Post Exploitation
CrackMapExec (CME) is a post-exploitation tool for pentesting Windows and Active Directory networks. It can enumerate users, spray passwords, execute commands, and move laterally.
sudo apt install crackmapexec
crackmapexec <protocol> <target> [options]
CrackMapExec is a post-exploitation tool that automates the assessment of Windows Active Directory networks. It provides a comprehensive suite for enumerating hosts, spraying passwords, executing commands, and moving laterally across domains.
With modular protocol support and color-coded output, CME is the go-to tool for red teams and pentesters performing large-scale Active Directory security assessments.
crackmapexec smb 192.168.1.0/24Sweep a subnet for SMB hosts and show OS, hostname and signingcrackmapexec smb 10.10.10.10 -u <USER> -p <PASS>Authenticate to a host over SMB with a username and passwordcrackmapexec smb 10.10.10.10 -u <USER> -p <PASS> -d example.comAuthenticate with an explicit domaincrackmapexec smb 10.10.10.10 -u <USER> -H <NTHASH>Pass-the-hash authentication using an NT hashcrackmapexec smb 192.168.1.0/24 -u <USER> -p <PASS> --local-authAuthenticate against local (non-domain) accountscrackmapexec smb 10.10.10.10 -u users.txt -p passwords.txtTest a list of usernames and passwords for valid credentialscrackmapexec smb 192.168.1.0/24 -u <USER> -p passwords.txt --continue-on-successPassword-spray and keep going after the first valid hitcrackmapexec smb 10.10.10.10 -u <USER> -p <PASS> --sharesList shares and the current user's read/write accesscrackmapexec smb 10.10.10.10 -u <USER> -p <PASS> --sessionsList active SMB sessions on the targetcrackmapexec smb 10.10.10.10 -u <USER> -p <PASS> --loggedon-usersShow users currently logged on to the hostcrackmapexec smb 10.10.10.10 -u <USER> -p <PASS> --usersEnumerate domain userscrackmapexec smb 10.10.10.10 -u <USER> -p <PASS> --groupsEnumerate domain groupscrackmapexec smb 10.10.10.10 -u <USER> -p <PASS> --pass-polDump the account/password policycrackmapexec smb 10.10.10.10 -u '' -p '' --rid-bruteBrute-force RIDs to enumerate users via a null sessioncrackmapexec smb 10.10.10.10 -u <USER> -p <PASS> -x whoamiExecute an OS command on the targetScan subnets for accessible SMB services.
Test passwords across many accounts safely.
Spread across domain-joined systems.
Run commands on remote Windows hosts.
Terminal output color-codes authentication attempts. A green plus indicates success, while a red minus indicates failure. If 'Pwn3d!' appears, the provided credentials hold administrative power over that specific machine.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.