“In modern enterprise environments, Active Directory credentials are the ultimate prize. NetExec (NXC) is a powerful, modern post-exploitation framework built to automate and streamline credential dumping.”
Moving through a network without a valid credential is slow and loud, and every password you spray is a chance to trip a lockout policy and a SOC alert at once. The modern approach is quieter: land somewhere, harvest the secrets that are already sitting on the box, and reuse them. Credential Dumping with NetExec (NXC) is a manual for doing exactly that with NetExec — the maintained successor to CrackMapExec — across SMB and WinRM.
The Deep Windows Harvest
The guide skips basic spraying and goes straight for the secrets stored on authenticated Windows targets, with the exact NXC syntax to pull each:
- LSA Secrets & SAM Hashes: The local NTLM hashes that feed Pass-the-Hash across the estate.
- LSASS Memory Dumping: Modules built on
nanodumpandlsassythat extract from LSASS without killing the process — noisy against a good EDR, so worth reserving for hosts where you have already assessed the monitoring. - DPAPI & Winlogon Data: Decrypting DPAPI-protected material and pulling cached keys and registry-stored secrets.
Plundering Third-Party Software
The most useful chapters are the ones defenders forget. Everyone watches LSASS; almost nobody watches the admin’s own toolbox, where credentials sit saved in application config because it was convenient. NXC will sweep for them automatically:
- mRemoteNG & WinSCP: Decrypting saved RDP and FTP connection profiles — mRemoteNG in particular stores credentials reversibly by default.
- PuTTY & SSH: Private keys left unprotected on disk.
- Cleartext Artefacts: Notepad++ session files, PowerShell command history, and saved Wi-Fi profiles, all of which routinely contain a password in the clear.
Conquering the Domain
The final chapters reach for domain-level secrets: abusing membership of Backup Operators to dump NTDS.dit over the network without ever being Domain Admin, and pulling LAPS local-admin passwords and gMSA secrets. The Backup Operators path is the standout — a group people hand out casually because “it’s only backups”, which is functionally a route to every hash in the domain.
Who Is This Book REALLY For?
- Red Team Operators: A modular cheat sheet. Land on a developer’s workstation and this gives you the commands to strip every stored credential off it quickly — though “quickly and quietly” depends entirely on the EDR, which the guide is right to make you think about.
- Blue Team Defenders: Knowing how NXC uses SMB to reach the SAM and those config files is what lets you write a network signature that actually fires.
- System Administrators: A blunt argument for Credential Guard, LAPS, and not leaving passwords in a Notepad++ tab — because that tab is a five-second win for anyone who gets a shell.
The Bottom Line
Credential Dumping with NetExec (NXC) is efficient post-exploitation, and its lesson is uncomfortable: the most damaging thing in an enterprise is rarely a missing patch. It is the cached and “encrypted” passwords administrators leave behind trying to work faster.
