Active Directory, Enumeration
Turning one valid credential into a full map of the domain, netexec for the sweep, BloodHound for the shortest path to Domain Admin.
On a domain, one valid credential turns the whole directory readable. netexec is my swiss-army knife, and BloodHound turns the raw dump into “here is the shortest path to Domain Admin.”
Credentialed enumeration#
Validate the credential, spray it across the subnet, then pull users, groups and the password policy.
bash
# validate a credential and spray it across the subnet
netexec smb <DC-IP> -u <user> -p <pass>
netexec smb <subnet>/24 -u <user> -p <pass>
# with creds: users, groups, password policy, loggable shares
netexec smb <DC-IP> -u <user> -p <pass> --users --groups --pass-pol
netexec smb <DC-IP> -u <user> -p <pass> --rid-bruteBloodHound & roastable accounts#
Collect everything in one pass, then flag the SPNs and pre-auth-disabled accounts worth roasting.
bash
# collect everything for BloodHound in one pass
bloodhound-python -u <user> -p <pass> -d <dom>.htb -ns <DC-IP> -c All
netexec ldap <DC-IP> -u <user> -p <pass> --bloodhound -c All --dns-server <DC-IP>
# enumerate SPNs and kerberoastable / asreproastable accounts
netexec ldap <DC-IP> -u <user> -p <pass> --kerberoasting kerb.txt
kerbrute userenum -d <dom>.htb --dc <DC-IP> users.txt