netexec (nxc)

Turn on logging

To log every nxc command and output to a file, find the nxc.conf file (in my Kali it was at /home/kali/.nxc/nxc.conf) and enable logging:

log_mode = True

Change the Pwn3d label

You can make that something more professional if you want - just edit the /home/kali/.nxc/nxc.conf file and change:

pwn3d_label = Compromised!

Find shares

nxc smb pcs.txt -u 'username' -p 'password' --shares

Cleaning up share list from log file

If you've turned on logging (see top of this page) here's a way to grep out just the shares you have WRITE access to. This is helpful if you want to try and drop tricky farmer payloads.

grep -i write log_2024-08-24-22-17-32.log | awk '{print $9,$10}' | sort > shares-i-can-write-to.txt

Find hosts with/without SMB signing

nxc smb pcs.txt -u '' -p '' --gen-relay-list nosigning.txt

Find hosts with/without SMB signing (alternate way)

grep for anything where signing is set to false

nxc smb pcs.txt -u '' -p '' > signingcheck.txt

If you want to get kind of fancy-pantsy you can take that grep to the next level by pulling out all hosts with SMB signing disabled and sorting by the host name:

cat signingcheck.txt| grep -i "signing:False" | awk '{print $0 " " $4}' | sort -k4,4 > no-signing-for-these-folks.txt

Find hosts running WebClient service

nxc smb dc1.domain.com -u lowpriv -p 'yerpassw0rd' -M webdav

Sort that log for just hostnames running WebClient

grep -i enabled webdav.log | awk '{print $9}' | sort | uniq

Sort that log for hostnames (and their IPs) running WebClient

grep -i enabled webdav.log | awk '{print $9 "," $7}' | sort | uniq