NetExec

🚩 This is the open source repository of NetExec maintained by a community of passionate people NetExec - The Network Execution Tool This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgnx64 started maintaining the project for the next 4 years, adding a lo...

CVE-2025-33073

CVE-2025-33073 PoC Exploit for the NTLM reflection SMB flaw. All credits go to the offical research: https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 Prerequisites OS: Kali Linux has most packages pre-installed. NetExec N...

DonPwner

🔥 DonPwner - Advanced DonPAPI Analysis & Attack Tool Advanced Password Spray & Credential Analysis Tool - Leveraging DonPAPI with Smart Delay & Jitter Features • Installation • Usage • Examples • Configuration • License 🎯 About DonPwner is an advanced penetration testing tool that revolutionizes...

Kitsune

Kitsune Kitsune is a Polymorphic Command & Control. This tool allows you to get a graphical version of your favourite hacking tools, such as NetExec, Villain or Evil-WinRM among others. In addition, brings many improvements such as automatic reconnection, reports, history and some extra functions...

Exploit for Improper Authorization in Microsoft

certighost – NXC module for CVE-2026-54121 NetExec NXC...

Active Directory Certificate Services CA Chase Configuration Checker

The Certighost NetExec SMB module checks Active Directory Certificate Services configuration for the EDITFATTRIBUTESUBJECTALTNAME2 chase flag associated with CVE-2026-54121...

LDAP Force Change Password

Resets a target user's password using LDAP unicodePwd requires LDAPS and ForceChangePassword / reset rights — NetExec: -M change-password. !/usr/bin/env python3 -- coding: utf-8 -- """Force-change a user password via LDAP ForceChangePassword ACL / NetExec change-password.""" from kittysploit impo...

LDAP Query

Runs a raw LDAP filter and dumps matching attributes NetExec: nxc ldap -u -p --query 'sAMAccountName=user' ''. !/usr/bin/env python3 -- coding: utf-8 -- """Raw LDAP query NetExec: nxc ldap --query.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleAuxiliary,...

LDAP Group Members

List members of a group, or groups for a user NetExec: --groups 'Backup Operators' / -M groupmembership. !/usr/bin/env python3 -- coding: utf-8 -- """Group membership helpers NetExec: --groups / groupmembership.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

MSSQL Enum Impersonate

Lists logins the current SQL user can EXECUTE AS NetExec: nxc mssql -M enumimpersonate. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate MSSQL impersonation rights NetExec: -M enumimpersonate.""" from future import annotations from kittysploit import class ModuleAuxiliary: info = "name":...

LDAP Active Users

Lists enabled not ACCOUNTDISABLE domain users for spray targeting NetExec: nxc ldap -u -p --active-users. !/usr/bin/env python3 -- coding: utf-8 -- """List enabled/active domain users NetExec: nxc ldap --active-users.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient fro...

LDAP AdminCount Accounts

Lists accounts with adminCount=1 AdminSDHolder / protected groups NetExec: nxc ldap -u -p --admin-count. !/usr/bin/env python3 -- coding: utf-8 -- """List adminCount=1 accounts NetExec: nxc ldap --admin-count.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

LDAP Auth Check

Validates domain credentials with an LDAP bind and reports domain / DC info NetExec: nxc ldap -u -p . !/usr/bin/env python3 -- coding: utf-8 -- """Validate domain credentials over LDAP NetExec: nxc ldap host -u -p.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class...

CVE-2026-27884

NetExec is a network execution tool. Prior to version 1.5.1, the module spiderplus improperly creates the output file and folder path when saving files from SMB shares. It does not take into account that it is possible for Linux SMB shares to have path traversal characters such as ../ in them. An...

CVE-2026-27884 NetExec vulnerable to arbitrary file write via path traversal in spider_plus module

NetExec is a network execution tool. Prior to version 1.5.1, the module spiderplus improperly creates the output file and folder path when saving files from SMB shares. It does not take into account that it is possible for Linux SMB shares to have path traversal characters such as ../ in them. An...

CVE-2026-27884 NetExec vulnerable to arbitrary file write via path traversal in spider_plus module

NetExec is a network execution tool. Prior to version 1.5.1, the module spiderplus improperly creates the output file and folder path when saving files from SMB shares. It does not take into account that it is possible for Linux SMB shares to have path traversal characters such as ../ in them. An...

CVE-2026-27884

CVE-2026-27884 affects NetExec’s spider_plus module prior to version 1.5.1, where saving files from SMB shares could be manipulated due to path traversal characters like ../ in SMB paths. An attacker could craft a filename in an SMB share that, when spider_plus crawls and downloads, writes or ove...

NetExec path traversal vulnerability

NetExec is a network execution tool developed by Pennyworth under open source. Versions of NetExec prior to 1.5.1 contained a path traversal vulnerability. This vulnerability stemmed from improper creation of file paths, which could lead to arbitrary file writing attacks...

CVE-2026-27884: Improper Limitation of a Pathname to a Restricted Directory

NetExec is a network execution tool. Prior to version 1.5.1, the module spiderplus improperly creates the output file and folder path when saving files from SMB shares. It does not take into account that it is possible for Linux SMB shares to have path traversal characters such as ../ in them. An...

PT-2026-22067

NetExec is a network execution tool. Prior to version 1.5.1, the module spider plus improperly creates the output file and folder path when saving files from SMB shares. It does not take into account that it is possible for Linux SMB shares to have path traversal characters such as ../ in them. A...