Situational Active Directory Flashcards
What tool to use to check for misconfigured service permissions?
AccessChk (Sysinternals)
How to perform Pass-the-Hash?
Mimikatz sekurlsa::pth or Impacket’s wmiexec.py with -hashes flag
What tool to use for extracting hashes from memory?
Mimikatz sekurlsa::logonpasswords
What to check when you have SeImpersonatePrivilege?
JuicyPotato or RoguePotato for privilege escalation
How to enumerate Active Directory from a non-domain machine?
BloodHound (SharpHound)
How to dump NTDS.dit from a domain controller?
vssadmin create shadow
What attack can be performed with unconstrained delegation?
Extract TGTs from memory using Mimikatz sekurlsa::tickets /export
How to exploit resource-based constrained delegation?
Create machine account
What tool to use to exploit Kerberoasting?
Rubeus kerberoast or GetUserSPNs.ps1 from PowerView
How to find accounts vulnerable to Kerberoasting?
GetUserSPNs.py from Impacket or PowerView’s Get-DomainUser -SPN
What tool to use to perform AS-REP Roasting?
Rubeus asreproast or GetNPUsers.py from Impacket
What permissions allow for DCSync attacks?
Replication rights (DS-Replication-Get-Changes & DS-Replication-Get-Changes-All)
What tool to use to perform a DCSync attack?
Mimikatz lsadump::dcsync /domain:example.com /user:krbtgt
How to bypass AMSI in PowerShell?
Use AMSI bypass scripts (e.g.
How to enumerate local privilege escalation opportunities?
WinPEAS
What tool to use to check ACL misconfigurations?
BloodHound
What tool to use to find unquoted service paths?
wmic service get name
How to execute arbitrary code via GPO abuse?
Modify a GPO that applies to a target
What tool to use to exploit LAPS misconfiguration?
PowerView Get-DomainObject
How to exploit PrintNightmare vulnerability?
Invoke-Nightmare or Mimikatz via printer bug exploitation
What attack can be performed when SeBackupPrivilege is enabled?
Copy SAM & SYSTEM files to extract hashes
What attack to perform when you have SeRestorePrivilege?
Overwrite SAM with known administrator credentials
What is the attack when SeTakeOwnershipPrivilege is enabled?
Take ownership of sensitive files (SAM
What is the attack when SeLoadDriverPrivilege is enabled?
Load a vulnerable driver to execute arbitrary code as SYSTEM
How to maintain persistence on a compromised AD?
Golden Ticket (forging TGTs)
What tool to use to create a Golden Ticket?
Mimikatz kerberos::golden /domain:example.com /sid:S-1-5-21-XXXX /krbtgt:HASH
How to escalate privileges with a writable service binary?
Replace service executable and restart service
What to check when you have a writable DLL in a service path?
Perform DLL hijacking by replacing the DLL with a malicious version
How to bypass UAC on Windows?
Use fodhelper
What tool to use to check for open SMB shares?
CrackMapExec
What tool to use to relay NTLM authentication?
Impacket’s ntlmrelayx.py
What attack can be performed with NTLM relay?
Relay authentication to LDAP
How to enumerate domain trusts?
nltest /domain_trusts
What is the attack when you find a writable Group Policy Preference (GPP)?
Extract credentials from cpassword in SYSVOL and decrypt with GpprefDecrypt.py
What attack can be performed with Shadow Credentials?
Forge certificates and authenticate as other users (PetitPotam abuse)
What tool to use to perform Shadow Credentials attack?
Certipy
What tool to use to find Kerberos ticket vulnerabilities?
Rubeus
How to perform a Silver Ticket attack?
Forge TGS with Mimikatz kerberos::golden and target specific services
What is the attack when you have constrained delegation enabled?
Perform S4U2Self + S4U2Proxy attack using Rubeus or Mimikatz
What tool to use to check for weak Kerberos encryption types?
Rubeus tgtdeleg /nowrap
How to escalate privileges using RBCD?
Add a new machine account and modify msDS-AllowedToActOnBehalfOfOtherIdentity
How to persist with AdminSDHolder abuse?
Modify ACLs on AdminSDHolder object to maintain admin access
How to check for vulnerable drivers for privilege escalation?
Use DriverQuery.exe
What tool to use to exploit insecure Active Directory permissions?
BloodHound (for mapping ACLs)
How to check for weak passwords in Active Directory?
CrackMapExec –pass-pol
What attack to perform if you find an unprotected LSASS process?
Dump LSASS memory using Mimikatz or Procdump.exe
How to check for domain controllers with missing security patches?
nmap –script smb-vuln-ms17-010
What is the attack when LDAP signing is disabled?
Intercept and modify LDAP traffic (LDAP relay attacks)
What tool to use to dump Active Directory data remotely?
ADExplorer.exe
