Active-Directory-Exploitation-Cheat-Sheet - A cheat sheet that contains common enumeration and

项目说明

Acti Exploitation Cheat Sheet

This cheat sheet contains common enumeration and attack methods for Windows Acti.

ℹ️ This repository was created by Nikos Katsiopis and Nikos .

This cheat sheet is inspired by the PayloadAllTheThings repo.

!Just Walking The Dog

Summary

Acti Exploitation Cheat Sheet

- Summary
- Tools
- Domain Enumeration
- Using PowerView
- Using AD Module
- Using BloodHound
- Remote BloodHound
- On Site BloodHound
- Using Adalanche
- Remote adalanche
- Export Enumerated Objects
- Useful Enumeration Tools
- Local Pri Escalation
- Useful Local Priv Esc Tools
- Lateral Mo
- Powershell Remoting
- Remote 代码 Execution with PS Credentials
- Import a PowerShell Module and Execute its Functions Remotely
- Executing Remote Stateful commands
- Mimikatz
- Remote Desktop Protocol
- URL File Attacks
- Useful Tools
- Domain Pri Escalation
- Kerberoast
- ASREPRoast
- Password Spray Attack
- Force Set SPN
- Abusing Shadow Copies
- List and Decrypt Stored Credentials using Mimikatz
- Unconstrained Delegation
- Constrained Delegation
- Resource Based Constrained Delegation
- DNSAdmins Abuse
- Abusing Acti DNS
- Abusing Backup Operators Group
- Abusing Exchange
- Weaponizing Printer Bug
- Abusing ACLs
- Abusing IPv6 with mitm6
- SID History Abuse
- Exploiting SharePoint
- Zerologon
- PrintNightmare
- Acti Certificate Services
- No PAC
- Domain Persistence
- Golden Ticket Attack
- DCsync Attack
- Sil Attack
- Skeleton Key Attack
- DSRM Abuse
- Custom SSP
- Cross Forest Attacks
- Trust Tickets
- Abuse MSSQL Servers
- Breaking Forest Trusts

Tools

Powersploit

PowerUpSQL

Powermad

Impacket

Mimikatz

Rubeus -> Compiled

BloodHound

AD Module

ASREPRoast

Adalanche

Domain Enumeration

Using PowerView

Powerview v.3.0<br>
Powerview Wiki

Get Current Domain: Get-Domain

Enumerate Other Domains: Get-Domain -Domain <DomainName>

Get Domain SID: Get-DomainSID

Get Domain Policy:

Get Domain Controllers:

Enumerate Domain Users:

Enum Domain Computers:

Enum Groups and Group Members:

Enumerate Shares:

Enum Group Policies:

Enum OUs:

Enum ACLs:

Enum Domain Trust:

Enum Forest Trust:

User Hunting:

:hea: Priv Esc to Domain Admin with User Hunting: \
I ha admin access on a machine -> A Domain Admin has a session on that machine -> I steal his token and impersonate him -> Profit!

Using AD Module

Get Current Domain: Get-ADDomain

Enum Other Domains: Get-ADDomain -Identity <Domain>

Get Domain SID: Get-DomainSID

Get Domain Controlers:

Enumerate Domain Users:

Enum Domain Computers:

Enum Domain Trust:

Enum Forest Trust:

Enum Local AppLocker Effecti:

Using BloodHound

#### Remote BloodHound

Python BloodHound Repository or install it with pip3 install bloodhound

#### On Site BloodHound

Using Adalanche

#### Remote Adalanche

#### Export Enumerated Objects

You can export enumerated objects from any module/cmdlet into an XML file for later ananlysis.

The Export-Clixml cmdlet creates a Common Language Infrastructure (CLI) XML-based representation of an object or objects and stores it in a file. You can then use the Import-Clixml cmdlet to recreate the sa based on the contents of that file.

Useful Enumeration Tools

ldapdomaindump Information dumper via LDAP

adidnsdump Integrated DNS dumping by any authenticated user

ACLight Ad Discovery of Pri Accounts

ADRecon Detailed Acti Recon Tool

Local Pri Escalation

Windows Local Pri Escalation Cookbook Cookbook for Windows Local Pri Escalations

Juicy Potato Abuse SeImpersonate or SeAssignPrimaryToken Pri for System Impersonation

:warning: Works only until Windows 服务端 2016 and Windows 10 until patch 1803

Lovely Potato Automated Juicy Potato

:warning: Works only until Windows 服务端 2016 and Windows 10 until patch 1803

PrintSpoofer Exploit the PrinterBug for System Impersonation

:pray: Works for Windows 服务端 2019 and Windows 10

RoguePotato Upgraded Juicy Potato

:pray: Works for Windows 服务端 2019 and Windows 10

Abusing Token Pri

SMBGhost C \

PoC

C (Hi/SeriousSAM)

Useful Local Priv Esc Tools

PowerUp Misconfiguration Abuse

BeRoot General Priv Esc Enumeration 工具

Privesc General Priv Esc Enumeration 工具

FullPowers Restore A Service Account's Pri

Lateral Mo

PowerShell Remoting

Remote 代码 Execution with PS Credentials

Import a PowerShell Module and Execute its Functions Remotely

Executing Remote Stateful commands

Mimikatz

:exclamation: What if mimikatz fails to dump credentials because of LSA Protection controls ?

