Using Credentials

Using Credentials
Every protocol supports using credentials in one form or another. For details on using credentials with a specific protocol, see the appropriate wiki section.
Generally speaking, to use credentials, you can run the following commands:
1
crackmapexec <protocol> <target(s)> -u username -p password
Copied!
When using usernames or passwords that contain special symbols, wrap them in single quotes to make your shell interpret them as a string.
Example:
1
crackmapexec <protocol> <target(s)> -u username -p '[email protected]'
Copied!
Due to a bug in Python's argument parsing library, credentials beginning with a dash (-) will throw an expected at least one argument error message. To get around this, specify the credentials by using the 'long' argument format (note the = sign):
crackmapexec <protocol> <target(s)> -u='-username' -p='[email protected]'
Using a credential set from the database
By specifying a credential ID (or multiple credential IDs) with the -id flag CME will automatically pull that credential from the back-end database and use it to authenticate (saves a lot of typing):
1
crackmapexec <protocol> <target(s)> -id <cred ID(s)>
Copied!
Multi-domain environment
​https://github.com/byt3bl33d3r/CrackMapExec/issues/243​
You can use CME with mulitple domain environment
1
crackmapexec <protocol> <target(s)> -p FILE -u password
Copied!
Where FILE is a file with usernames in this format
1
DOMAIN1\user
2
DOMAIN2\user
Copied!
Brute Forcing & Password Spraying
All protocols support brute-forcing and password spraying. For details on brute-forcing/password spraying with a specific protocol, see the appropriate wiki section.
By specifying a file or multiple values CME will automatically brute-force logins for all targets using the specified protocol:
Examples:
1
crackmapexec <protocol> <target(s)> -u username1 -p password1 password2
Copied!
1
crackmapexec <protocol> <target(s)> -u username1 username2 -p password1
Copied!
1
crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -p ~/file_containing_passwords
Copied!
1
crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes
Copied!
Password Spraying without bruteforce
Can be usefull for protocols like WinRM and MSSQL. This option avoid the bruteforce when you use files (-u file -p file)
1
crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes --no-bruteforce
Copied!
1
crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -p ~/file_containing_passwords --no-bruteforce
Copied!
1
user1 -> pass1
2
user2 -> pass2
Copied!
By default CME will exit after a successful login is found. Using the --continue-on-success flag will continue spraying even after a valid password is found. Usefull for spraying a single password against a large user list.
1
crackmapexec <protocol> <target(s)> -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes --no-bruteforce --continue-on-success
Copied!

Getting Started - Previous

Target Formats

Next - Getting Started

Using Kerberos

Last modified 1yr ago

Copy link

Contents

Using Credentials

Using a credential set from the database

Multi-domain environment

Brute Forcing & Password Spraying

Password Spraying without bruteforce