Recherche globale

Offensive MS-RPC client for AD (SAMR/LSA/srvsvc): recon, sweep and write ops, a Go rewrite of rpcclient.

Cross-referenced AD recon report in one command.

rpcclient-ng -d $DOMAIN -u $USER -p $PASS -c sweep $TARGET

AD/SMB enumeration tool written in Go.

BloodHound CE collector in pure Bash.

SMB, LDAP, MSSQL, WinRM and SSH quick references.

AD enumeration and abuse from Linux.

ADCS enumeration and ESC exploitation.

Kerberos principal confusion (Linux/Samba AD): a <user>$ machine account maps to the Unix user <user> via auth_to_local, granting GSSAPI access as that user.

echo '$NEWPASS' | kinit '$TARGET_USER$@$REALM'; ssh -o PreferredAuthentications=gssapi-with-mic $TARGET_USER@$TARGET_HOST

Active Directory exploitation, cheatsheets, and tools.

C2 notes, tooling and related posts.

Windows and Linux privilege escalation resources.

Pivoting techniques, tunnels, and routing.

Enumerate domain users through SMB.

nxc smb $TARGET -u $USER -p $PASS --users

List accessible SMB shares and permissions.

nxc smb $TARGET -u $USER -p $PASS --shares