Offensive Netexec
Use this skill whenever the user asks about NetExec (nxc), a network exploitation and...
Install
npx skills add SnailSploit/Claude-Red --skill offensive-netexec -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Security
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Use this skill whenever the user asks about NetExec (nxc), a network exploitation and post-exploitation tool for Active Directory environments. Triggers include: any mention of 'nxc', 'netexec', 'crackmapexec' successor questions, AD enumeration, SMB/LDAP/WinRM/MSSQL/SSH/RDP/VNC/WMI/FTP/NFS protocol attacks, password spraying, credential dumping (SAM, NTDS, LSASS, DPAPI), Kerberoasting, ASREPRoasting, lateral movement, BloodHound collection, module usage, or any pentest workflow involving Windows domain environments. This skill covers ALL protocols, ALL modules, and ALL core features of NetExec. Always provide full command examples with correct flags and options.
NetExec (nxc), Reference Skill
Global Syntax & Options
nxc <protocol> <target(s)> [auth options] [action options] [global options]
Available Protocols
smb ssh ldap ftp wmi winrm rdp vnc mssql nfs
Target Formats
nxc smb 192.168.1.0/24 # CIDR
nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs
nxc smb 192.168.1.1-28 # IP range
nxc smb dc01.corp.local # Hostname
nxc smb ~/targets.txt # File
Global Flags
| Flag | Description |
|---|---|
-t THREADS | Concurrent threads (default: 100) |
--timeout TIMEOUT | Per-thread timeout in seconds |
--jitter INTERVAL | Random delay between connections (e.g. 3, 2-5, 4-4) |
--no-progress | Suppress progress bar |
--verbose | Verbose output |
--debug | Debug-level output |
Authentication
Core Auth Flags
-u USERNAME # Single username
-u user1 user2 # Multiple usernames
-u ~/users.txt # Username file
-p PASSWORD # Plaintext password
-p 'P@ss!' # Always quote special chars
-p='-P@ss' # Use = for passwords starting with -
-H 'NTHASH' # NT hash only
-H 'LM:NT' # Full NTLM hash
-H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'
-id <cred_id> # Use credential from nxcdb
--local-auth # Authenticate as local user (not domain)
Domain Auth (SMB example)
nxc smb 192.168.1.0/24 -u Administrator -p 'Password123'
nxc smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'
Local Auth
nxc smb 192.168.1.0/24 -u localadmin -p 'Password123' --local-auth
Kerberos Auth
# Auto-handle TGT using password
nxc smb dc01.corp.local -u user -p pass -k
# Use existing ccache ticket
export KRB5CCNAME=/path/to/ticket.ccache
nxc smb dc01.corp.local --use-kcache
