LogoLogo
NetExec Github
  • Welcome
  • News
    • 🕷️v1.0.0 Release!
    • 🔧v1.1.0 - nxc4u
    • 📡v1.2.0 - ItsAlwaysDNS
    • 🏎️v1.3.0 - NeedForSpeed
    • 🧈v1.4.0 - SmoothOperator
  • Logo & Banner
  • Getting Started
    • Installation
      • 🐧Installation for Unix
      • 🪟Installation for Windows
      • 🍎Installation for Mac
      • 🛠️Manually building the binary
      • ➡️Post Installation Setup
    • Selecting & Using a Protocol
    • Target Formats
    • Using Credentials
    • Using Kerberos
    • Using Certificates
    • Using Modules
    • 🆕DNS options
    • Database General Usage
    • BloodHound Integration
    • Audit Mode
    • Ignore OpSec Warnings
    • Logging
  • SMB protocol
    • Generate hosts file
    • Generate krb5.conf file
    • Generate TGT
    • Scan for Vulnerabilities
    • Enumeration
      • Enumerate Hosts
      • Enumerate Null Sessions
      • Enumerate Guest Logon
      • Enumerate Hosts with SMB Signing Not Required
      • Enumerate Active SMB Sessions
      • Enumerate Shares and Access
      • 🆕Enumerate Network Interfaces
      • Enumerate Disks
      • Enumerate Bitlocker
      • Enumerate Logged on Users
      • Enumerate Domain Users
      • Enumerate Users by Bruteforcing RID
      • Enumerate Domain Groups
      • Enumerate Local Groups
      • Enumerate Domain Password Policy
      • 🆕Enumerate Anti-Virus & EDR
    • Password Spraying
    • Authentication
      • Checking Credentials (Domain)
      • Checking Credentials (Local)
      • 🆕Delegation
    • Command Execution
      • Executing Remote Commands
        • Process Injection (pi module)
      • Getting Shells 101
    • Spidering Shares
    • Get and Put Files
    • Obtaining Credentials
      • Dump SAM
      • Dump LSA
      • Dump NTDS.dit
      • Dump LSASS
      • Dump DPAPI
      • 🆕Dump with BackupOperator Priv
      • 🆕Dump SCCM
      • 🆕Dump Token Broker Cache
      • Dump WIFI password
      • Dump KeePass
      • Dump Veeam
      • Dump WinSCP
      • 🆕Dump PuTTY
      • 🆕Dump VNC
      • 🆕Dump mRemoteNG
      • 🆕Dump Notepad
      • 🆕Dump Notepad++
      • 🆕Dump Remote Desktop Credential Manager
    • Defeating LAPS
    • Checking for Spooler & WebDav
    • Steal Microsoft Teams Cookies
    • 🆕Impersonate logged-on Users
    • 🆕Change User Password
    • 🆕Dump User Local Security Questions
  • LDAP protocol
    • Authentication
    • Enumerate Domain Users
    • Enumerate Domain Groups
    • 🆕Query LDAP
    • ASREPRoast
    • Find Domain SID
    • Kerberoasting
    • 🆕Find Misconfigured Delegation
    • Unconstrained Delegation
    • Admin Count
    • Machine Account Quota
    • Get User Descriptions
    • Dump gMSA
    • Exploit ESC8 (ADCS)
    • Extract Subnet
    • 🛠️Check LDAP Signing
    • Read DACL Rights
    • Extract gMSA Secrets
    • Bloodhound Ingestor
    • List DC IP
    • Enumerate Domain Trusts
    • 🆕Enumerate SCCM
  • WINRM protocol
    • Password Spraying
    • Authentication
    • Command Execution
    • 🆕Defeating LAPS
  • MSSQL protocol
    • Password Spraying
    • Authentication
    • MSSQL PrivEsc
    • MSSQL Command Execution
    • MSSQL Upload & Download
    • Execute via xp_cmdshell
    • 🆕Enumerate Users by Bruteforcing RID
  • SSH protocol
    • Password Spraying
    • Authentication
    • Command Execution
    • Get and Put Files
  • FTP protocol
    • Password Spraying
    • 🆕File Listing, etc
    • 🆕File Upload & Download
  • RDP Protocol
    • Password Spraying
    • Screenshot (connected)
    • Screenshot Without NLA (not connected)
  • WMI Protocol
    • Password Spraying
    • Authentication
    • Command Execution
  • NFS Protocol
    • 🆕Enumeration
    • Download and Upload Files
    • 🆕Escape to root file system
Powered by GitBook
On this page
  • Database General Usage
  • Interacting with the Database
  • Listing Help
  • Workspaces
  • Accessing a Protocol's Database
  • Exporting From the Database

Was this helpful?

Edit on GitHub
  1. Getting Started

Database General Usage

Database General Usage

nxc automatically stores all used/dumped credentials (along with other information) in its database which is setup on first run.

Each protocol has its own database which makes things much more sane and allows for some awesome possibilities. Additionally, there are workspaces (like Metasploit), to separate different engagements/pentests.

For details and usage of a specific protocol's database see the appropriate wiki section.

All workspaces and their relative databases are stored in ~/.nxc/workspaces

Interacting with the Database

nxc ships with a secondary command line script nxcdb which abstracts interacting with the back-end database. Typing the command nxcdb will drop you into a command shell:

#~ nxcdb
nxcdb (default) >

Listing Help

At anytime, just type "help" for a list of commands:

nxcdb (default)(smb) > help

Documented commands (type help <topic>):
========================================
clear_database  creds  dpapi  exit  export  groups  help  hosts  shares  wcc

Undocumented commands:
======================
back  import

Workspaces

The default workspace name is called 'default' (as represented within the prompt), once a workspace is selected everything that you do in nxc will be stored in that workspace.

To create a workspace:

nxcdb (default) > workspace create test
[*] Creating workspace 'test'
<-- CUT -->
nxcdb (test) >

To switch workspace:

nxcdb (test) > workspace default
nxcdb (default) >

To list workspaces:

nxcdb (test) > workspace list
[*] Enumerating Workspaces
default
==> test

Accessing a Protocol's Database

To access a protocol's database simply run proto <protocol>, for example:

nxcdb (test) > proto smb
nxcdb (test)(smb) >

As you can see by the prompt, we are now in the workspace called 'test' and using the SMB protocol's database. Every protocol database has its own set of commands, you can run help to view available commands.

Please refer to the appropriate wiki section for details and usage of a specific protocol's database.

To switch protocol database:

nxcdb (test)(smb) > back
nxcdb (test) > proto http
nxcdb (test)(http) >

You can export information from the database in a few different ways

nxcdb (test)(smb) > export shares detailed file.csv

For all of the up to date options, type help export

nxcdb (default)(smb) > help export

export [creds|hosts|local_admins|shares|signing|keys] [simple|detailed|*] [filename]
Exports information to a specified file

* hosts has an additional third option from simple and detailed: signing - this simply writes a list of ips of
hosts where signing is enabled
* keys' third option is either "all" or an id of a key to export
    export keys [all|id] [filename]
PreviousDNS optionsNextBloodHound Integration

Last updated 2 months ago

Was this helpful?

Exporting From the Database

🆕