Command Manager

NetExec pre2k Module

Enumerate computer accounts that still use the pre-Windows-2000 compatible access default password (the lowercase computer name without the trailing $). Authenticate to LDAP first to list candidates, then spray. Module lives on the ldap protocol since v1.4. v1.5.1 added support for changing the password on locked pre2k accounts.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
nxc
Category
Enumeration / LDAP
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap <dc-ip> -u '<user>' -p '<password>' -M pre2k

Credential variants

The same attack using a different authentication material.

Show All Candidates requires password

nxc ldap <dc-ip> -u '<user>' -p '<password>' -M pre2k -o ALL=true

Examples

nxc ldap dc.corp.local -u jdoe -p 'Password123!' -M pre2k

Tags

netexec nxc pre2k machine-account default-credentials

References