Pearson's OSCP Notebook

nxcspray

Properties1
tagsnxcspray, netexec, nxc, crackmapexec, password-spray, credential-reuse, lateral-movement, smb, winrm, ldap, active-directory, oscp

4 min read

nxcspray — Multi-Protocol Credential Spray (NetExec)

nxcspray is a small bash script that runs nxc against multiple protocols and multiple targets with one username + password — ideal when you loot creds and need to find where they work across the subnet.

GitHub: NTHSec/nxcspray
NetExec docs: netexec.wiki · Target formats

Full nxc reference → CrackMapExec - nxc

OSCP use: Found user:password in a config, share, or mail → nxcspray all targets.txt -u user -p 'pass' instead of running six separate nxc commands.

Install

git clone https://github.com/NTHSec/nxcspray.git
cd nxcspray
sudo mv nxcspray /usr/local/bin/
sudo chmod +x /usr/local/bin/nxcspray
 
# Requires nxc (NetExec) on PATH
which nxc

Or download the single script from the repo and chmod +x.

Usage

nxcspray <protocols|all> <targets> -u <username> -p <password>
ArgumentDescription
protocolsComma-separated list: smb, ldap, winrm, rdp, mssql, ssh
allSpray smb, ldap, winrm, rdp, mssql, ssh (script default list)
targetsSingle IP/hostname or path to file (one target per line)
-uUsername
-pPassword (quote if special chars)

Help (no args):

nxcspray -h
# [-] Usage: nxcspray <protocols|all> <targets> -u <username> -p <password>

Examples

Spray SMB + WinRM against a target list

nxcspray smb,winrm targets.txt -u e.hills -p 'Il0vemyj0b2025!'

Spray all supported protocols against one host

nxcspray all 10.1.45.200 -u e.hills -p 'Il0vemyj0b2025!'

Subnet + common AD protocols

nxcspray smb,ldap,winrm 192.168.1.0/24 -u jsmith -p 'Summer2024!'

After looting creds on a box

# Build targets from nmap / nxc sweep
nxc smb 10.10.10.0/24 > hosts.txt   # or manual IP list
 
nxcspray all targets.txt -u caroline.robinson -p 'FoundPassword123!'

What all runs (from script source)

When you pass all, nxcspray loops these protocols in order:

smb → ldap → winrm → rdp → mssql → ssh

Each protocol × each target runs:

nxc "$PROTO" "$TARGET" -u "$USER" -p "$PASS"

Custom subset:

nxcspray smb,ldap,winrm DC_IP -u admin -p password

NetExec target formats

nxc (and nxcspray) accept the same target formats documented at netexec.wiki — Target Formats:

# Hostname
nxc smb dc.corp.local -u user -p pass
 
# Single IP
nxc smb 192.168.1.10 -u user -p pass
 
# Multiple IPs (space-separated)
nxc smb 192.168.1.0 192.168.0.2 -u user -p pass
 
# CIDR
nxc smb 192.168.1.0/24 -u user -p pass
 
# IP range
nxc smb 192.168.1.0-28 10.0.0.1-67 -u user -p pass
 
# File — one target per line
nxc smb ~/targets.txt -u user -p pass

nxcspray file targets: if the second argument is a file, the script reads one target per line and sprays each line for every protocol.

Combine formats in manual nxc when not using nxcspray — see CrackMapExec - nxc.

Before you spray — checklist

  1. Password policy — avoid lockouts:
nxc smb DC_IP -u known_user -p known_pass --pass-pol
nxc ldap DC_IP -u known_user -p known_pass --pass-pol

  1. Time sync (Kerberos / ldap kerberoast paths) → Time Sync

  2. Watch nxc output status codes → CrackMapExec - nxc > Output status codes

StatusAction
(Pwn3d!)Admin — shell/dump with evil-winrm, secretsdump
[+] greenValid creds — try RunasCs, WinRM, SMB shares
STATUS_PASSWORD_MUST_CHANGEChange password AD - NT_STATUS_PASSWORD_MUST_CHANGE — kpasswd / smbpasswd first
STATUS_ACCOUNT_LOCKED_OUTStop spraying that user

nxcspray vs other tools

SituationTool
One cred, many protocols + hostsnxcspray
One password, many users (spray)nxc smb -u users.txt -p 'OnePass' — CrackMapExec - nxc
Kerberos user enum / spray (no SMB)Kerbrute
Online brute single serviceHydra
Pass-the-Hashnxc -H — nxcspray is password only (no -H flag)

nxcspray does not replace Kerbrute for username discovery or nxc -u users.txt -p 'OnePass' for classic password spraying — it reuses known user+pass across protocols.

Typical OSCP workflow

Loot cred (config, share, mail, DB)
    ↓
nxc smb SUBNET --pass-pol          (if spraying users — not needed for single known pair)
    ↓
nxcspray all targets.txt -u USER -p 'PASS'
    ↓
(Pwn3d!) / [+] on winrm or smb
    ↓
[[evil-winrm]] · [[secretsdump]] · [[Credential Graph]]

Chain with Credential Discovery → LatMovement.

Limitations

  • Password only — no -H NTLM hash, no -d domain flag in wrapper (add domain to username: CORP/user or user@corp.local if nxc accepts)
  • Runs sequentially — no threading control (underlying nxc has -t)
  • For fine control (modules, --shares, --exec-method) use CrackMapExec - nxc directly

Quick cheat sheet

# Install
git clone https://github.com/NTHSec/nxcspray.git && sudo mv nxcspray/nxcspray /usr/local/bin/ && chmod +x /usr/local/bin/nxcspray
 
# All protocols, one IP
nxcspray all 10.10.10.10 -u admin -p 'Password123!'
 
# SMB + WinRM, target file
nxcspray smb,winrm targets.txt -u jsmith -p 'Summer2024!'
 
# Policy first
nxc smb DC_IP -u user -p pass --pass-pol

Graph View

Backlinks