Recherche globale

AD/SMB enumeration tool written in Go.

BloodHound CE collector in pure Bash.

SMB, LDAP, MSSQL, WinRM and SSH quick references.

AD enumeration and abuse from Linux.

ADCS enumeration and ESC exploitation.

Active Directory exploitation, cheatsheets, and tools.

C2 notes, tooling and related posts.

Windows and Linux privilege escalation resources.

Pivoting techniques, tunnels, and routing.

Enumerate domain users through SMB.

nxc smb $TARGET -u $USER -p $PASS --users

List accessible SMB shares and permissions.

nxc smb $TARGET -u $USER -p $PASS --shares

Read managed password from gMSA account.

bloodyAD --host $DC -d $DOMAIN -u $USER -p $PASS get object '$GMSA$' --attr msDS-ManagedPassword

Enumerate all AD users with GoFenrir.

gf ldap -t $TARGET -u $USER -p $PASS --users

Run full BloodHound CE collection.

./bashhound-ce -d domain.local -u USERNAME -p PASSWORD -c All