NetExec (nxc): What Do the Results Actually Prove?

Concept

NetExec (the active, modernized community successor to CrackMapExec) is an automated network assessment and lateral movement utility for Active Directory environments. It enables multi-threaded credential testing and privilege verification across a wide spectrum of enterprise protocols (SMB, WMI, WinRM, LDAP, MSSQL, RDP, SSH, FTP).

When responding to an incident where an adversary workstation is recovered or pentest logs are triaged, DFIR investigators encounter standardized NetExec console lines:

[-] SMB 10.0.1.15:445 STATUS_LOGON_FAILURE
[+] SMB 10.0.1.20:445 CORP\alice:Password123
[+] SMB 10.0.1.25:445 CORP\bob:Password123 (Pwn3d!)

Why It Matters in DFIR

NetExec is ubiquitous in post-exploitation playbooks used by ransomware operators and penetration testers:

Capability vs Action Confusion: Observing (Pwn3d!) in triage data frequently leads incident responders to prematurely declare that an endpoint was compromised. DFIR rigor demands proving actual malicious action (service creation, binary execution, SAM/LSA dumping).
Protocol Granularity: NetExec can test credentials via SMB (--shares), WMI (-x whoami), WinRM (-X), or LDAP. Each protocol generates vastly different audit signatures.
Default IP-Based Behavior: NetExec typically targets subnets via raw IP addresses, inevitably forcing NTLM authentication instead of Kerberos. This generates distinctive bursts of network logon events (Event 4624 Type 3) across the estate.

How It Works

How NetExec Computes `(Pwn3d!)`

Over SMB, NetExec executes the following exact sequence:

SMB negotiation followed by a SESSION_SETUP request containing the target credentials.
If credentials fail: displays [-] STATUS_LOGON_FAILURE.
If credentials authenticate successfully: displays [+].
To evaluate administrative status (Pwn3d!):
- NetExec attempts a TREE_CONNECT request against hidden administrative shares: \\TARGET\ADMIN$ or \\TARGET\C$.
- If the target returns STATUS_ACCESS_DENIED, the user is a valid standard user ([+]).
- If the target grants access (STATUS_SUCCESS), NetExec concludes the account has local administrative privileges and appends (Pwn3d!).
- No malicious payload was delivered. No process was created. Only an SMB tree connect was verified.

NetExec (Attacker)                        Target Server
   │                                           │
   │ 1. SMB Negotiate & Session Setup          │
   ├──────────────────────────────────────────►│
   │◄──────────────────────────────────────────┤ 2. SUCCESS (Event 4624 Type 3)
   │                                           │
   │ 3. Tree Connect: \\TARGET\ADMIN$          │
   ├──────────────────────────────────────────►│
   │◄──────────────────────────────────────────┤ 4. STATUS_SUCCESS (Event 5140)
   │                                           │
   ▼                                           ▼
Displays: (Pwn3d!)                      ZERO processes executed!

What Is Possible

Differentiating Password Spraying from Execution: Running NetExec without execution switches (-x, -X, --sam, --lsa) performs read-only credential validation without host modification.
Fingerprinting NetExec Network Traffic: NetExec tools employ standardized Impacket SMB structures, identifiable by rapid successive connections to IPC$, ADMIN$, and default named pipes.
Detecting Active Execution: When an adversary appends -x "command", NetExec invokes wmiexec or smbexec, producing concrete host artefacts (ephemeral services, output batch files in C:\Windows\Temp).

What Is Not Possible

Inferring Malware Execution Solely from (Pwn3d!): A (Pwn3d!) line provides zero evidence of ransomware deployment or persistent backdoor installation.
Negotiating Kerberos via Raw IP Subnet Targets: Supplying an IP range (e.g., 192.168.1.0/24) forces NetExec into NTLM mode unless the -k flag is specified alongside resolvable FQDNs.
Accessing ADMIN$ with Local Accounts Under UAC Filtering: Non-RID 500 local administrative accounts suffer remote UAC filtering and return standard [+] unless LocalAccountTokenFilterPolicy is specifically enabled.

Common DFIR Confusions

NetExec Output Indicator	What It Technically Proves	What It Does NOT Prove
`[-] STATUS_LOGON_FAILURE`	The tested password is invalid for this identity.	Does not prove the account does not exist.
`[+] User:Pass`	Account credentials successfully authenticated.	Does not prove access to files or local administrative rights.
`[+] User:Pass (Pwn3d!)`	Account can access `ADMIN$` or `C$` shares.	Does NOT prove that code or ransomware was executed.
`[+] SMB ... Signing:False`	Target does not enforce SMB signing (relay vulnerable).	Does not prove an NTLM relay attack occurred.

Concrete Forensic Example

During post-incident analysis, investigators recover an attacker terminal log containing:

SMB  192.168.10.50  445  SRV-APP  [+] CORP\helpdesk:Summer2026! (Pwn3d!)

Leadership fears immediate compromise of application server SRV-APP.

DFIR triage on SRV-APP reveals:

Event ID 4624 (Logon Type 3): Successful authentication for CORP\helpdesk at 14:02:11 UTC via NtLmSsp.
Event ID 5140 (Share Access): Successful connection to ADMIN$ at 14:02:12 UTC.
Event ID 7045 (Service Installed): Zero services registered.
Event ID 4688 / Sysmon 1 (Process Creation): Zero child processes spawned.
Directory C:\Windows\Temp: No temporary .bat or output files found.
DFIR Conclusion: The adversary validated administrative access rights, but executed zero payloads on SRV-APP during this interaction.

Key Forensic Artefacts

Host Security Logs:
- Event ID 4624 (Type 3): Network logon via NtLmSsp, with Workstation Name capturing attacker hostname.
- Event ID 5140: Network share access against \\*\ADMIN$ or \\*\IPC$.
- Event ID 5145: Detailed share access check with elevated AccessMask: 0x12019F.
Host Execution Artefacts (if -x / smbexec / wmiexec invoked):
- smbexec: Event ID 7045 recording ephemeral service creation executing cmd.exe /Q /c ... > \\127.0.0.1\C$\__output 2>&1.
- wmiexec: Process execution under WmiPrvSE.exe spawning cmd.exe or powershell.exe with output redirection to C:\Windows\Temp.

Investigation Methods

Correlate Consecutive IPC$ and ADMIN$ Access: Identify bursts of Event 4624 and 5140 events occurring within milliseconds across multiple endpoints.
Verify Presence or Absence of Service Creation (Event 7045): Confirm whether administrative SMB connections were followed by service registrations.
Inspect Anonymous Pre-Authentication Probes: NetExec always initiates target profiling via null/anonymous sessions to extract OS version and domain NetBIOS names.

Investigative Tooling

Chainsaw / Hayabusa: Sigma rules hunting for Impacket and NetExec execution signatures:
- net_connection_win_impacket_lateral_movement.yml
- win_system_service_install_smbexec.yml

PowerShell / Get-WinEvent:

# Query administrative share accesses
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=5140} |
  Where-Object { $_.Properties[6].Value -like '*ADMIN$' -or $_.Properties[6].Value -like '*C$' } |
  Select-Object TimeCreated, @{N='User';E={$_.Properties[1].Value}}, @{N='Share';E={$_.Properties[6].Value}}, @{N='IP';E={$_.Properties[7].Value}}

Key Takeaways

(Pwn3d!) strictly indicates that access to ADMIN$ or C$ was authorized.
NetExec without execution flags spawns zero processes on the target.
IP-based scanning relies on NTLM, generating characteristic Event 4624 Type 3 logs.
Affirming compromise requires forensic evidence of actual execution (Event 7045, Event 4688, created payloads).