# Pennyw0rth/NetExec

The Network Execution Tool

Repository: https://github.com/Pennyw0rth/NetExec
Canonical: https://ross.abutalabs.com/products/netexec
Homepage: https://netexec.wiki/
Language: Python
License: BSD-2-Clause
License Family: permissive
Topics: hacking, pentest, pentest-tool, pentest-tools, pentesting, python, python3, red-team, active-directory, infosec, security, security-tools, infosectools, networks, windows
Last push: 2026-08-26T16:04:19+00:00

## Health v2 (maintenance only)
Score: 74/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 40, longevity 77
- inputs: {"age_days": 1090, "days_push": 7, "days_rel": 191, "gap_med": 181, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 5815, forks 752 (observed 2026-08-28T04:09:29.989323+00:00)

## What it is
NetExec (nxc) is a community-maintained, open-source network execution tool and successor to CrackMapExec, used for pentesting and red-team operations against Windows and Active Directory environments. It supports multiple protocols (SMB, LDAP, WinRM, MSSQL, SSH, FTP, RDP, WMI, NFS) for enumeration, authentication attacks like password spraying, command execution, and credential gathering.

## Use cases
- password spray an active directory domain
- enumerate smb shares on a network
- dump ntds credentials from a domain controller
- kerberoast and asreproast domain users
- execute commands remotely via winrm or wmi
- find active directory misconfigurations like delegation attacks
- enumerate ldap users and groups during a pentest
- check hosts for vulnerabilities across a subnet

## When to choose
- you need a modern, actively maintained replacement for CrackMapExec
- you are performing red-team or pentest work against Windows/AD environments
- you want one tool covering many protocols (SMB, LDAP, WinRM, MSSQL, SSH, RDP) for enumeration and post-exploitation
- you need community-driven updates, modules, and BloodHound integration

## When to avoid
- you need a GUI-driven vulnerability scanner rather than a command-line tool
- your target is non-Windows infrastructure outside the supported protocols
- you require a fully documented stable API for building integrations (wiki is still in development)
- you are looking for a defensive-only auditing tool without offensive capabilities

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, cli, networking, auth
- domain: security, penetration-testing, networking, developer-tools
- platform: windows, python, cli, cross-platform
- tags: red-team, active-directory, crackmapexec-successor, smb, ldap, winrm, password-spraying, kerberos, post-exploitation, pentesting, command-line, linux, macos, docker

## Member repositories
- Pennyw0rth/NetExec (main) score 74

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:29.989323+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:52:12.258186+00:00, confidence not recorded.
  - readme: https://github.com/Pennyw0rth/NetExec (fetched 2026-08-28T04:09:29.989323+00:00, sha 9cc6e79e6754)
  - homepage: https://netexec.wiki/ (fetched 2026-08-29T08:47:49.792600+00:00, sha 7f41bfc6df6a)
  - site_page: https://www.netexec.wiki/getting-started/installation (fetched 2026-08-29T08:47:49.795232+00:00, sha 076a413defae)
  - site_page: https://www.netexec.wiki/getting-started/selecting-and-using-a-protocol (fetched 2026-08-29T08:47:49.797149+00:00, sha fbb4b37c730e)
  - site_page: https://www.netexec.wiki/getting-started/target-formats (fetched 2026-08-29T08:47:49.799083+00:00, sha f9017bfdbf29)
  - site_page: https://www.netexec.wiki/getting-started/using-credentials (fetched 2026-08-29T08:47:49.801078+00:00, sha 295ea4959eb0)
  - site_page: https://www.netexec.wiki/getting-started/using-kerberos (fetched 2026-08-29T08:47:49.803107+00:00, sha a3a787d64ab0)
  - site_page: https://www.netexec.wiki/getting-started/using-certificates (fetched 2026-08-29T08:47:49.804889+00:00, sha 6d82b405ee52)
  - site_page: https://www.netexec.wiki/getting-started/using-modules (fetched 2026-08-29T08:47:49.806452+00:00, sha 2c4863948d0c)
  - site_page: https://www.netexec.wiki/getting-started/dns-options (fetched 2026-08-29T08:47:49.808117+00:00, sha c1f3c596463e)
- Data as of 2026-08-30T08:39:29.467469+00:00.