E-CRA
crackmapexec
Swiss-army-knife tool for validating credentials and enumerating access across many Windows/AD hosts at once over SMB, WinRM, MSSQL, and LDAP.
OVERVIEW
CrackMapExec (byt3bl33d3r/CrackMapExec) was the original Swiss-army-knife tool for AD pentesting: point it at a subnet or host list with a password, NTLM hash, or Kerberos ticket, and it reports which hosts accept it over SMB, WinRM, MSSQL, or LDAP, while also enumerating shares, sessions, and domain users along the way. The upstream repository is archived and no longer receives updates.
Its actively maintained continuation is NetExec (Pennyw0rth/NetExec, binary `nxc`, https://github.com/Pennyw0rth/NetExec), a compatible fork that carries the same command syntax and module system forward with new protocols and modules. This entry keeps the name "crackmapexec" because that is how the tool is still commonly referenced across engagement notes and other tooling, but anyone installing fresh today should get NetExec, not the archived original.
USE CASES
Practical use cases
- 01
Spraying one known-good credential (password, hash, or ticket) across an entire subnet to find every host it authenticates on.
- 02
Enumerating SMB shares, sessions, and logged-on users across many hosts in a single pass instead of one at a time.
- 03
Pulling domain user and group lists via LDAP once any domain-authenticated foothold exists.
- 04
Chaining a validated credential into a module (e.g. a Mimikatz or secretsdump-style dump) executed remotely over WinRM or SMB.
QUICK START
With one or more candidate credentials (password, hash, or ticket) already in hand, to check where they work across an entire Windows/AD network at once.
- Confirm the credential in hand and the target range are both in scope for this level of access.
- Install NetExec (pip install netexec, or pipx) — the maintained continuation of this tool.
- Run it against the target range over the relevant protocol (SMB, WinRM, MSSQL, or LDAP) with the credential.
- Review which hosts return a valid authentication (typically marked in green) and note them for follow-up.
- Layer in an enumeration or execution module only once the client has authorized that level of activity.
nxc smb 10.10.10.0/24 -u jdoe -H <ntlm_hash>BEFORE YOU RUN IT
What to check before running it
The original byt3bl33d3r/CrackMapExec repository is archived; install NetExec (Pennyw0rth/NetExec) instead of relying on the unmaintained original for anything beyond historical reference.
Spraying a credential across an entire subnet is loud on EDR- and SIEM-monitored networks — authentication attempts against dozens of hosts from one source in a short window is a well-known detection pattern.
A successful hit is proof credential reuse works, not permission to pivot further: keep any follow-on module use inside the scope and authorization already agreed with the client.