NetExec (nxc)

HTB machines where NetExec (nxc) is used

Taken from the chapters of IppSec videos where NetExec (nxc) shows up. The ▶ link jumps to the minute of that part.

Guides that use NetExec (nxc)

• Active Directory enumeration: users, LDAP, BloodHound and password spraying 4 min read What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.
• Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.
• SMB and NFS enumeration: shares, null sessions and files full of passwords 4 min read Enumerate SMB and NFS with NetExec, smbclient, smbmap and enum4linux-ng, with or without credentials: null sessions, files with passwords and no_root_squash.
• NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam 4 min read Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam.
• Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory 3 min read What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).
• Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit 4 min read Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup.
• Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync 4 min read What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA.
• MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft 3 min read Attack SQL Server in a domain: connect with mssqlclient, run commands with xp_cmdshell, escalate with EXECUTE AS, abuse linked servers and steal hashes.
• Passwords in Active Directory: GPP (Groups.xml), LAPS and gMSA 3 min read Three places where the domain itself stores passwords you can read: cpassword in Groups.xml, the LAPS local admin password and the hash of gMSA accounts.
• ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16) 4 min read Find vulnerable ADCS templates and CAs with Certipy and exploit ESC1, ESC4, ESC7, ESC8, ESC9 and ESC16, with the typical error for each case.