Active Directory
Resources
Last updated
Resources
Last updated
Useful Tools
• PingCastle – https://www.pingcastle.com/
• Bloodhound – https://github.com/BloodHoundAD/BloodHound
• Adalanche – https://github.com/lkarlslund/adalanche
• ADACLScanner – https://github.com/canix1/ADACLScanner
• SysInternals – https://docs.microsoft.com/en-us/sysinternals/
AdFind - http://www.joeware.net/freetools/tools/adfind/index.htm
Attacking Active Directory: Initial Attack Vectors
Combining NTLM Relays and Kerberos Delegation:
Attacking Active Directory: Post-Compromise Enumeration
PowerView Cheat Sheet:
Attacking Active Directory: Post-Compromise Attacks
Group Policy Pwnage:
Mimikatz:
Active Directory Security Blog:
Harmj0y Blog:
Pentester Academy Active Directory:
Pentester Academy Red Team Labs:
eLS PTX:
INITIAL ACCESS
Responder
responder -I eth0 -dw
copy all the hash
gedit ntlmhash.txt
Captured Hash cracking with Hashcat
hashcat -m 5600 ntlmhash.txt rockyou.txt --force (VM)
hashcat64.exe -m 5600 ntlmhash.txt rockyou.txt -O (WIN)
MITM6
-----------------------------------------------------------------------------------------------------
Pass the pass & pass the hash
Token Impersonation
Kerberoasting
Mimikatz > Golden ticket
Additional Resources:
Responder config for SMB relay attack
ntlmrelayx.py -tf targets.txt -smb2support
