On this page 33 sections
  1. What CrackMapExec does
  2. Target syntax
  3. Username and password authentication
  4. Password lists
  5. NTLM hash authentication
  6. SMB — identify hosts
  7. SMB — authenticated access
  8. SMB — list shares
  9. SMB — enumerate users
  10. SMB — enumerate groups
  11. SMB — logged-on users
  12. SMB — password policy
  13. SMB — RID brute-force enumeration
  14. SMB — execute a command
  15. SMB — PowerShell execution
  16. SMB — modules
  17. WinRM — test authentication
  18. WinRM — command execution
  19. LDAP — connect to a domain controller
  20. LDAP — enumerate users
  21. LDAP — enumerate groups
  22. LDAP — password policy
  23. LDAP — trusted domains
  24. MSSQL — test authentication
  25. MSSQL — execute SQL query
  26. MSSQL — execute operating-system command
  27. SSH — test authentication
  28. SSH — command execution
  29. Custom ports
  30. Continue after successful login
  31. Useful output filters
  32. Protocol help
  33. CrackMapExec and NetExec
Lab use only. Apply these techniques only to systems you own or have explicit permission to test.
01

What CrackMapExec does

CrackMapExec, commonly abbreviated as CME, is a post-exploitation and network assessment tool used to interact with services such as SMB, WinRM, LDAP, MSSQL and SSH. It is especially common in Windows and Active Directory labs.

Use these commands only against systems you own or are explicitly authorized to test.

Show available protocols
crackmapexec --help
Show service-specific options
crackmapexec smb --help
02

Target syntax

Targets can be single hosts, CIDR networks or files containing one target per line.

Single host
crackmapexec smb 10.10.10.20
Network range
crackmapexec smb 10.10.10.0/24
Targets from file
crackmapexec smb targets.txt
03

Username and password authentication

-u specifies the username and -p specifies the password. A domain can be supplied with -d when authenticating to Active Directory.

Local or workgroup account
crackmapexec smb 10.10.10.20 -u administrator -p 'Password123!'
Domain account
crackmapexec smb 10.10.10.20 -d corp.local -u samir -p 'Password123!'
Local authentication
crackmapexec smb 10.10.10.20 -u administrator -p 'Password123!' --local-auth
04

Password lists

CME can accept username and password files. This is useful in authorized password-auditing labs.

Username list
crackmapexec smb 10.10.10.20 -u users.txt -p 'Password123!'
Password list
crackmapexec smb 10.10.10.20 -u samir -p passwords.txt
Username and password lists
crackmapexec smb 10.10.10.20 -u users.txt -p passwords.txt
05

NTLM hash authentication

For protocols that support NTLM authentication, CME can authenticate using an NTLM hash instead of the plaintext password.

Authenticate with NTLM hash
crackmapexec smb 10.10.10.20 -u administrator -H '<NTLM_HASH>'
Domain authentication with hash
crackmapexec smb 10.10.10.20 -d corp.local -u administrator -H '<NTLM_HASH>'
06

SMB — identify hosts

SMB mode can identify Windows hosts, domains, SMB signing state and SMBv1 support.

Enumerate SMB host information
crackmapexec smb 10.10.10.0/24
07

SMB — authenticated access

Valid credentials can be checked across one or more SMB targets.

Test credentials
crackmapexec smb 10.10.10.20 -u samir -p 'Password123!'
Test credentials across subnet
crackmapexec smb 10.10.10.0/24 -d corp.local -u samir -p 'Password123!'
08

SMB — list shares

--shares lists SMB shares visible to the authenticated account together with available permissions.

Enumerate shares
crackmapexec smb 10.10.10.20 -u samir -p 'Password123!' --shares
Enumerate shares with domain account
crackmapexec smb 10.10.10.20 -d corp.local -u samir -p 'Password123!' --shares
09

SMB — enumerate users

--users enumerates domain users when the target and account permissions allow it.

Enumerate users
crackmapexec smb 10.10.10.20 -d corp.local -u samir -p 'Password123!' --users
10

SMB — enumerate groups

--groups lists groups visible through SMB or domain enumeration.

Enumerate groups
crackmapexec smb 10.10.10.20 -d corp.local -u samir -p 'Password123!' --groups
11

SMB — logged-on users

--loggedon-users attempts to enumerate users currently logged on to the target.

Show logged-on users
crackmapexec smb 10.10.10.20 -u administrator -p 'Password123!' --loggedon-users
12

SMB — password policy

--pass-pol retrieves domain password-policy information when available.

Show password policy
crackmapexec smb 10.10.10.20 -d corp.local -u samir -p 'Password123!' --pass-pol
13

SMB — RID brute-force enumeration

--rid-brute enumerates accounts by querying Windows RIDs. This can reveal users and groups when normal enumeration is restricted.

RID enumeration
crackmapexec smb 10.10.10.20 -u samir -p 'Password123!' --rid-brute
14

SMB — execute a command

With sufficient administrative privileges, -x can execute a command through the SMB execution methods supported by CME.

Execute whoami
crackmapexec smb 10.10.10.20 -u administrator -p 'Password123!' -x "whoami"
Show hostname
crackmapexec smb 10.10.10.20 -u administrator -p 'Password123!' -x "hostname"
15

SMB — PowerShell execution

-X executes a PowerShell command when supported by the target and permissions.

PowerShell hostname query
crackmapexec smb 10.10.10.20 -u administrator -p 'Password123!' -X '$env:COMPUTERNAME'
16

SMB — modules

CME includes protocol-specific modules. -L lists available modules and -M selects one.

