blue0x1/nimuxPure-Nim network enumeration and remote execution toolkit for authorized security assessments. Supports SMB, LDAP, Kerberos, WinRM, database clients, secrets collection, DCSync, GPO operations, and SOCKS routing.
Pure-Nim network enumeration and remote execution toolkit
nimux is a native command surface for authorized security assessments. It combines network enumeration, lightweight web discovery, credential validation, Active Directory operations, Kerberos workflows, remote execution, file movement, secrets collection, DCSync, GPO operations, database clients, and SOCKS routing into one Pure-Nim toolkit.
Current release: v1.0.6
You are on the official public repository for nimux.
nimux is built for authorized testing only. Do not use it against third-party systems without written permission. Developers are not responsible for misuse, damage, or legal consequences.
Usage examples, command references, and workflow notes are maintained in the documentation:
Agent guidance and MCP integration files are available in SKILLS.md and integrations/.
The core nimux binary remains independent. AI integrations should call nimux as the native execution engine, prefer --json, use --dry-run before supported writes, and require explicit approval for execution or changes.
nimux-mcp is a separate MCP stdio wrapper for AI clients.
Location:
integrations/mcp/nimux-mcp
Build:
cd integrations/mcp/nimux-mcp
nimble build -y
Example MCP client config:
{
"mcpServers": {
"nimux": {
"command": "/path/to/nimux/integrations/mcp/nimux-mcp/nimux_mcp",
"env": {
"NIMUX_BIN": "/usr/local/bin/nimux",
"NIMUX_MCP_POLICY": "/path/to/policy.json"
}
}
}
}
The wrapper supports MCP Content-Length framed JSON-RPC, local newline-delimited JSON-RPC tests, policy checks, approval gates, redaction, progress notifications, and SOCKS pivot metadata.
Read more:
https://docs.nimux.wiki/mcp-integration
Nimble builds nimux from source, so native development libraries must be installed first. On Kali, Debian, or Ubuntu:
sudo apt update
sudo apt install -y build-essential ca-certificates git libssl-dev libkrb5-dev
nimble install nimux
Do not run Nimble with sudo. If Nimble reports an SSL certificate error,
refresh the system CA store before retrying:
sudo apt install --reinstall ca-certificates
sudo update-ca-certificates
nimble refresh
MinGW-w64 is optional for the base installation, but is required by execution paths that build Windows helper binaries:
sudo apt install -y mingw-w64
Prebuilt release assets are available on GitHub:
https://github.com/blue0x1/nimux/releases
Download the latest Linux binary or Debian package from the releases page.
Install the Debian package:
sudo dpkg -i nimux_*_amd64.deb
sudo apt --fix-broken install
Use the standalone Linux binary:
chmod +x nimux
./nimux --help
./nimux --version
The public container image is available from GitHub Container Registry:
docker run --rm -it --network host ghcr.io/blue0x1/nimux:latest --help
Run a scan:
docker run --rm -it --network host ghcr.io/blue0x1/nimux:latest \
scan 10.10.10.0/24 --port 445,389,5985 --open
Run lightweight web discovery:
nimux http app.example.local --dirs words.txt --workers 100 --status 200,301,302,403 --baseline
nimux http app.example.local --dirs words.txt --auto-calibrate --recursion --depth 2 --extract-links
nimux http app.example.local --files words.txt --extensions php,txt,bak --workers 100 --filter-regex 'Not Found' -fs 325
nimux http 192.0.2.10 --vhosts vhosts.txt -d app.example.local --workers 100 --resume seen.jsonl --json
nimux dns app.example.local --subdomains subdomains.txt --workers 200 --json
Run read-only SMB spidering:
nimux smb files01.example.local --shares
nimux smb files01.example.local --spider --share Public --max-depth 3
nimux smb files01.example.local --spider --interesting --size-limit 10485760
Run the MCP wrapper:
docker run --rm -i --network host --entrypoint nimux_mcp \
ghcr.io/blue0x1/nimux:latest
nimux is available on the AUR:
https://aur.archlinux.org/packages/nimux
Install with an AUR helper:
yay -S nimux
Or build manually:
git clone https://aur.archlinux.org/nimux.git
cd nimux
makepkg -si
nimux is available in BlackArch:
sudo pacman -S nimux
git clone https://github.com/blue0x1/nimux
cd nimux
nimble build -y
Requirements:
Build a local Debian package from source:
dpkg-buildpackage -us -uc -b
sudo apt install ../nimux_*.deb
nimux scan 10.10.10.0/24 --port 445,389,5985 --open
nimux smb dc01.example.local -u operator -H <nt_hash> -d example.local --shares --users
nimux smb files01.example.local -u operator -p '<password>' -d example.local --spider --max-depth 3 --interesting
nimux ldap dc01.example.local -u operator -p '<password>' -d example.local --bloodhound --legacy --bloodhound-out bh-legacy.zip
nimux winrm host.example.local -u operator -p '<password>' -d example.local --cmd whoami
nimux kerberos dc01.example.local -u operator -p '<password>' -d example.local --request kinit --out <ccache>
nimux scan 10.10.10.0/24 --port 445,389,5985 --proxy socks5://127.0.0.1:1080
ADCS policy and certificate workflow examples:
nimux ldap dc01.example.local -u '<gmsa-account>$' -H <nt_hash> -d EXAMPLE.LOCAL \
--adcs-policy --ca CORP-CA --adcs-get-disable-extension-list
nimux ldap dc01.example.local -u '<gmsa-account>$' -H <nt_hash> -d EXAMPLE.LOCAL \
--adcs-policy --ca CORP-CA \
--adcs-set-disable-extension-list 1.3.6.1.4.1.311.25.2
nimux ldap dc01.example.local -u <service-user> -p '<password>' -d EXAMPLE.LOCAL \
--adcs-request --adcs-rpc --ca CORP-CA --template User \
--upn <admin>@example.local \
--sid S-1-5-21-1111111111-2222222222-3333333333-500 \
--out <admin>.pfx
LDAP capture listener:
nimux ldap --server
nimux ldap --server --srvhost 0.0.0.0 --srvport 2222
nimux ldap --server --srvhost 0.0.0.0 --srvport 2222 --challenge 1122334455667788