← Cheatsheets

Active Directory

Enumeration, Kerberos, ACL abuse, AD CS and post-exploitation, chaining ACEs and tickets up to the DC.

grep>

Enumeration

Enumeration32 commands

Without credentials
LDAP / domain dump
Users & groups
LAPS
GPP / SYSVOL
ADCS
Domain DNS
Shares
BloodHound
PowerView: users & SPN
PowerView: ACL & groups
PowerView: local access & shares
PowerView: environment & LAPS
Tools

Access & credentials

LLMNR / NBT-NS poisoning13 commands

Responder
Inveigh
Crack / relay
Relay targets
mitm6 (IPv6)

Password spraying14 commands

Enumerate policy
kerbrute
netexec
PowerShell

Kerberos22 commands

Clock
AS-REP Roasting
Kerberoasting
Ticket use
Delegation / CredSSP

Privilege & certificate abuse

ACL / DACL abuse26 commands

ForceChangePassword
GenericWrite (targeted Kerberoast)
AddMember
GenericAll / bloodyAD
RBCD
Shadow Credentials
Owner / DACL edit
Read DACL

AD CS (certificates)18 commands

Find templates
ESC1 (req with UPN)
ESC (others)
Authenticate with PFX
Shadow / relay
Convert PFX

Coercion, trusts & lateral movement

Coercion & DC CVEs (NoPac, PetitPotam, PrintNightmare)12 commands

NoPac
PrintNightmare
PetitPotam
Relay to AD CS
PKINIT / hash

Trusts: child > parent & cross-forest13 commands

Map trusts
Child > parent (SID history)
Cross-forest
Usage

Post-exploitation & lateral35 commands

Dump: LSASS / mimikatz
Dump: remote secretsdump
Dump: local SAM/SYSTEM
Dump: netexec (NTDS/SAM/DPAPI)
Dump: GPP
DCSync
Pass-the-Hash
Golden / Silver ticket
Ticket use
Remote execution
DNS / spooler
Remote enumeration
AD Recycle Bin