CrackMapExec

Target format

crackmapexec <protocol> ms.evilcorp.org

crackmapexec <protocol> 192.168.1.0 192.168.0.2

crackmapexec <protocol> 192.168.1.0/24

crackmapexec <protocol> 192.168.1.0-28 10.0.0.1-67

crackmapexec <protocol> ~/targets.txt

Using Credentials

crackmapexec <protocol> <target(s)> -u username -p password

crackmapexec <protocol> <target(s)> -u username -p 'Admin!123@'

Using a credential set from the database

crackmapexec <protocol> <target(s)> -id <cred ID(s)>

Brute Forcing & Password Spraying

crackmapexec <protocol> <target(s)> -u username1 -p password1 password2

crackmapexec <protocol> <target(s)> -u username1 username2 -p password1

crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -p ~/file_containing_passwords

crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes

Password Spraying without bruteforce, Can be usefull for protocols like WinRM and MSSQL. This option avoid the bruteforce when you use files (-u file -p file)

crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes --no-bruteforce

crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -p ~/file_containing_pa