# Offensive Netexec

Use this skill whenever the user asks about NetExec (nxc), a network exploitation and...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-netexec -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-netexec -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-netexec -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-netexec -g -a gemini-cli -y`

## Description

Use this skill whenever the user asks about NetExec (nxc), a network exploitation and post-exploitation tool for Active Directory environments. Triggers include: any mention of 'nxc', 'netexec', 'crackmapexec' successor questions, AD enumeration, SMB/LDAP/WinRM/MSSQL/SSH/RDP/VNC/WMI/FTP/NFS protocol attacks, password spraying, credential dumping (SAM, NTDS, LSASS, DPAPI), Kerberoasting, ASREPRoasting, lateral movement, BloodHound collection, module usage, or any pentest workflow involving Windows domain environments. This skill covers ALL protocols, ALL modules, and ALL core features of NetExec. Always provide full command examples with correct flags and options.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# NetExec (nxc), Reference Skill

## Global Syntax & Options

```
nxc <protocol> <target(s)> [auth options] [action options] [global options]
```

### Available Protocols
`smb` `ssh` `ldap` `ftp` `wmi` `winrm` `rdp` `vnc` `mssql` `nfs`

### Target Formats
```bash
nxc smb 192.168.1.0/24          # CIDR
nxc smb 192.168.1.1 192.168.1.2 # Multiple IPs
nxc smb 192.168.1.1-28          # IP range
nxc smb dc01.corp.local         # Hostname
nxc smb ~/targets.txt           # File
```

### Global Flags
| Flag | Description |
|------|-------------|
| `-t THREADS` | Concurrent threads (default: 100) |
| `--timeout TIMEOUT` | Per-thread timeout in seconds |
| `--jitter INTERVAL` | Random delay between connections (e.g. `3`, `2-5`, `4-4`) |
| `--no-progress` | Suppress progress bar |
| `--verbose` | Verbose output |
| `--debug` | Debug-level output |

---

## Authentication

### Core Auth Flags
```bash
-u USERNAME          # Single username
-u user1 user2       # Multiple usernames
-u ~/users.txt       # Username file

-p PASSWORD          # Plaintext password
-p 'P@ss!'           # Always quote special chars
-p='-P@ss'           # Use = for passwords starting with -

-H 'NTHASH'          # NT hash only
-H 'LM:NT'           # Full NTLM hash
-H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

-id <cred_id>        # Use credential from nxcdb

--local-auth         # Authenticate as local user (not domain)
```

### Domain Auth (SMB example)
```bash
nxc smb 192.168.1.0/24 -u Administrator -p 'Password123'
nxc smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'
```

### Local Auth
```bash
nxc smb 192.168.1.0/24 -u localadmin -p 'Password123' --local-auth
```

### Kerberos Auth
```bash
# Auto-handle TGT using password
nxc smb dc01.corp.local -u user -p pass -k

# Use existing ccache ticket
export KRB5CCNAME=/path/to/ticket.ccache
nxc smb dc01.corp.local --use-kcache

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/active-directory/offensive-netexec/SKILL.md