moving-laterally-with-netexec - Lateral Movement with NetExec for Penetration Testing
Use NetExec to enumerate SMB, WinRM, LDAP, and MSSQL services, spray passwords, execute commands, and dump credentials on authorized targets.
Tags
Updated: 2026-06-30Capabilities
Typical Inputs
Typical Outputs
What this skill does
- validate credentials across hosts
- enumerate SMB shares and users
- enumerate password policy via LDAP
- spray passwords under lockout threshold
- execute commands on remote hosts
- dump SAM hashes from hosts
- dump LSA secrets from hosts
- dump NTDS credentials from domain controller
- perform Kerberoasting via LDAP
- perform ASREPRoasting via LDAP
- retrieve LAPS passwords via LDAP
- collect BloodHound data via LDAP
- execute SQL queries on MSSQL
- log results to SQLite workspace
Inputs
- valid credentials or NT hashes or Kerberos tickets
- target host range or subnet
- user list file
- target network ports (SMB, WinRM, LDAP, MSSQL)
- authorized scope and rules of engagement
Outputs
- credential validation results with Pwn3d markers
- enumerated shares, users, and password policy
- SAM, LSA, and NTDS credential dumps
- remote command execution output
- BloodHound collection files
- SQLite workspace logs
Requirements
- Linux operator host (Kali, Parrot, or Ubuntu)
- NetExec (nxc) installed via pipx or Docker
- network reachability to target ports 445, 5985-5986, 389-636, 1433
- valid credentials within authorized scope
- account-lockout policy reviewed before spraying