nxs

PyPI version

What can this cred actually do?

nxs is a credential capability mapper powered by NetExec. It takes a credential and checks it against 10 different protocols (SMB, LDAP, WMI, WinRM, SSH, RDP, MSSQL, FTP, VNC, NFS) to show you exactly what level of access you have on the target.

Install

pipx install nxsctl

Requires NetExec (nxc) in PATH.

Usage

nxs 10.10.10.10 -u john.doe -p 'Password123' -d domain.local

Password prompt if -p is omitted:

nxs 10.10.10.10 -u john.doe -d domain.local

Hash authentication:

nxs 10.10.10.10 -u john.doe -H NT_HASH -d domain.local
nxs 10.10.10.10 -u john.doe -H LM_HASH:NT_HASH -d domain.local

Quickstart

nxs 10.10.10.10 -u admin -p 'Password123!'

# Spray a file of credentials (format: user:pass or user:hash)
nxs 10.10.10.10 -f creds.txt

# Password spray — one password across a user list
nxs 10.10.10.10 -u users.txt -p 'Password123!'

# All combinations — every user × every password (-C/--combo)
nxs 10.10.10.10 -u users.txt -p passwords.txt -C

# Specific protocols
nxs 192.168.1.0/24 -u john.doe -H 'LM:NT' --protocols ssh,winrm

OPSEC mode (single-threaded, low retry):

nxs 10.10.10.10 -u john.doe -p 'Password123' -d domain.local --opsec

Kerberos:

nxs 10.10.10.10 -u john.doe -p 'Password123' -d domain.local -k --kdc-host dc01.domain.local

# Authenticate with a ccache ticket file (no password needed):
nxs 10.10.10.10 -T user.ccache

# Scan a directory of tickets:
nxs 10.10.10.10 -T ./tickets/

JSON output:

nxs 10.10.10.10 -u john.doe -p 'Password123' --json
nxs 10.10.10.10 -u john.doe -p 'Password123' --json --raw

Save raw proof:

nxs 10.10.10.10 -u john.doe -p 'Password123' --save loot/

Verbose output (detailed execution info, WIP...):

nxs 10.10.10.10 -u john.doe -p 'Password123' --verbose

Example Output

nxs v0.1.0 10.10.10.10 · john.doe@domain.local · 4 protocols

  [+] SMB    WRITE    Shared[READ+WRITE], Web[READ]
  [+] LDAP   READ     Enumerated 15 domain users
  [-] WINRM  NO       Authentication failed

With --verbose, detailed output is nested underneath:

nxs v0.1.0 10.10.10.10 · admin · 1 protocols

  [+] WINRM  EXEC     domain.local\admin
      ↳ USER INFORMATION
      ↳ ----------------
      ↳ User Name         SID
      ↳ ================= ============================================
      ↳ domain\admin      S-1-5-21-3623811015-3361044348-30300820-500

Access Levels

Level Marker Meaning
ADMIN [+] Admin-level access
EXEC [+] Command execution
WRITE [+] Write access
READ [+] Read access
AUTH [*] Authenticated, no further access
UNCLEAR [?] Inconclusive result
NO [-] Authentication failed or port closed

License

MIT

Project links

Data verified by PyPI on Aug 1, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for nicetrykiddo from gravatar.com nicetrykiddo

Credits

Author: nicetrykiddo

GitHub Statistics

Data verified by PyPI on Aug 1, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.10

Tags

active-directory ldap netexec nxc pentest red-team smb wmi

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

nxsctl-0.3.6.tar.gz (17.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

nxsctl-0.3.6-py3-none-any.whl (19.4 kB view details)

Uploaded Python 3

File details

Details for the file nxsctl-0.3.6.tar.gz.

File metadata

  • Download URL: nxsctl-0.3.6.tar.gz
  • Upload date:
  • Size: 17.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for nxsctl-0.3.6.tar.gz
Algorithm Hash digest
SHA256 e9123d2d47f726b47765be6620bafbe1e6f9fc70974a2b405601b89ca4bdc1e1
MD5 3d72fff550603e1f30a5eb7570c3ffe9
BLAKE2b-256 c1ae149a5343b3845d6a2b09606c675a174f05aa5f18a688eecc3108243cec1a

See more details on using hashes here.

Provenance

The following attestation bundles were made for nxsctl-0.3.6.tar.gz:

Publisher: publish.yml on nicetrykiddo/nxs

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file nxsctl-0.3.6-py3-none-any.whl.

File metadata

  • Download URL: nxsctl-0.3.6-py3-none-any.whl
  • Upload date:
  • Size: 19.4 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for nxsctl-0.3.6-py3-none-any.whl
Algorithm Hash digest
SHA256 fd71ccb32a1f6743158d13d89cc053a81a630760ed572b27a1b0f2eba4fc40f9
MD5 4b4f8e5888529c222eab103fb7fa3fbf
BLAKE2b-256 b65edfe441363a6fc2ce4ec00fd23a608493e0b393f11ff9d7d6ea1205c67a74

See more details on using hashes here.

Provenance

The following attestation bundles were made for nxsctl-0.3.6-py3-none-any.whl:

Publisher: publish.yml on nicetrykiddo/nxs

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

0.3.6 This release

2 files

0.3.5

2 files

0.3.4

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page