Using Credentials

Using Credentials

The most basic way to test a set of of credentials across a network:

With a plain-text password:

python crackmapexec.py 172.16.0.1/24 -u username -p password

Note: When using usernames or passwords that contain special symbols, wrap them in single quotes to make your shell interpret it as a string:

python crackmapexec.py 172.16.0.1/24 -u username -p 'Admin!123@'

With a NTLM hash (Note: -H will always override -p):

python crackmapexec.py 172.16.0.1/24 -u username -H LMHASH:NTHASH

As of version 2.0 Kerberos is supported:

python crackmapexec.py 172.16.0.1/24 -u username --kerb -k HEX_KEY

Brute-Forcing SMB

By specifying a file or a comma separated list of values with the -u, -p and -H arguments, CrackMapExec will automatically brute-force SMB logins for all targets:

Examples:

python crackmapexec.py 172.16.0.1/24 -u username1 -p password1,password2

python crackmapexec.py 172.16.0.1/24 -u username1,username2 -p password1

python crackmapexec.py 172.16.0.1/24 -u username1,username2 -H NT:LM,NT:LM

python crackmapexec.py 172.16.0.1/24 -u ~/file_containing_usernames -p ~/file_containing_passwords

python crackmapexec.py 172.16.0.1/24 -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes

Null Sessions

You can log in with a null session by using '' or guest as the username and/or password

Examples:

python crackmapexec.py 172.16.0.1/24 -u '' -p ''

python crackmapexec.py 172.16.0.1/24 -u guest -p guest