Active-Directory-Exploitation-Cheat-Sheet

Active Directory 漏洞利用速查表 此速查表包含 Windows Active Directory 的常见枚举和攻击方法。 ℹ️ 此仓库由 Nikos Katsiopis 和 Nikos Vourdas 创建。 此速查表灵感来源于 PayloadAllTheThings 仓库。 摘要 Active Directory 漏洞利用速查表 摘要 工具 域枚举 使用 PowerView 使用 AD Module 使用 BloodHound 远程 BloodHound 现场 BloodHound 使用 Adalanche 远程 Adalanche 导出枚举对象 有用的枚举工具...

mimikatz

mimikatz mimikatz 是我为了学习 C 语言并对 Windows 安全进行一些实验而制作的一款工具。 如今它以从内存中提取明文密码、哈希、PIN 码和 Kerberos 票据而闻名。mimikatz 还可以执行哈希传递（pass-the-hash）、票据传递（pass-the-ticket）或构建黄金票据（Golden tickets）。 root@kitploit: .. mimikatz 2.0 alpha x86 release "Kiwi en C" Apr 6 2014 22:02:03 . ^ . / \ / \ / Benjamin DELPY...

vulnerable-AD

Vulnerable-AD 创建一个易受攻击的活动目录，让您可以在本地实验室中测试大多数活动目录攻击。 主要功能 随机化攻击 全面覆盖上述攻击 您需要在已安装活动目录的域控制器上运行脚本 部分攻击需要客户端工作站 支持的攻击 滥用ACL/ACE Kerberoasting AS-REP Roasting 滥用DnsAdmins 对象描述中的密码 使用默认密码的用户对象 Changeme123! 密码喷洒 DCSync 白银票据 黄金票据 传递哈希 传递票据 SMB签名已禁用 示例 root@kitploit: if you didn't install Active Directory...

Invoke-sAMSpoofing

Invoke-sAMSpoofing Explotaciones CVE-2021-42287/CVE-2021-42278 en powershell Tabla de contenido Resumen Menú Capturas de pantalla Referencias Resumen Un script sencillo para atacar AD con las explotaciones CVE-2021-42287/CVE-2021-42278 automáticamente. Menú Invoke-sAMSpooofing Invoke-GoldenTicket...

MakeMeEnterpriseAdmin

Esempio di esecuzione riuscita: root@kitploit: ====================================================================== /\ Elevated domain admins to Enterprise admins - version 1.0 || /||\ Require: domain admin right |:||:| or more specifically DS-Replication-Get-Changes-All |/||| Vincent LE TOUX...

lab-purple-team

Lab Purple Team - Active Directory !screenshots/wazuhsecu...

DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense

DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense By Maulik Maheta and Chao Sun · April 14, 2026 Executive summary A DCSync attack is one of the most formidable techniques an adversary can deploy after gaining a foothold in an Active Directory AD environmen...

Active Directory Under Siege: Why Critical Infrastructure Needs Stronger Security

Active Directory remains the authentication backbone for over 90% of Fortune 1000 companies. AD's importance has grown as companies adopt hybrid and cloud infrastructure, but so has its complexity. Every application, user, and device traces back to AD for authentication and authorization, making ...

New Silver SAML Attack Evades Golden SAML Defenses in Identity Systems

Cybersecurity researchers have disclosed a new attack technique called Silver SAML that can be successful even in cases where mitigations have been applied against Golden SAML attacks. Silver SAML "enables the exploitation of SAML to launch attacks from an identity provider like Entra ID against...

Kerberos Silver/Golden/Diamond/Sapphire Ticket Forging

This module forges a Kerberos ticket. Four different techniques can be used: - Silver ticket: Using a service account hash, craft a ticket impersonating any user and privileges to that account. - Golden ticket: Using the krbtgt hash, craft a ticket impersonating any user and privileges. - Diamond...

Unpatched Systems Vulnerable to Spoofed Linked Certificates in KDC

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Windows Server provides Public Key Infrastructure PKI technology to enable capabilities such as Encrypting File System EFS, domain authentication, digital signatures, and email security. Misconfiguration...

Active-Directory-Exploitation-Cheat-Sheet

This is a cheat sheet for Windows Active Directory exploitation, containing common enumeration and attack methods. The repository is a collection of PowerShell scripts and modules that can be used to perform various attacks on Active Directory, including domain enumeration, lateral movement, and...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in several components of Windows. The vulnerabilities potentially enable a malicious person to able to perform attacks that result in the following categories of damage: Obtaining elevated privileges Execution of arbitrary code Accessing sensitive data The...

Mimikatz v2.2.0 - A Post-Exploitation Tool to Extract Plaintexts Passwords, Hash, PIN Code from Memory

mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. But that's not all!...

Windows Escalate Golden Ticket

This module will create a Golden Kerberos Ticket using the Mimikatz Kiwi Extension. If no options are applied it will attempt to identify the current domain, the domain administrator account, the target domain SID, and retrieve the krbtgt NTLM hash from the database. By default the well-known...