CrackMapExec MCP Server

A Model Context Protocol (MCP) server that provides AI assistants with access to CrackMapExec/NetExec network penetration testing capabilities via SSH to a Kali Linux host.

Overview

This MCP server enables AI-powered network security assessments by exposing CrackMapExec (CME) / NetExec (NXC) functionality through the standardized MCP interface. It supports multiple protocols and comprehensive enumeration, credential dumping, and command execution capabilities.

Related MCP server: redteam-mcp

Features

Supported Protocols

Capabilities

• Enumeration: Shares, users, groups, sessions, computers, domain controllers

• Credential Dumping: SAM, LSA secrets, NTDS.dit, gMSA passwords

• Command Execution: cmd, PowerShell, via multiple methods (wmiexec, smbexec, atexec)

• Password Spraying: Multi-threaded credential testing with jitter support

• Module System: Extensible via NetExec modules

• Credential Database: Store and search discovered credentials

Installation

Prerequisites

• Node.js 18+

• SSH access to a Kali Linux host with NetExec/CrackMapExec installed

• SSH key-based authentication configured (recommended)

Setup

# Clone the repository
git clone https://github.com/schwarztim/sec-crackmapexec-mcp.git
cd sec-crackmapexec-mcp

# Install dependencies
npm install

# Build
npm run build

Configuration

Environment Variables

Claude Desktop Configuration

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "crackmapexec": {
      "command": "node",
      "args": ["/path/to/sec-crackmapexec-mcp/dist/index.js"],
      "env": {
        "KALI_HOST": "your-kali-host",
        "SSH_USER": "kali",
        "SSH_KEY": "/path/to/ssh/key"
      }
    }
  }
}

Available Tools

cme_smb

Execute SMB protocol operations including share enumeration, user enumeration, credential dumping, and command execution.

// Example: Enumerate shares
{ targets: "192.168.1.0/24", username: "admin", password: "pass123", shares: true }

// Example: Dump SAM hashes
{ targets: "192.168.1.100", username: "admin", password: "pass123", sam: true }

cme_winrm

Execute commands via Windows Remote Management (ports 5985/5986).

{ targets: "192.168.1.100", username: "admin", password: "pass123", execPowershell: "Get-Process" }

cme_ssh

Test SSH credentials and execute commands on Linux/Unix hosts.

{ targets: "192.168.1.0/24", username: "root", password: "toor", execCmd: "id" }

cme_mssql

Query MSSQL databases and execute OS commands via xp_cmdshell.

{ targets: "192.168.1.50", username: "sa", password: "password", query: "SELECT @@version" }

cme_ldap

Enumerate Active Directory via LDAP queries.

{ targets: "dc01.domain.local", username: "user", password: "pass", domain: "domain.local", usersEnabled: true }

cme_rdp

Validate RDP access to targets.

{ targets: "192.168.1.0/24", username: "admin", password: "pass123" }

cme_wmi

Execute commands via WMI.

{ targets: "192.168.1.100", username: "admin", password: "pass123", execCmd: "whoami" }

cme_modules

List available modules for a protocol or get module options.

// List SMB modules
{ protocol: "smb" }

// Get options for specific module
{ protocol: "smb", moduleName: "mimikatz" }

cme_spray

Perform password spraying attacks with jitter support.

{
  protocol: "smb",
  targets: "192.168.1.0/24",
  usernames: "users.txt",
  passwords: "Summer2024!",
  domain: "corp.local",
  jitter: "1-3"
}

cme_creds

Manage the NetExec credential database.

// List all credentials
{ action: "list" }

// Search credentials
{ action: "search", searchTerm: "admin" }

// Export credentials
{ action: "export", exportPath: "creds.csv" }

cme_raw

Execute raw NetExec commands for advanced operations.

{ command: "smb 192.168.1.100 -u admin -p pass123 --shares" }

Security Considerations

This tool is intended for authorized security testing only. Ensure you have:

1. Written authorization to test target systems

2. Proper scope definition for the engagement

3. Understanding of applicable laws and regulations

Never use this tool against systems without explicit permission.

Architecture

┌─────────────────┐      SSH      ┌─────────────────┐
│  Claude/AI      │ ────────────► │  Kali Linux     │
│  Assistant      │               │  + NetExec      │
├─────────────────┤               └─────────────────┘
│  MCP Server     │                      │
│  (Node.js)      │                      ▼
└─────────────────┘               ┌─────────────────┐
                                  │  Target Network │
                                  └─────────────────┘

Development

# Run in development mode
npm run dev

# Build for production
npm run build

# Start production server
npm start

License

MIT License - see LICENSE file for details.

Related Projects

• NetExec - The network execution tool

• Model Context Protocol - The MCP specification

• MCP SDK - Official MCP SDK

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Disclaimer

This software is provided for educational and authorized security testing purposes only. The authors are not responsible for any misuse or damage caused by this tool. Always obtain proper authorization before conducting security assessments.