Checking Credentials (Domain)

Authentication

Failed logins result in a [-]
Successful logins result in a [+] Domain\Username:Password

Info

Code execution results in a (Pwn3d!) added after the login confirmation. With SMB protocol, most likely your compromised user is in the local administrators group.

    SMB         192.168.1.101    445    HOSTNAME          [+] DOMAIN\Username:Password (Pwn3d!)

The following checks will attempt authentication to the entire /24 though a single target may also be used.

Warning

If NTLM authentication is not available, Kerberos requires the hostname and domain name instead of an IP address.

User/Password

nxc smb <CIDR> -u <USERNAME> -p <PASSWORD>

User/Hash

After obtaining credentials such as\ Administrator:500:aad3b435b51404eeaad3b435b51404ee:13b29964cc2480b4ef454c59562e675c:::\ you can use both the full hash or just the nt hash (second half)

nxc smb <CIDR> -u <USERNAME> -H 'LM:NT'
nxc smb <CIDR> -u <USERNAME> -H 'NTHASH'
nxc smb <CIDR> -u <USERNAME> -H <HASH>
nxc smb <CIDR> -u <USERNAME> -H <HASH>