Active Directory — Hub
External: Internal All The Things — Enumeration External: Internal All The Things — AD Tricks
Tools for Windows domain environments — enumerate users, capture or relay NTLM hashes, abuse Kerberos, map attack paths, and dump credentials.
OSCP workflow: Kerbrute user enum → Kerberoast / AS-REP → Bloodhound + Sharphound map paths → Impacket for shells & dumps → Responder on internal nets.
For domain concepts, see AD and Kerberos.
Install AD tools on Kali: Installation - Kali Setup > 📌 Active Directory (Kali-side)
Decision trees: Attack Path Graph · Credential Graph · Credential Discovery
📌 Tools in This Folder
| Note | Purpose |
|---|---|
| Kerbrute | Valid username enum & password spray (Kerberos) |
| nxcspray | Multi-protocol cred reuse — one user+pass via nxc |
| krb5-user | kinit, klist, kpasswd — Kerberos client & password change (port 464) |
| Kerberoast | Kerberoasting & AS-REP roasting |
| Bloodhound + Sharphound | AD attack path mapping (UI + analysis) |
| SharpHound | BloodHound data collector (Windows on-box) |
| RustHound | BloodHound collector (Rust — Linux/Windows/macOS) |
| bloodyAD | LDAP read/write — DCSync, GenericAll, RBCD, ACL abuse |
| PowerView | PowerShell AD enum from Windows shell (Recon) |
| PowerSploit | PowerShell offensive framework — PowerView, PowerUp hub |
| PowerUp | Windows local privesc — services, registry (on-box) |
| Active Directory Cmdlets | Get-ADUser, Get-ADComputer, Get-ADGroup (RSAT) |
| Mimikatz | Credential dump on Windows (on-box) |
| pypykatz | Parse LSASS dumps / registry hives offline on Kali |
| Responder | LLMNR/NBT-NS poison → capture NTLMv2 |
| ntlm_theft | Malicious files → force NTLM to your listener |
| Rubeus | Windows Kerberos — roast, PtT, golden/silver tickets |
| Certipy & Certify | AD CS abuse — Certipy (Linux) + Certify (Windows) |
| AD CS ESC | ESC1–ESC16 index — detect, exploit, Hacker Recipes links |
| Shadow Credentials - pywhisker | GenericWrite → pywhisker → PKINITtools → NT hash |
| RunasCs | Run process as another user — creds on Windows shell, -l 8, reverse -r |
| krbrelayx | dnstool (ADIDNS) · addspn · printerbug · Kerberos relay |
| gMSADumper | Dump gMSA passwords (ReadGMSAPassword) |
| GMSA - Group Managed Service Accounts | gMSA attributes, extraction tools, Golden GMSA |
| dMSA - Delegated Managed Service Accounts | BadSuccessor, dMSA credential dumping (Server 2025) |
AD Permissions (BloodHound ACL abuse)
| Note | Purpose |
|---|---|
| AD Permissions | Hub — every DACL right → exploit file |
| WriteDacl | WriteDACL on Domain → DCSync |
| GenericAll | Full control by target type |
| GenericWrite | Shadow creds · RBCD · SPN |
| ForceChangePassword | Reset victim password |
| AllExtendedRights | Extended rights bundle |
| WriteOwner | Take ownership → grant rights |
| AddMember | Join privileged group |
| AD CS Permissions | Certificate template & CA ACLs → ESC4/ESC7 |
| DCSync | Dump all domain hashes — secretsdump / nxc —ntds |
| HasSession | Session on computer → cred theft via LSASS |
📌 Attack Chains
No creds yet
[[Kerberos Setup - krb5.conf]] — hosts + /etc/krb5.conf (nxc --generate-krb5-file)
[[Time Sync]] — `timedatectl set-ntp false` then `sudo ntpdate -s DC_IP` (Kerberos requires ±5 min)
Kerbrute userenum → GetNPUsers (AS-REP) → Kerberoast → crack with [[Hashcat]]
Port 5222 (XMPP)? → Pidgin user search → users.txt → GetNPUsers / Kerbrute
On internal network
Responder (capture) → crack OR [[ntlmrelayx]] relay → [[secretsdump]] → Pass-the-Hash
With domain user
BloodHound collect → path to DA → [[bloodyAD]] / [[Impacket]] psexec/wmiexec → [[evil-winrm]]
AD CS misconfig? → [[Certipy & Certify]] find → [[AD CS ESC]] (ESC1/8/9) → req / auth
📌 Related Tool Suites
| Need | Go to |
|---|---|
| Impacket scripts (GetUserSPNs, secretsdump, relay) | Impacket |
| SMB enum | SMB |
| Crack captured hashes | Password Attacks |
| WinRM shell | evil-winrm in Remote Access |
| XMPP user enum (5222) | Pidgin in Recon |
| LDAP enum (389) | ldapsearch in Recon |
| Kerberos on Windows shell | Rubeus |
| AD Certificate Services | Certipy & Certify · AD CS ESC |
Related Tools
- Time Sync
- Impacket
- CrackMapExec - nxc
- Kerbrute
- nxcspray
- krb5-user
- Kerberoast
- Rubeus
- SharpHound
- RustHound
- bloodyAD
- Mimikatz
- pypykatz
- RunasCs
- PowerView
- Active Directory Cmdlets
- PowerShell Cmdlets