nxs

What can this cred actually do?

nxs is a credential capability mapper powered by NetExec. It takes a credential and checks it against 10 different protocols (SMB, LDAP, WMI, WinRM, SSH, RDP, MSSQL, FTP, VNC, NFS) to show you exactly what level of access you have on the target.

Install

pipx install nxsctl

Requires NetExec (nxc) in PATH.

Usage

nxs 10.10.10.10 -u john.doe -p 'Password123' -d domain.local

Password prompt if -p is omitted:

nxs 10.10.10.10 -u john.doe -d domain.local

Hash authentication:

nxs 10.10.10.10 -u john.doe -H NT_HASH -d domain.local
nxs 10.10.10.10 -u john.doe -H LM_HASH:NT_HASH -d domain.local

Quickstart

IPv6-only hostnames (including /etc/hosts) are detected automatically. IPv4 is preferred for dual-stack hosts unless -6 is explicitly requested.

nxs compatibility -u test -p 'pass@123'
nxs compatibility -6 -u test -p 'pass@123'  # Force IPv6
nxs dead:beef::1001 -u test -p 'pass@123'

Mixed IPv4 and IPv6 target files are scanned in separate Nmap runs. Nmap failures are reported instead of silently being treated as 0 open ports.

nxs 10.10.10.10 -u admin -p 'Password123!'

# Spray a file of credentials (format: user:pass or user:hash)
nxs 10.10.10.10 -f creds.txt

# Password spray — one password across a user list
nxs 10.10.10.10 -u users.txt -p 'Password123!'

# All combinations — every user × every password (-C/--combo)
nxs 10.10.10.10 -u users.txt -p passwords.txt -C

# Specific protocols
nxs 192.168.1.0/24 -u john.doe -H 'LM:NT' --protocols ssh,winrm

OPSEC mode (single-threaded, low retry):

nxs 10.10.10.10 -u john.doe -p 'Password123' -d domain.local --opsec

Kerberos:

nxs 10.10.10.10 -u john.doe -p 'Password123' -d domain.local -k --kdc-host dc01.domain.local

# Authenticate with a ccache ticket file (no password needed):
nxs 10.10.10.10 -T user.ccache

# Scan a directory of tickets:
nxs 10.10.10.10 -T ./tickets/

JSON output:

nxs 10.10.10.10 -u john.doe -p 'Password123' --json
nxs 10.10.10.10 -u john.doe -p 'Password123' --json --raw

Save raw proof:

nxs 10.10.10.10 -u john.doe -p 'Password123' --save loot/

Verbose output (detailed execution info, WIP...):

nxs 10.10.10.10 -u john.doe -p 'Password123' --verbose

Example Output

nxs v0.1.0 10.10.10.10 · john.doe@domain.local · 4 protocols

  [+] SMB    WRITE    Shared[READ+WRITE], Web[READ]
  [+] LDAP   READ     Enumerated 15 domain users
  [-] WINRM  NO       Authentication failed

With --verbose, detailed output is nested underneath:

nxs v0.1.0 10.10.10.10 · admin · 1 protocols

  [+] WINRM  EXEC     domain.local\admin
      ↳ USER INFORMATION
      ↳ ----------------
      ↳ User Name         SID
      ↳ ================= ============================================
      ↳ domain\admin      S-1-5-21-3623811015-3361044348-30300820-500

Access Levels

License

MIT