CrackMapExec
Swiss-army knife for AD/SMB networks.
KaliParrothigh
pkg: crackmapexec
CrackMapExec sprays credentials and runs commands across SMB/WinRM/LDAP/MSSQL — auth testing and lateral movement at scale.
Syntax
crackmapexec smb {targets} -u {user} -p {pass}
Example
crackmapexec smb 10.0.0.0/24 -u admin -p Password1
Tests the credential against every SMB host in the range.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
crackmapexec smb TARGET
Usage examples
crackmapexec smb 10.0.0.0/24 -u admin -p Password1
Spray one credential across the subnet.
crackmapexec smb 10.0.0.5 -u admin -H aad3b... --sam
Pass-the-hash and dump local hashes.
crackmapexec smb 10.0.0.5 -u admin -p P@ss --shares
List shares you can access.
Advantages
- Mass auth testing + exec
- Multi-protocol (SMB/WinRM/…)
Disadvantages
- Loud; triggers lockouts
- AD authorization essential
Tags
#ad#smb#lateral
Official docs: NetExec ↗
Related commands
Frequently asked questions
What is CrackMapExec used for?
CrackMapExec sprays credentials and runs commands across SMB/WinRM/LDAP/MSSQL — auth testing and lateral movement at scale.
What is an example CrackMapExec command?
A common example is: crackmapexec smb 10.0.0.0/24 -u admin -p Password1 — Tests the credential against every SMB host in the range.
Is CrackMapExec part of Kali Linux?
Yes. CrackMapExec ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install crackmapexec.
What category of security tool is CrackMapExec?
CrackMapExec is a Password Attacks tool with a high-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.