CrackMapExec VS impacket

Let’s walk through a typical attack against the Administrator account using a popular tool, CrackMapExec.

Attackers like to use crackmapexec to exploit Windows networks and machines. It can achieve various goals like enumerating users, cracking SMB shares, and injecting shellcode into memory.

After gaining a local administrator NTLM password hash using SMB relay attacks, Redbot Security used the “CrackMapExec” tool to pass the local administrator hash to all systems and found multiple systems using the same password:

ntlmrelayx2proxychains aims to connect the tool of the SecureAuthCorps' impacket suite, ntlmrelayx.py (hereafter referred to as "ntlmrelayx"), along with @byt3bl33d3r's tool, CrackMapExec (hereafter referred to as "CME"), over proxychains, developped by haad.

CrackMapExec - Swiss army knife for pentesting networks.

Regarding network shares, I personally tend to use crackmapexec with a list of systems. It won't list the ACLs but it is very good at finding out what a standard domain user could access (if this is what you are after) https://github.com/byt3bl33d3r/CrackMapExec

On the dedicated attack machine, install Impacket via:

https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py. (see the docs at the top of the program)

The first result on google for "Python SMB server" literally has a working example

Impacket is now in python 3 also. https://github.com/SecureAuthCorp/impacket