Guide · Agent skill
How to use the NetExec (nxc) Active Directory agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-netexec skill gives an AI agent a detailed reference manual for NetExec (nxc), an open-source tool penetration testers use to probe Windows Active Directory networks. Once installed, the agent answers questions about nxc syntax, authentication options, password spraying, credential dumping, Kerberoasting and lateral movement with ready-to-run command examples and flag explanations. This guide is for security professionals and students working in authorised lab environments, and it explains how to install the skill, trigger it and use it safely.
NetExec Active Directory ReferenceSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Get the skill file. Download the offensive-netexec ZIP from this page. The skill is a single SKILL.md file.
- 2Place it in your skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder to limit it to that project.
- 3Or upload it in the Claude apps. In the Claude apps, open Settings, then Capabilities, then Skills, and upload the skill there.
- 4Install NetExec on your machine. The skill's commands require NetExec (nxc) on the machine where you run them. The skill does not install it for you.
- 5Ask a specific question. Name the protocol, the target and what credentials you have, for example an SMB share listing with a domain user.
- 6Check the output markers. Use the colour codes and Pwn3d! meanings from the skill to read results, and confirm you are authorised for every target.
What the skill makes the agent do
The skill supplies documentation and examples. It does not scan, connect to or attack anything itself. When you ask about nxc commands, the agent answers from the skill's reference content, so you get command lines and an explanation of each flag.
The skill's description says it covers all listed protocols, modules and core features of NetExec. The protocols it lists are smb, ssh, ldap, ftp, wmi, winrm, rdp, vnc, mssql and nfs.
- Global syntax: nxc <protocol> <target(s)> [auth options] [action options] [global options]
- Target formats: CIDR ranges, IP ranges, hostnames, multiple IPs and target files
- Authentication: passwords, NT hashes, local auth, Kerberos and credential IDs
- Password spraying, brute force and throttling with jitter
- SMB enumeration, spidering, file operations and command execution
- Output colour codes and what Pwn3d! means for each protocol
Install the offensive-netexec skill in Claude
Download the skill ZIP from this page. The skill is a single file, SKILL.md, so the unzipped folder should contain that file. You can install it in one of two ways.
For a personal install, unzip the folder into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder instead. In the Claude apps, you can also upload the skill under Settings, then Capabilities, then Skills.
- Personal: ~/.claude/skills/
- Single project: the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills
Trigger the skill with natural requests
You do not need to name the skill. The skill's description lists the topics that should activate it, including any mention of nxc or NetExec, AD enumeration, password spraying, credential dumping, Kerberoasting, ASREPRoasting, lateral movement, BloodHound collection and module usage.
Ask a specific question with the context you have, such as the protocol, the target range and whether you have credentials. The skill is written to give full command examples with correct flags, so precise questions get more useful answers.
- How do I list SMB shares on 192.168.1.0/24 with a valid domain user?
- Show me the nxc flags for authenticating with an NT hash instead of a password.
- What does the Pwn3d! label mean for WinRM and for LDAP?
- Which nxc options should I use to spray one password without locking accounts?
Example: check the password policy before spraying
The skill's own guidance is to check the domain password policy before any spraying, because spraying can trigger account lockouts. Its OpSec note also says that jitter works per host and that spraying several hosts multiplies authentication attempts.
The skill describes --no-bruteforce as pairing user[0] with pass[0], user[1] with pass[1], and so on. Without it, every user is tried with every password.
nxc smb <target> -u user -p pass --pass-polRead output: colour codes and Pwn3d!
The skill lists four output markers. RED means authentication failed. GREEN means authentication succeeded. MAGENTA means the password is valid but the account is not an admin. (Pwn3d!) means admin access or code execution is available.
What Pwn3d! implies depends on the protocol. The skill's table says SMB means local or domain admin access, WMI means local admin, WinRM and RDP mean code execution, VNC means code execution, LDAP means a path to Domain Admin, SSH means root access, and FTP has no check.
- RED: authentication failed
- GREEN: authentication succeeded
- MAGENTA: password valid, account not admin
- (Pwn3d!): admin access or code execution available
Safety, scope and what the skill does not do
The skill's listing says it runs no scripts and uses no network. The commands it shows do touch the network once you run them yourself, so the risk sits with the person running nxc, not with the documentation.
The skill produces offensive command lines for password spraying, credential dumping and lateral movement. These can lock out accounts and cause serious harm if used against systems you do not own or have written permission to test. Only use them in authorised engagements or lab environments you control.
The skill is oriented toward offence rather than hardening. Beginners looking for a defensive-only guide should look elsewhere.
- Requires NetExec (nxc) installed on the machine where commands run
- Requires target network access and authorisation to test it
- Check lockout policy with --pass-pol before spraying
- Use --jitter to slow authentication attempts
What people use it for
- Looking up the nxc flags for authenticating with a password, an NT hash, a local account or a Kerberos ticket.
- Checking SMB signing and SMBv1 status across a subnet from the first scan output.
- Planning a throttled, lockout-aware password spray in an authorised test after reviewing the password policy.
- Learning how Kerberoasting, ASREPRoasting and lateral movement are structured in an authorised lab.
- Finding the right nxc module syntax, such as enum_av or spider_plus, for a specific check.
Frequently asked questions
How do I install the NetExec agent skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings, then Capabilities, then Skills.
Do I need NetExec installed to use the skill?
Yes. The skill supplies documentation and examples, so the nxc commands it produces only run on a machine where NetExec (nxc) is installed. You also need network access to the target and authorisation to test it.
Is the NetExec skill free?
The listing for this skill states the MIT licence. This page does not list any price, so check the licence text and the source repository for the terms that apply to you.
Does the skill scan or attack my network?
No. The skill's listing says it only supplies documentation and examples and does not itself scan or attack anything. Any command you run from its examples will touch the network, so only run them against systems you are authorised to test.
Why does my nxc output show red or magenta results?
According to the skill, red means authentication failed and magenta means the password is valid but the account is not an admin. Green means authentication succeeded. Check your username, password or hash and the target before retrying.
How does this compare with other tools?
This page does not compare the skill with other tools. The skill covers NetExec only, and its content is oriented toward offence, so it is not a defensive or hardening guide.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security professionals who already use NetExec and want fast, accurate nxc syntax, and students learning Active Directory attack structure in authorised labs. It is not suited to anyone planning to test networks without written permission, or to beginners who want a defensive-only guide.
Download the skill