CrackMapExec / NetExec

v1.3.0 (netexec)Porchetta Industries (community)

The swiss army knife for AD assessment: spray credentials across a subnet over SMB/WinRM/LDAP/MSSQL, list shares, dump local hashes, and check signing and password policy. Maintained today as NetExec (nxc). The range answers from the authored domain, so it shows which hosts a stolen credential really reaches.

Category: Post-exploitation & lateral movement
Package: netexec
Runs on: Linux
Commands: crackmapexec, cme, netexec, nxc

Authentication results come from the authored domain model; each attempt generates logon telemetry on the target.

Install it

The scripts below install the real Porchetta Industries (community) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-cme.sh

Windows installer (PowerShell)

Install-cme.ps1

No native Windows build. Use a Linux host in the range, or run it under WSL.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Python (pipx)

Install the interpreter tooling
```
sudo apt install -y pipx
```
Install CrackMapExec / NetExec
```
pipx install netexec
```
pipx keeps the tool in its own environment and still puts it on PATH.

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install CrackMapExec / NetExec
```
sudo apt install -y netexec
```

Check it worked

Confirm it landed on PATH
```
which crackmapexec
```
Check the version
```
crackmapexec --version
```
The range reports 1.3.0 (netexec).

Remove it

Take it off again
```
pipx uninstall netexec
```

On Windows

No native Windows build. Use a Linux host in the range, or run it under WSL.

Windows Subsystem for Linux

Install a Linux userland on the Windows host
```
wsl --install -d Ubuntu
```
The upstream project has no native Windows build; WSL is the usual way round it.
Install CrackMapExec / NetExec inside it
```
wsl sudo apt install -y netexec
```

Inside the range

Tick it on the launch screen
Under CrackMapExec / NetExec's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y netexec
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use CrackMapExec / NetExec

Pentest: Read the AD Attack GraphUse the /pentest/attack-graph view to spot the shortest path from a helpdesk account to Domain Admin, walk it end-to-end with the simulated Kerberoast/DCSync tools, and file the delegation finding.