LSA as a Protected Process (Kernel Land Bypass)

LSA as a Protected Process (Userland "Fileless" Bypass)

- PPLdump
- Bypassing LSA Protection in Userland

LSA is running as process (LSAISO) by Credential Guard

Detailed Mimikatz Guide

Poking Around With 2 lsass Protection Options

Remote Desktop Protocol

If the host we want to lateral move to has "RestrictedAdmin" enabled, we can pass the hash using the RDP 协议 and get an interacti without the plaintext password.

Mimikatz:

xFreeRDP:

:exclamation: If Restricted Admin mode is disabled on the remote machine we can connect on the host using another 工具/协议 like psexec or winrm and enable it by creating the following registry key and setting it's value zero: "HKLM:\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin".

Bypass "Single Session per User" Restriction

On a domain computer, if you ha execution as the system or local administrator and want an RDP session that another user is already using, you can get around the single session restriction by adding the following registry key:

Once you' the desired stuff, you can delete the key to reinstate the single-session-per-user restriction.

URL File Attacks

.url file

.scf file

Putting these files in a writeable share the only has to open the file explorer and na to the share. Note that the file doesn't need to be opened or the user to interact with it, but it must be on the top of the file system or just in the windows explorer window in order to be rendered. Use responder to capture the hashes.

:exclamation: .scf file attacks won't work on the latest of Windows.

Useful Tools

Powercat netcat written in powershell, and provides tunneling, relay and portforward

capabilities.

SCShell fileless lateral mo 工具 that relies on ChangeSer to run command

E the ultimate WinRM shell for hacking/pentesting

RunasCs Csharp and open of windows builtin runas.exe

ntlm_theft creates all possible file formats for url file attacks

Domain Pri Escalation

Kerberoast

_WUT IS DIS?:_ \
All standard domain users can request a copy of all service accounts along with their correlating password hashes, so we can ask a TGS for any SPN that is bound to a "user"
account, extract the encrypted blob that was encrypted using the user's password and bruteforce it offline.

PowerView:

AD Module:

Impacket:

Rubeus:

ASREPRoast

_WUT IS DIS?:_ \
If a domain user account do not require kerberos preauthentication, we can request a valid TGT for this account without e domain credentials, extract the encrypted
blob and bruteforce it offline.

PowerView: Get-DomainUser -PreauthNotRequired -

AD Module: Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth

Forcefully Disable Kerberos Preauth on an account i ha Permissions or more!
Check for interesting permissions on accounts:

Hint: We add a filter e.g. RDPUsers to get "User Accounts" not Machine Accounts, because Machine Account hashes are not crackable!

PowerView:

And finally execute the attack using the ASREPRoast 工具.

Using Rubeus:

Using Impacket:

Password Spray Attack

If we ha some passwords by compromising a user account, we can use this method to try and exploit password reuse
on other domain accounts.

Tools:

DomainPasswordSpray

CrackMapExec

In

Spray

Force Set SPN

_WUT IS DIS ?:
If we ha permissions -> GenericAll/GenericWrite we can set a SPN on a target account, request a TGS, then grab its blob and bruteforce it._

PowerView:

AD Module:

Finally use any 工具 from before to grab the hash and kerberoast it!

Abusing Shadow Copies

If you ha administrator access on a machine try to list shadow copies, it's an easy way for Domain Escalation.

1. You can dump the backuped SAM 数据库 and harvest credentials.
2. Look for DPAPI stored creds and decrypt them.
3. Access backuped sensiti.

List and Decrypt Stored Credentials using Mimikatz

Usually encrypted credentials are stored in:

%appdata%\Microsoft\Credentials

%localappdata%\Microsoft\Credentials

Detailed Article:
DPAPI all the things

Unconstrained Delegation

_WUT IS DIS ?: If we ha access on a machine that has Unconstrained Delegation enabled, we can wait for a
high value target or DA to connect to it, steal his TGT then ptt and impersonate him!_

Using PowerView:

Note: We can also use Rubeus!

