Analyzing NetExec

NetExec (nxc) is the modern successor to CrackMapExec, providing a unified network pentesting framework for Windows and Active Directory environments. The codebase demonstrates a modular architecture with protocol-specific implementations sharing common authentication and database infrastructure.

Architecture Overview

netexec.py (CLI entry)
    ├── cli.py (argparse + protocol subcommands)
    ├── connection.py (base connection class)
    ├── database.py (SQLAlchemy base)
    ├── nxcdb.py (database navigator/CLI)
    └── protocols/
        ├── smb/   (SMB with smbexec, wmiexec, atexec)
        ├── ldap/  (LDAP/LDAPS enumeration)
        ├── mssql/ (MSSQL interaction)
        ├── ssh/   (SSH command execution)
        ├── rdp/   (RDP with NLA detection)
        ├── wmi/   (WMI via DCOM)
        ├── winrm/ (WinRM/PSRemoting)
        ├── vnc/   (VNC screenshot/hash dump)
        ├── nfs/   (NFS enumeration)
        └── ftp/   (FTP anonymous access)

Protocol Modules

SMB (nxc/protocols/smb/)

The most comprehensive module. Features include:

• Authentication: NTLM, Kerberos, certificate-based (PFX/PEM)
• Execution methods: smbexec, wmiexec, atexec, ptesexec, srvsync
• Enumeration: shares, sessions, loggedon users, local groups, domains
• Credential dumping: SAM, LSA, SYSTEM hive, NTDS.dit
• Vulnerability checks: Spooler, Zerologon, PetitPotam, SMB signing
• Database: Custom tables for hosts, shares, admin relations

Key file: nxc/protocols/smb/__init__.py (2,452 lines) contains the main SMB protocol class.

LDAP (nxc/protocols/ldap/)

• Authentication: NTLM, Kerberos, LDAPS
• Enumeration: users, groups, computers, GPOs, trusts
• BloodHound integration: add_user_bh() for AD attack path analysis
• ACL/DACL enumeration: daclread.py module for permission analysis

MSSQL (nxc/protocols/mssql/)

• Interactive SQL shell with command execution
• Linked query enumeration and execution
• Kerberos authentication support

SSH (nxc/protocols/ssh/)

Using Paramiko for SSH connections. Supports:

• Public-key and password authentication
• Command execution and output retrieval
• Context manager for proper session cleanup

RDP (nxc/protocols/rdp/)

Uses aardwolf library for RDP protocol:

• NLA detection: Checks Network Level Authentication support
• Protocol negotiation: SSL, RDP, Hybrid, Hybrid+EX modes
• Clipboard and video capture support
• Kerberos/NTLM credential support

WMI (nxc/protocols/wmi/)

• DCOM-based WMI connection via impacket.dcerpc.v5.dcomrt
• Execution methods: wmiexec, wmiexec-event
• Volume shadow copy listing via list_snapshots()
• WQL query execution with callback support

WinRM (nxc/protocols/winrm/)

• PSRemoting via WinRM protocol
• PowerShell command execution
• Kerberos and NTLM authentication

Credential Storage

Database Schema

NetExec uses SQLite with SQLAlchemy ORM. Each protocol maintains its own database file at ~/.nxc/workspaces/<workspace>/<proto>.db.

Core Tables:

# From nxc/protocols/smb/database.py
class Host:
    ip, hostname, domain, os, dc, smbv1, signing, spooler, zerologon, petitpotam
 
class User:
    domain, username, password, credtype, pillaged_from_hostid
 
class AdminRelation:
    userid → User.id, hostid → Host.id  # Who has admin on what
 
class Share:
    hostid, userid, name, remark, read, write

Credential Types: hash, password, key, ticket, cert, cache

Workspace Management

• Workspaces isolated in ~/.nxc/workspaces/<name>/
• Per-protocol databases: smb.db, ldap.db, mssql.db, etc.
• nxcdb.py provides interactive database navigator with export commands

Module System

Module Structure

Modules in nxc/modules/ inherit from a NXCModule base class. Each module must define:

name = "module_name"           # Must match filename.py
description = "What it does"
category = CATEGORY.ENUMERATION  # or CREDENTIAL_DUMPING, PRIVILEGE_ESCALATION
supported_protocols = ["smb", "ldap", "mssql"]
 
def options(module, context, params):
    """Module configuration"""
    pass
 
def on_login(context, connection):
    """Run after successful login"""
    pass
 
# Optional: for admin-only modules
def on_admin_login(context, connection):
    """Run after admin-level login"""
    pass

