auth # Authenticate as local user (not domain) ``` ### Domain Auth (SMB example) ```bash nxc smb 192.168.1.0/24 -u Administrator -p 'Passwor...