Active Directory
Initial Attack Vectors
Internal: --------- Attack vectors that are ideal for internal penetration tests, where the att...
LLMNR Poisoning (Internal)
Note: Network Environment Given that LLMNR is a name resolution protocol that works on the Local...
SMB Relay (Internal/External)
Note: Network Environment This attack works best in a flat network. However, as long as the atta...
IPv6 DNS Spoofing (Internal)
Note: Network Environment This spoofing attack and works by sending a router announcement to mul...
Passback Attacks (Internal/External)
What's the Flaw? Usually involves an unsecure device -- like a printer or multifunction device -...
PrintNightmare (Internal/External)
Remote Code Execution https://github.com/cube0x0/CVE-2021-1675 Contains full details on scannin...
Post Exploitation: Enumeration
PowerShell AD Module on Any Domain Host as Any User
Borrow a DLL Normally, one must install RSAT (Remote Server Administration Tools) on a host to m...
Enumerating Hosts and Identifying the Domain Controllers
Post-Compromise Enumeration Enumerating Hosts PowerShell Ping Sweep on Target Not the most rel...
Dumping DNS Records with adidnsdump
Active Directory Integrated DNS Dump (adidnsdump) GitHub Repository Installation python3 -m pi...
CrackMapExec
When to Use Useful post-compromise if you've dumped hashes from SAM or LSASS or obtained clearte...
PowerView
Overview A set of PowerShell functions that can be used to enumerate ActiveDirectory. Part of th...
BloodHound
1. Installation sudo apt install -y neo4j bloodhound 2. Setup sudo neo4j console & Nav...
Remote Bloodhound
GitHub Repo Prerequisites impacket ldap3 dnspython Installation python3 -m pip insta...
LdapDomainDump
When to Use You'll know when you've found a domain controller, because it will have ...
LdapSearch
When to Use You'll know when you've found a domain controller, because it will have several por...
Enum4Linux
Details Enum4linux is a tool for enumerating information from Windows and Samba systems. It at...
GetADUsers.py
When to Use Helpful in post-compromise enumeration. If you've compromised a domain-joined host, ...
GetUserSPNs.py
When to Use Useful in post-compromise enumeration. If you acquire user passwords or hashes for a...
Manual Enumeration
Users net.exe Local net user net user <username> Domain net user /domain net user <usern...
Post Exploitation: Attacks
Mimikatz
Overview https://github.com/gentilkiwi/mimikatz There are various spin-offs of the Mimikatz pro...
Dumping Hashes without Mimikatz
Post-Compromise on Target Lsass Process Dump Sysinternals ProcDump Download ProcDump here # D...
Impacket-Addcomputer
When to Use Could be used post-compromise upon enumerating the ms-DS-MachineAccountQuota policy....
DCSync
DCSync Overview DC Sync is a legitimate function of Active Directory environments where a domain...
Pass the Password
Overview Cracked a hash or discovered a password for a domain user. Use the password and crackma...
Pass the Hash
Overview Dumped the SAM or LSA and now have hashes for domain or a local users. Use the hash and...
Password & Credential Brute Force
User Emumeration You have enumerated users with one of the methods defined here: CrackMapExec...
Token Impersonation
Overview Tokens are temporary keys that allow a user to perform actions on a system or network w...
Kerberoasting
Overview The attacker uses a known username and password of a user on a domain. A typical Kerbe...
Group Policy Preferences (GPP)
Overview GPP allows admins to create policies with embedded credentials. The credentials are enc...
PrintNightmare
Local Privilege Escalation https://github.com/calebstewart/CVE-2021-1675
ZeroLogon
Caution This can potentially break a domain controller, due the fact that this attack temporaril...