Skip to content

Windows AD

  • AD is based on the protocols x.500 and LDAP

If you do NOT HAVE DOMAIN creds:

  • Kerbrute to find valid usernames
  • Kerbrute to find usernames that do not require krb pre authentication
  • ASREPRoasting
  • LLMNR Poisoning
  • Password policy and spraying
  • GPP Policy having encrypted passwords
  • Check passwords in description, Password not required options

If you HAVE DOMAIN creds:

  • Enumerate security controls - LAPS
  • Credentialed Enum using Linux
    • domain enum
    • user enum
    • share enum
    • rpcclient
    • psexec
    • windapsearch
    • bloodhound
  • Credentialed Enum using Windows
    • PowerShell
    • PowerView
    • Domain enum
    • Trust enum
    • local admin access
    • SPN enum (kerberoasting)
    • SharpView if no Powerview
    • Snaffler to get creds saved on machine
    • BloodHound
  • LOTL
  • Kerberoasting (Getting a users SPN) Impacket-GetUserSPNs
  • TargetedKerberoasting (GenericWrite)
  • AD CS
  • Shadow Credentials
    • pywhisker
  • ACL Enum and Abuse
  • DCSync (replication privileges) - Impacket-secretsdump
  • CVEs
  • Domain Trusts
    • Cross Forest
    • Parent child