Netexec

Netexec

Purpose

Use this skill for tightly scoped credential and service validation in approved internal environments.

Phase Fit

• Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
• Secondary: Retest and Closure

Use When

• Need to validate what approved credentials can access over SMB or WinRM.
• Need to confirm privilege boundaries or share exposure.
• Need a repeatable internal retest after hardening changes.

Avoid When

• Credentials or lockout thresholds are unclear.
• Broad lateral-movement style testing is not explicitly approved.

Inputs

• Approved targets and protocol
• Authorized credential set
• Lockout, alerting, and stop-condition guidance

Procedure

1. Start with the smallest target set and protocol required.
2. Validate basic access before attempting deeper checks.
3. Capture only the minimum evidence needed to show the boundary failure.
4. Stop immediately if lockouts or unexpected privilege changes occur.
5. Preserve the exact protocol and host set for retest.

Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

# SMB null session check across a subnet
netexec smb 10.10.10.0/24

# SMB enumeration with credentials
netexec smb 10.10.10.0/24 -u auditor -p '<password>' -d contoso.com --shares

# Pass-the-Hash
netexec smb 10.10.10.0/24 -u administrator -H <NTLM_hash> -d contoso.com

# Enumerate domain users via SMB
netexec smb 10.10.10.10 -u auditor -p '<password>' -d contoso.com --users

# Execute a command
netexec smb 10.10.10.100 -u auditor -p '<password>' -d contoso.com -x "whoami"

# WinRM access check
netexec winrm 10.10.10.100 -u auditor -p '<password>'

# RDP credential check
netexec rdp 10.10.10.100 -u auditor -p '<password>'

Evidence to Capture

• Accessible shares or services tied to the tested credential set
• Boundary failures that enable privilege or data exposure
• Exact host and protocol context for retest

Safety Boundaries

• Keep the target set narrow and rate aware.
• Do not expand to credential spraying or broad auth testing without explicit approval.