CrackMapExec

CrackMapExec (CME) is a post-exploitation “swiss army knife” for attacking Active Directory networks — originally by byt3bl33d3r, later maintained under Porchetta Industries, and now succeeded by the community fork NetExec (nxc), which is where active development happens. CME wraps impacket-style protocol libraries in a single CLI that sweeps entire subnets with credentials, enumerates shares, executes commands, and runs attack modules.

Credential spraying — the core pattern

Spray credentials across a network looking for SMB shares that can be logged in to:

crackmapexec smb $BROADCAST/$SUBNET_MASK -u $USERNAME -p $PASSWORD

Output marks each host with a compact status:

• [+] — valid credentials
• [+] (Pwn3d!) — valid credentials with local admin rights — the host is immediately actionable for share access and command execution
• [-] — authentication failed

This makes CME the standard tool for validating a cracked or phished password against an entire estate in one shot — and the reason it appears in nearly every internal-pentest workflow alongside enum4linux-derived user lists.

Beyond spraying

Capability	Flag / form
Pass-the-hash	-H $NTLM_HASH (see ntlm-relay-attacks)
Command execution	-x $CMD (cmd) or -X $PS_CMD (PowerShell), via WMI/atexec/smbexec methods
Share/user/group enumeration	--shares, --users, --groups, --pass-pol
SAM/LSA dumping	--sam, --lsa (with admin)
Modules	-M mimikatz, -M lsassy, -M zerologon, etc.
Other protocols	ldap, mssql, winrm, ssh, rdp in place of smb

Domain authentication uses -d $DOMAIN; local-account authentication (which also bypasses some UAC token-filtering issues described in windows-remote-management) uses --local-auth.

Notes

• Use nxc for new work: NetExec is a drop-in replacement (nxc smb ... with the same flags); CME 5.x is archived. Most writeups and detection signatures still say “crackmapexec,” so the name persists.
• Detection: spraying produces bursts of EID 4624/4625 logon events across many hosts from a single source — one of the noisiest possible authentication patterns. --jitter and targeted (non-subnet) lists reduce the blast radius; defenders should alert on exactly this fan-out.
• For single-host interactive share work, smbclient and smbmap are lighter-weight; CME’s value is the sweep.

Sources

• Pennyw0rth/NetExec — GitHub
• Porchetta-Industries/CrackMapExec — GitHub (archived)
• MITRE ATT&CK T1021.002 — SMB/Windows Admin Shares

Related: smbclient, smbmap, enum4linux, ntlm-relay-attacks, windows-remote-management, evil-winrm