Module Loader (nxc/loaders/moduleloader.py)

• Validates module structure (name, description, category, supported_protocols)
• Initializes Context object with db, logger, args
• Parses -o KEY=VALUE options into module_options dict

Module Categories

131 modules available including:

• Enumeration: get-domain_user.py, get-domain_computer.py, get-domain_group.py
• Credential Dumping: sam.py, lsa.py, dpapi_hash.py, mimikatz.py
• PrivEsc: bloodhound.py, uac.py, alwaysinstallelevated.py
• Persistence: add-computer.py, add-domain-group-members.py
• C2 Integration: empire_exec.py for PowerShell agent deployment

Protocol Negotiation

Authentication Flow

1. Args parsing: cli.py loads all auth options (password, hash, kerberos, cert)
2. Protocol selection: Subparser determines protocol module to load
3. Credential iteration: For each user+password combo, attempt login
4. Auth methods per protocol:
   • SMB: NTLM SSP → Kerberos → Certificate
   • LDAP: Simple bind → NTLM → Kerberos
   • RDP: NLA detection → NTLM/Kerberos → CredSSP
   • WMI: DCOM → NTLMSSP → Kerberos

Kerberos Support

• ccache file loading via KRB5CCNAME
• AES key support (128/256 bits)
• KDC host auto-resolution from domain
• Ticket extraction and reuse

Credential Reuse

# From connection.py
def create_conn_obj(self):
    """Protocol-specific connection factory"""
    pass
 
def plaintext_login(self, domain, username, password):
    """NTLM/cleartext auth"""
    pass
 
def hash_login(self, domain, username, ntlm_hash):
    """Pass-the-hash support"""
    pass
 
def kerberos_login(self, domain, username, password="", aesKey="", kdcHost=""):
    """Kerberos auth from ccache or keys"""
    pass

Output Formatting

CLI Output

• AsciiTable: from terminaltables3 import AsciiTable for aligned output
• Color coding: from termcolor import colored for success/fail/debug states
• NXCAdapter: Custom logger wrapper with context (protocol, host, hostname, module)

self.logger.success("Pwned!")   # Green
self.logger.fail("Failed")       # Red
self.logger.debug("Info")        # Gray
self.logger.highlight("Data")    # Yellow

Export Formats

• CSV: Semicolon-delimited with QUOTE_ALL
• List: Simple line-by-line (for IPs, hashes)
• Empire: JSON API integration

C2 Integration

Empire API (nxcdb.py)

def do_import(self, line):
    if line == "empire":
        # POST to /api/admin/login
        # GET /api/creds with token
        # Import: credtype, domain, username, password

Supports importing credentials from Empire’s REST API into NetExec’s database for lateral movement.

PowerShell Execution

• Modules like empire_exec.py generate PowerShell one-liners for agent deployment
• web_delivery.py for download cradle execution

Key Dependencies

Library	Purpose
impacket	SMB, DCOM, RPC, Kerberos protocol implementations
bloodhound	AD attack path analysis
dploot	DPAPI credential extraction
paramiko	SSH protocol
aardwolf	RDP protocol with NLA
asyauth	NTLM/Kerberos authentication primitives
sqlalchemy	Database ORM

Configuration

• Global config: ~/.nxc/nxc.conf (INI format)
• Module path: ~/.nxc/modules/ (user-extensible)
• Workspaces: ~/.nxc/workspaces/<name>/
• Environment: NXC_PATH overrides default config location

Security Considerations

• Credential handling: Passwords stored in memory during execution, not persisted unencrypted
• Hash caching: NTLM hashes can be reused for PtH attacks
• Kerberos ticket caching: TGT/TGS stored in ccache format
• SAM/LSA extraction: Raw registry hive reads requiring SYSTEM privileges
• NTDS.dit parsing: Domain credential database extraction from DC

Conclusion

NetExec provides a robust, extensible framework for network pentesting with comprehensive protocol support and modular architecture. The codebase is well-organized with clear separation between core infrastructure, protocol implementations, and post-exploitation modules. Its SQLite-based credential storage and workspace management enable efficient assessment workflows across large environments.