offensive-netexec

1# NetExec (nxc) — Reference Skill
2 
3## Global Syntax & Options
4 
5```
6nxc <protocol> <target(s)> [auth options] [action options] [global options]
7```
8 
9### Available Protocols
10`smb` `ssh` `ldap` `ftp` `wmi` `winrm` `rdp` `vnc` `mssql` `nfs`
11 
12### Target Formats
13```bash
14nxc smb 192.168.1.0/24          # CIDR
15nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs
16nxc smb 192.168.1.1-28          # IP range
17nxc smb dc01.corp.local         # Hostname
18nxc smb ~/targets.txt           # File
19```
20 
21### Global Flags
22| Flag | Description |
23|------|-------------|
24| `-t THREADS` | Concurrent threads (default: 100) |
25| `--timeout TIMEOUT` | Per-thread timeout in seconds |
26| `--jitter INTERVAL` | Random delay between connections (e.g. `3`, `2-5`, `4-4`) |
27| `--no-progress` | Suppress progress bar |
28| `--verbose` | Verbose output |
29| `--debug` | Debug-level output |
30 
31---
32 
33## Authentication
34 
35### Core Auth Flags
36```bash
37-u USERNAME          # Single username
38-u user1 user2       # Multiple usernames
39-u ~/users.txt       # Username file
40 
41-p PASSWORD          # Plaintext password
42-p 'P@ss!'           # Always quote special chars
43-p='-P@ss'           # Use = for passwords starting with -
44 
45-H 'NTHASH'          # NT hash only
46-H 'LM:NT'           # Full NTLM hash
47-H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'
48 
49-id <cred_id>        # Use credential from nxcdb
50 
51--local-auth         # Authenticate as local user (not domain)
52```
53 
54### Domain Auth (SMB example)
55```bash
56…