List SMB modules
crackmapexec smb -L
Show module options
crackmapexec smb -M MODULE_NAME --options
Run a module
crackmapexec smb 10.10.10.20 -u administrator -p 'Password123!' -M MODULE_NAME
17

WinRM — test authentication

WinRM is commonly exposed on TCP 5985 for HTTP and 5986 for HTTPS. CME can verify whether credentials provide WinRM access.

Password authentication
crackmapexec winrm 10.10.10.20 -u administrator -p 'Password123!'
Domain authentication
crackmapexec winrm 10.10.10.20 -d corp.local -u samir -p 'Password123!'
NTLM hash authentication
crackmapexec winrm 10.10.10.20 -u administrator -H '<NTLM_HASH>'
18

WinRM — command execution

If the account has the required WinRM permissions, commands can be executed remotely.

Execute whoami
crackmapexec winrm 10.10.10.20 -u administrator -p 'Password123!' -x "whoami"
Execute ipconfig
crackmapexec winrm 10.10.10.20 -u administrator -p 'Password123!' -x "ipconfig"
19

LDAP — connect to a domain controller

LDAP mode is useful for Active Directory enumeration. The target is normally a domain controller.

LDAP authentication
crackmapexec ldap 10.10.10.10 -d corp.local -u samir -p 'Password123!'
LDAP authentication with hash
crackmapexec ldap 10.10.10.10 -d corp.local -u samir -H '<NTLM_HASH>'
20

LDAP — enumerate users

List domain users
crackmapexec ldap 10.10.10.10 -d corp.local -u samir -p 'Password123!' --users
21

LDAP — enumerate groups

List domain groups
crackmapexec ldap 10.10.10.10 -d corp.local -u samir -p 'Password123!' --groups
22

LDAP — password policy

Show domain password policy
crackmapexec ldap 10.10.10.10 -d corp.local -u samir -p 'Password123!' --pass-pol
23

LDAP — trusted domains

Enumerate domain trusts
crackmapexec ldap 10.10.10.10 -d corp.local -u samir -p 'Password123!' --trusted-for-delegation
24

MSSQL — test authentication

MSSQL mode checks Microsoft SQL Server authentication using Windows or SQL credentials depending on the environment.

Windows authentication
crackmapexec mssql 10.10.10.30 -d corp.local -u samir -p 'Password123!'
Local authentication
crackmapexec mssql 10.10.10.30 -u sa -p 'Password123!' --local-auth
NTLM hash authentication
crackmapexec mssql 10.10.10.30 -d corp.local -u samir -H '<NTLM_HASH>'
25

MSSQL — execute SQL query

-q executes a SQL query against the target after successful authentication.

Show SQL Server version
crackmapexec mssql 10.10.10.30 -u sa -p 'Password123!' --local-auth -q "SELECT @@VERSION"
Show current database
crackmapexec mssql 10.10.10.30 -u sa -p 'Password123!' --local-auth -q "SELECT DB_NAME()"
List databases
crackmapexec mssql 10.10.10.30 -u sa -p 'Password123!' --local-auth -q "SELECT name FROM sys.databases"
26

MSSQL — execute operating-system command

When the SQL Server account and server configuration allow it, CME can request operating-system command execution through MSSQL.

Execute whoami
crackmapexec mssql 10.10.10.30 -u sa -p 'Password123!' --local-auth -x "whoami"
27

SSH — test authentication

SSH mode verifies credentials against SSH services, typically on TCP port 22.

Password authentication
crackmapexec ssh 10.10.10.40 -u samir -p 'Password123!'
Test account across network
crackmapexec ssh 10.10.10.0/24 -u samir -p 'Password123!'
28

SSH — command execution

With valid SSH credentials, CME can execute commands on the remote system.

Execute whoami
crackmapexec ssh 10.10.10.40 -u samir -p 'Password123!' -x "whoami"
Show system information
crackmapexec ssh 10.10.10.40 -u samir -p 'Password123!' -x "uname -a"
29

Custom ports

Some protocol implementations allow a custom destination port to be specified with --port.

SMB on custom port
crackmapexec smb 10.10.10.20 --port 445 -u samir -p 'Password123!'
SSH on custom port
crackmapexec ssh 10.10.10.40 --port 2222 -u samir -p 'Password123!'
30

Continue after successful login

By default, credential testing behavior may stop after a successful combination depending on the protocol and version. --continue-on-success continues testing additional combinations.

Continue testing credentials
crackmapexec smb 10.10.10.20 -u users.txt -p passwords.txt --continue-on-success
31

Useful output filters

CME output can be combined with standard Linux tools when working through larger lab networks.

Show successful logins
crackmapexec smb 10.10.10.0/24 -u samir -p 'Password123!' | grep "[+]"
Save command output
crackmapexec smb 10.10.10.0/24 -u samir -p 'Password123!' | tee cme-results.txt
32

Protocol help

CME versions differ in the options exposed by each protocol. Checking the built-in help is the fastest way to verify supported flags.

SMB help
crackmapexec smb --help
WinRM help
crackmapexec winrm --help
LDAP help
crackmapexec ldap --help
MSSQL help
crackmapexec mssql --help
SSH help
crackmapexec ssh --help
33

CrackMapExec and NetExec

CrackMapExec is the older project name commonly found in training material, writeups and labs. Many newer environments use NetExec, whose command is typically nxc and whose syntax is largely derived from CrackMapExec.

Equivalent NetExec example
nxc smb 10.10.10.20 -u samir -p 'Password123!' --shares