CrackMapExec Tutorial

CrackMapExec (CME) is a powerful post-exploitation tool designed to assess and identify security weaknesses in Active Directory environments.

What is CrackMapExec?

CME combines the functionality of tools like PowerSploit and Impacket into a streamlined command-line interface for network scanning and credential testing.

Key Features:

Password spraying across networks
Domain user enumeration
SMB share discovery
Local admin mapping
LSA secrets extraction

Installation

Install CrackMapExec using Python pip:

pip3 install crackmapexec

Basic Usage Examples

Scan a network for SMB shares:

crackmapexec smb 192.168.1.0/24

Test credentials against multiple hosts:

crackmapexec smb 192.168.1.0/24 -u username -p password

Common Protocols

SMB: Windows file sharing
WinRM: Windows Remote Management
MSSQL: Microsoft SQL Server
LDAP: Directory services

Safety Considerations

Always obtain proper authorization before using CME on any network or system.

Best Practices:

Document all testing activities
Use dedicated testing environments when possible
Monitor system logs during testing
Coordinate with network administrators

Advanced Techniques

Dump local SAM hashes:

crackmapexec smb 192.168.1.100 -u admin -p password --sam

Check for BloodHound data:

crackmapexec smb 192.168.1.100 -u admin -p password -M bloodhound

Resources

Report bugs and issues on the GitHub Issues page.

Legal Notice

CrackMapExec should only be used for authorized security testing and penetration testing engagements.

Module Development

CrackMapExec supports custom modules for extended functionality.

Creating Custom Modules:

Python-based module structure
Access to core CME functions
Customizable output formats
Integration with existing modules

Reporting Features

CME includes built-in logging and reporting capabilities for documentation purposes.

Output Options:

Terminal output with color coding
JSON export functionality
Database logging
Custom report templates

Troubleshooting

Common issues and their solutions when using CrackMapExec:

Common Problems:

Authentication failures
Network connectivity issues
Module compatibility errors
Python dependency conflicts

Future Development

Ongoing development focuses on enhancing CME’s capabilities and security features.

Planned Features:

Enhanced protocol support
Improved evasion techniques
Additional automation options
Extended module library

Conclusion

CrackMapExec remains an essential tool for security professionals conducting Active Directory assessments. Its versatility, extensive feature set, and active development make it valuable for authorized security testing. Users must maintain ethical standards and obtain proper authorization before deployment.

FAQs

What is CrackMapExec (CME) and what is its primary purpose?
CrackMapExec is a post-exploitation tool that automates assessing security in Active Directory environments. It’s designed for network reconnaissance, credential gathering, and identifying common security misconfigurations.
Which protocols does CrackMapExec support?
CME supports multiple protocols including SMB, WMI, MSSQL, LDAP, SSH, and WINRM, allowing penetration testers to interact with various services across Windows networks.
How can I install CrackMapExec securely?
CrackMapExec can be installed through Python pip with ‘pip3 install crackmapexec’, through Docker, or by cloning the GitHub repository. The most stable method is using pip installation in a dedicated Python virtual environment.
What are the common flags used in CME commands?
Common flags include -u (username), -p (password), –local-auth (local authentication), -H (hash), and -M (modules). The –shares flag is used for enumerating shares, while -x executes commands.
How can CrackMapExec be used to enumerate domain users?
Use the command ‘crackmapexec smb target -u username -p password –users’ to enumerate domain users. This will list all users in the domain along with their properties.
What is the password spraying technique in CME?
Password spraying in CME involves testing a single password against multiple user accounts using the syntax ‘crackmapexec smb target -u users.txt -p password’. This helps avoid account lockouts by limiting attempts per account.
How does CME handle password hashes for authentication?
CME can perform Pass-the-Hash attacks using the -H flag followed by the NTLM hash. It accepts both LM:NTLM format and just NTLM hashes for authentication against Windows systems.
What modules are available in CrackMapExec?
CME includes modules like empire, mimikatz, enum_chrome, rdp, tokens, and spider_plus. These modules extend functionality for specific tasks like credential harvesting, browser data extraction, and share enumeration.
How can CME be used to identify vulnerable systems?
CME can identify systems vulnerable to specific exploits using modules and built-in checks. It can detect misconfigurations, unpatched systems, and weak security settings across the network.
What logging options does CrackMapExec provide?
CME logs results to ~/.cme/logs/ by default and supports various verbosity levels using -v flags. It can generate logs in multiple formats and provides real-time output of operations.

Author: Editor

Photo of author

Editor

January 5, 2025

Tool Documentation Standards

documentation standards

Documentation standards ensure consistency, clarity, and effectiveness when recording findings during penetration testing engagements. Proper documentation helps security teams track vulnerabilities, communicate issues to stakeholders, and maintain an audit trail ... Read more

Testing Tool Integration

tool integration

Testing tool integration is a critical aspect of cybersecurity assessment that combines various security testing tools to create a more robust and comprehensive penetration testing workflow. Security professionals need efficient ... Read more

Automation Framework Design

automation framework

An automation framework streamlines and standardizes penetration testing processes, making security assessments more efficient and repeatable. Properly designed frameworks reduce manual effort while maintaining testing quality and consistency across different ... Read more

Exploitation Tool Development

tool development

Penetration testing tools require careful development to effectively identify security vulnerabilities in systems and networks. Security professionals need specialized exploitation tools that can safely simulate real-world attacks without causing damage. ... Read more

Security Tool Architecture

tool architecture

Security tool architecture forms the backbone of effective penetration testing, enabling security professionals to systematically probe systems for vulnerabilities. A well-structured security testing toolkit combines reconnaissance tools, vulnerability scanners, exploitation ... Read more

Build Server Security

build security

Security testing of build servers protects the foundation of software development and deployment processes from potential threats and vulnerabilities. Build servers handle sensitive data, access credentials, and control deployment pipelines, ... Read more

Secret Management

secrets management

Secret management stands as a cornerstone of cybersecurity, particularly during penetration testing operations where handling sensitive data requires meticulous care and precision. Penetration testers must safeguard various types of secrets ... Read more

Deployment Security

deployment security

Penetration testing during deployment phases helps organizations identify security vulnerabilities before applications go live. Security teams use automated and manual testing methods to simulate real-world attacks against newly deployed systems ... Read more