Constrained Delegation

Using PowerView and Kekeo:

_ALTERNATIVE:_
Using Rubeus:

Now we can access the service as the impersonated user!

:triangular_flag_on_post: What if we ha rights for only a specific SPN? (e.g TIME):

In this case we can still abuse a feature of kerberos called "alternati". This allows us to request TGS tickets for other "alternative" services and not only for the one we ha for. Thats gives us the le to request valid tickets for any service we want that the host supports, giving us full access over the target machine.

Resource Based Constrained Delegation

_WUT IS DIS?: \
TL;DR \
If we ha/GenericWrite pri on a machine account object of a domain, we can abuse it and impersonate ourselves as any user of the domain to it. For example we can impersonate Domain Administrator and ha access._

Tools we are going to use:

PowerView

Powermad

Rubeus

First we need to enter the security context of the user/machine account that has the pri over the object.
If it is a user account we can use Pass the Hash, RDP, PSCredentials etc.

Exploitation Example:

Detailed Articles:

Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Acti

RESOURCE-BASED CONSTRAINED DELEGATION ABUSE

:exclamation: In Constrain and Resource-Based Constrained Delegation if we don't have the password/hash of the account with TRUSTED_TO_AUTH_FOR_DELEGATION that we try to abuse, we can use the very nice trick "tgt::deleg" from kekeo or "tgtdeleg" from rubeus and fool Kerberos to give us a valid TGT for that account. Then we just use the ticket instead of the hash of the account to perform the attack.

Detailed Article:
Rubeus – Now With More Kekeo

DNSAdmins Abuse

_WUT IS DIS ?: If a user is a member of the DNSAdmins group, he can possibly load an arbitary DLL with the pri of dns.exe that runs as SYSTEM. In case the DC serves a DNS, the user can escalate his pri to DA. This exploitation process needs pri to restart the DNS service to work._

1. Enumerate the members of the DNSAdmins group:
- PowerView: Get-NetGroupMember -GroupName "DNSAdmins"
- AD Module: Get-ADGroupMember -Identiny DNSAdmins
2. Once we found a member of this group we need to compromise it (There are many ways).
3. Then by serving a malicious DLL on a SMB share and configuring the dll usage,we can escalate our pri:

Abusing Acti DNS

Exploiting Acti DNS

ADIDNS Re

Inveigh

Abusing Backup Operators Group

_WUT IS DIS ?: If we manage to compromise a user account that is member of the Backup Operators
group, we can then abuse it's SeBackupPri to create a shadow copy of the current state of the DC,
extract the ntds.dit 数据库 file, dump the hashes and escalate our pri to DA._

1. Once we ha on an account that has the SeBackupPri we can access the DC and create a shadow copy using the signed binary diskshadow:

2. Next we need to access the shadow copy, we may have the SeBackupPri but we cant just
simply copy-paste ntds.dit, we need to mimic a backup software and use Win32 API calls to copy it on an accessible folder. For this we are
going to use this amazing repo:

3. Using smbclient.py from impacket or some other 工具 we copy ntds.dit and the SYSTEM hive on our local machine.
4. Use secretsdump.py from impacket and dump the hashes.
5. Use psexec or another 工具 of your choice to PTH and get Domain Admin access.

Abusing Exchange

Abusing Exchange one Api call from DA

C

Pri Exchange your pri for Domain Admin privs by abusing Exchange

Weaponizing Printer Bug

Printer 服务端 Bug to Domain Administrator

NetNTLMtoSil

Abusing ACLs

Escalating pri with ACLs in Acti

aclpwn.py

In

Abusing IPv6 with mitm6

Compromising IPv4 networks via IPv6

mitm6

SID History Abuse

_WUT IS DIS?: If we manage to compromise a child domain of a forest and SID filtering isn't enabled (most of the times is not), we can abuse it to pri escalate to Domain Administrator of the root domain of the forest. This is possible because of the SID History field on a kerberos TGT ticket, that defines the "extra" security groups and pri._

Exploitation example:

Detailed Articles:

Kerberos Golden Tickets are Now More Golden

A Guide to Attacking Domain Trusts

Exploiting SharePoint

C RCE Exploitation \

PoC

C 代码 execution through BDC deserialization

C RCE using typecon \

PoC

Zerologon

Zerologon: Unauthenticated domain controller compromise: White paper of the .

SharpZeroLogon: C# implementation of the Zerologon exploit.

In: PowerShell implementation of the Zerologon exploit.

Zer0Dump: Python implementation of the Zerologon exploit using the impacket library.

PrintNightmare

C: details.

Impacket implementation of PrintNightmare: Reliable PoC of PrintNightmare using the impacket library.

