~/bokkapig
hack the box machine writeups

Nmcap.exe

type: OtherMSBinaries
Command-line packet capture utility from Microsoft Network Monitor 3.x.

Full path

C:\Program Files\Microsoft Network Monitor 3\nmcap.exe
C:\Program Files (x86)\Microsoft Network Monitor 3\nmcap.exe

Commands

  1. ReconnaissanceAdministrator T1040

    Capture network traffic on windows to collect sensitive data.

    nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}

    Start capture on all network adapters and save to specified .cap (circular) file. Optionally, one can add:

    • /TerminateWhen /TimeAfter 30 seconds to auto-terminate after a relative times (e.g. 30 seconds);
    • /TerminateWhen /Time 04:52:00 AM 9/17/2025 to auto-terminate after a specific date/time;
    • /TerminateWhen /KeyPress x to terminate when a specific key is pressed.

    os: Windows

Resources

acknowledgement: Avihay Eldad @AvihayEldad