Active Directory AD Attacks

Windows & Active Directory Exploitation Cheat Sheet and Command ReferenceCas van Cooten

Attack Methodology

Phase	Page
AD Fundamentals	AD Overview
Initial Enumeration (LotL)	AD Enumeration Commands
LLMNR/NBT-NS Poisoning	LLMNR/NBT-NS Poisoning
Password Spraying	Password Spraying
Credentialed Enumeration	Credentialed AD Enumeration
Kerberos Attacks	Pentesting Kerberos
ACL Abuse	ACL Abuse
DCSync	DCSync
Domain Trust Abuse	Domain Trust Abuse
Misc Misconfigurations	Miscellaneous AD Misconfigurations

AD Enumeration Tools

• SharpView - .NET port of PowerView.ps1

• Windapsearch - LDAP Enumeration

• ldapsearch-ad - LDAP Enumeration

• Get-ADGroupMemberDate - Retrieve date a user was added

Active Directory GPO Tools

• SharpGPOAbuse - Abuse GPO edit rights

• Group3r - Enumerate and identify exploitable GPO misconfigurations

• GPOwned

• pyGPOAbuse - Python partial implementation of SharpGPOAbuse

AD Misc Tools

• GoldenGMSA - C# tool for abusing Group Managed Service Accounts (gMSA)

AD Lateral Movement Tools

• SharpRDP - .NET non-graphical RCE via RDP

• SharpNoPSExec - Leverages existing services without creating new ones

• NimExec - Fileless remote command execution via MS-SCMR

• EvilWinRM

• SharpWSUS - Lateral movement through WSUS

• KrbRelayUp - Wrapper around Rubeus and KrbRelay

• KrbRelay - Kerberos Relaying

• SharpSystemTriggers - Remote authentication triggers

• SpoolSample - PrinterBug Attack (Unconstrained Delegation)

Windows Attack Boxes

• Commando VM - Mandiant Windows security distribution

• Flare VM - Mandiant reverse engineering environment