C# Implementation of C: Reliable PoC of PrintNightmare written in C#.

Acti Certificate Services

Check for Certificate Templates with: Certify

_Note: Certify can be executed with Cobalt Strike's execute-assembly command as well_

Make sure the msPKI-Certificates-Name-Flag value is set to "ENROLLEE_SUPPLIES_SUBJECT" and that the Enrollment Rights
allow Domain/Authenticated Users. Additionally, check that the pkiextendedkeyusage parameter contains the "客户端 Authentication" value as well as that the "Authorized Signatures Required" parameter is set to 0.

This exploit only works because these settings enable ser authentication, meaning an attacker can specify the UPN of a Domain Admin ("DA")
and use the captured certificate with Rubeus to forge authentication.

_Note: If a Domain Admin is in a Protected Users group, the exploit may not work as intended. Check before choosing a DA to target._

Request the DA's Account Certificate with Certify

This should return a valid certificate for the associated DA account.

The exported cert.pem and cert.key files must be consolidated into a single cert.pem file, with one gap of whitespace between the END RSA PRIVATE KEY and the BEGIN CERTIFICATE.

_Example of cert.pem:_

#Utilize openssl to Convert to PKCS #12 Format

The openssl command can be utilized to convert the certificate file into PKCS #12 format (you may be required to enter an export password, which can be anything you like).

Once the cert.pfx file has been exported, upload it to the compromised host (this can be done in a of ways, such as with Powershell, SMB, certutil.exe, Cobalt Strike's upload functionality, etc.)

After the cert.pfx file has been uploaded to the compromised host, Rubeus can be used to request a Kerberos TGT for the DA account which will then be imported into memory.

This should result in a successfully imported ticket, which then enables an attacker to perform malicious aciti under DA user context, such as performing a DCSync attack.

No PAC

sAMAccountname Spoofing Exploitation of C and C

Weaponisation of C/C Exploitation of C and C

noPAC C# tool to exploit C and C

sam-the-admin Python automated 工具 to exploit C and C

noPac E of "sam-the-admin" 工具

Domain Persistence

Golden Ticket Attack

DCsync Attack

Tip: \
/ptt -> inject ticket on current running session \
/ticket -> save the ticket on the system for later use

Sil Attack

SPN List

Skeleton Key Attack

DSRM Abuse

_WUT IS DIS?: Every DC has a local Administrator account, this accounts has the DSRM password which is a SafeBackupPassword. We can get this and then pth its NTLM hash to get local Administrator access to DC!_

Then just PTH to get local admin access on DC!

Custom SSP

_WUT IS DIS?: We can set our on SSP by dropping a custom dll, for example mimilib.dll from mimikatz, that will monitor and capture plaintext passwords from users that logged on!_

From powershell:

Now all logons on the DC are logged to -> C:\Windows\System32\kiwissp.log

Cross Forest Attacks

Trust Tickets

_WUT IS DIS ?: If we ha Admin rights on a Domain that has Bidirectional Trust relationship with an other forest we can get the Trust key and forge our own inter-realm TGT._

:warning: The access we will have will be limited to what our DA account is configured to have on the other Forest!

Using Mimikatz:

:exclamation: Tickets -> .kirbi format

Then Ask for a TGS to the external Forest for any service using the inter-realm TGT and access the resource!

Using Rubeus:

Abuse MSSQL Servers

Enumerate MSSQL Instances: Get-SQLInstanceDomain

Check Accessibility as current user:

Gather Information about the instance: Get-SQLInstanceDomain | Get-SQLSer -

Abusing SQL Database Links: \

_WUT IS DIS?: A 数据库 link allows a SQL 服务端 to access other resources like other SQL 服务端. If we have two linked SQL Servers we can execute stored procedures in them. 数据库 links also works across Forest Trust!_

Check for existing Database Links:

Then we can use queries to enumerate other links from the linked 数据库:

Query execution:

Breaking Forest Trusts

_WUT IS DIS?: \
TL;DR \
If we have a bidirectional trust with an external forest and we manage to compromise a machine on the local forest that has enabled unconstrained delegation (DCs have this by default), we can use the printerbug to force the DC of the external forest's root domain to authenticate to us. Then we can capture it's TGT, inject it into memory and DCsync to dump it's hashes, giving ous complete access over the whole forest._

Tools we are going to use:

Rubeus

SpoolSample

Mimikatz

Exploitation example:

Detailed Articles:

Not A Security Boundary: Breaking Forest Trusts

Hunting in Acti: Unconstrained Delegation & Forests Trusts

项目信息

开发语言：未知

Star 数：6759

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A cheat sheet that contains common enumeration and attack methods for Windows Acti.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。