fraggle/WebsiteTemplate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
main
WebsiteTemplate/cheatsheets/crackmapexec.html
Fraggle 6f42a58ee5
first commit
2026-01-25 11:33:37 -04:00

217 lines
7.1 KiB
HTML
Raw Permalink Blame History

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self' data:; img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self' https://defcon.social https://bsky.app;">
<meta http-equiv="X-Content-Type-Options" content="nosniff">
<link rel="stylesheet" href="../assets/css/style.css">
<link rel="icon" type="image/x-icon" href="../favicon.ico">
<script>
// Apply theme immediately to prevent flash
(function() {
const theme = localStorage.getItem('theme') ||
(window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
document.documentElement.setAttribute('data-theme', theme);
})();
</script>
<title>crackmapexec Cheatsheet - Cheatsheets - Launch Pad</title>
</head>
<body>
<button class="theme-toggle" id="themeToggle" aria-label="Toggle dark mode">
<svg class="theme-icon theme-icon-moon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"></path></svg>
<svg class="theme-icon theme-icon-sun" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="display: none;"><circle cx="12" cy="12" r="5"></circle><line x1="12" y1="1" x2="12" y2="3"></line><line x1="12" y1="21" x2="12" y2="23"></line><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"></line><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"></line><line x1="1" y1="12" x2="3" y2="12"></line><line x1="21" y1="12" x2="23" y2="12"></line><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"></line><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"></line></svg>
</button>
<br/><br/>
<div class="name">
__ _______________________ _________._________________________
\_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/
| __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_
| \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \
\___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ /
\/ \/ \/ \/ \/ \/ \/
</div>
<div class="blog-page-header">
<div class="blog-header-content">
<a href="/cheatsheets" class="back-link" title="Back to Cheatsheets">
<svg xmlns="http://www.w3.org/2000/svg" width="42" height="42" viewBox="0 0 24 24" class="home-icon"><path fill="currentColor" d="M10 20v-6h4v6h5v-8h3L12 3 2 12h3v8z"/></svg>
</a>
<h1 class="blog-page-title">crackmapexec Cheatsheet</h1>
</div>
</div>
<div class="blog-post-container">
<div class="blog-posts-container" style="max-width: 900px; margin: 0 auto;">
<div class="blog-post">
<div class="blog-post-content">
<p><a href="index.html">← Back to cheatsheets</a></p>
<p><a href="../index.html">← Home</a></p>
<hr>
<p>CrackMapExec (CME) is a post-exploitation tool for assessing the security of Active Directory environments. Enumerates, exploits, and pivots through Windows networks using various protocols.</p>
<hr>
<h2>Basic Usage</h2>
<ul>
<li>crackmapexec smb 192.168.1.0/24 - Enumerate SMB</li>
</ul>
<ul>
<li>crackmapexec smb 192.168.1.0/24 -u user -p pass - Authenticate</li>
</ul>
<ul>
<li>crackmapexec smb 192.168.1.0/24 -u user -H hash - Pass-the-hash</li>
</ul>
<ul>
<li>crackmapexec smb 192.168.1.0/24 -u user -p pass -M module - Execute module</li>
</ul>
<hr>
<h2>Protocols</h2>
<ul>
<li>smb - SMB/CIFS protocol</li>
</ul>
<ul>
<li>ssh - SSH protocol</li>
</ul>
<ul>
<li>winrm - WinRM protocol</li>
</ul>
<ul>
<li>ldap - LDAP protocol</li>
</ul>
<ul>
<li>mssql - Microsoft SQL Server</li>
</ul>
<ul>
<li>rdp - Remote Desktop Protocol</li>
</ul>
<ul>
<li>vnc - VNC protocol</li>
</ul>
<hr>
<h2>Authentication</h2>
<ul>
<li>-u user - Username</li>
</ul>
<ul>
<li>-p password - Password</li>
</ul>
<ul>
<li>-H hash - NTLM hash</li>
</ul>
<ul>
<li>-k - Kerberos authentication</li>
</ul>
<ul>
<li>-d domain - Domain name</li>
</ul>
<ul>
<li>-U user:pass - User:pass format</li>
</ul>
<ul>
<li>--local-auth - Local authentication</li>
</ul>
<hr>
<h2>Enumeration</h2>
<ul>
<li>--shares - List shares</li>
</ul>
<ul>
<li>--sessions - List sessions</li>
</ul>
<ul>
<li>--loggedon-users - Logged on users</li>
</ul>
<ul>
<li>--disks - List disks</li>
</ul>
<ul>
<li>--users - Enumerate users</li>
</ul>
<ul>
<li>--groups - Enumerate groups</li>
</ul>
<ul>
<li>--computers - Enumerate computers</li>
</ul>
<ul>
<li>--pass-pol - Password policy</li>
</ul>
<hr>
<h2>Execution</h2>
<ul>
<li>-x command - Execute command</li>
</ul>
<ul>
<li>-X command - Execute PowerShell</li>
</ul>
<ul>
<li>-M module - Execute module</li>
</ul>
<ul>
<li>--exec-method wmiexec - Execution method</li>
</ul>
<ul>
<li>--no-output - Suppress output</li>
</ul>
<hr>
<h2>Common Examples</h2>
<h3>Enumerate SMB</h3>
<pre><code>crackmapexec smb 192.168.1.0/24</code></pre>
<p>Scan network for SMB hosts.</p>
<h3>Authenticate</h3>
<pre><code>crackmapexec smb 192.168.1.0/24 -u admin -p Password123</code></pre>
<p>Test credentials across network.</p>
<h3>Pass-the-Hash</h3>
<pre><code>crackmapexec smb 192.168.1.0/24 -u admin -H aad3b435b51404eeaad3b435b51404ee</code></pre>
<p>Authenticate with NTLM hash.</p>
<h3>List Shares</h3>
<pre><code>crackmapexec smb 192.168.1.0/24 -u user -p pass --shares</code></pre>
<p>Enumerate SMB shares.</p>
<h3>Execute Command</h3>
<pre><code>crackmapexec smb 192.168.1.10 -u admin -p pass -x "whoami"</code></pre>
<p>Run command on target.</p>
<h3>PowerShell</h3>
<pre><code>crackmapexec smb 192.168.1.10 -u admin -p pass -X "Get-Process"</code></pre>
<p>Execute PowerShell command.</p>
<h3>Dump SAM</h3>
<pre><code>crackmapexec smb 192.168.1.10 -u admin -p pass --sam</code></pre>
<p>Dump SAM database.</p>
<h3>List Modules</h3>
<pre><code>crackmapexec smb --list-modules</code></pre>
<p>Show available modules.</p>
<h3>Use Module</h3>
<pre><code>crackmapexec smb 192.168.1.10 -u admin -p pass -M mimikatz</code></pre>
<p>Execute module.</p>
<hr>
<h2>Tips</h2>
<ul>
<li>Use -H for pass-the-hash attacks</li>
</ul>
<ul>
<li>Use --shares to discover file shares</li>
</ul>
<ul>
<li>Use -x for command execution</li>
</ul>
<ul>
<li>Use -X for PowerShell execution</li>
</ul>
<ul>
<li>Check --list-modules for available modules</li>
</ul>
<ul>
<li>Use -k for Kerberos authentication</li>
</ul>
<ul>
<li>Essential for AD security testing</li>
</ul>
<ul>
<li>Powerful lateral movement tool</li>
</ul>
</div>
</div>
</div>
</div>
<script async type="text/javascript" src="../blog/analytics.js"></script>
<script src="../theme.js"></script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink