Active Directory - Enumeration Cheat Sheet
Active Directory - Enumeration Cheat Sheet · from Anas-Magane/Pentesting (ACTIVE DIRECTORY).
NetBIOS name like PUPPY but FQDN (Fully Qualified Domain Name) is like
bash
PUPPY.local
example.corp
company.internalTools Used
bash
Nmap: For initial port scanning and service enumeration.
Gobuster: To discover hidden directories on the web server.
crackmapexec: Verifies login credentials over SMB/WinRM, and helps in credential spraying.
evil-winrm: Connects to the Windows target using WinRM (remote PowerShell access).
smbclient: Accesses SMB shares to download files like .kdbx (KeePass).
keepass4brute: Brute-forces passwords on KeePass database files.
bloodhound: Maps Active Directory attack paths (e.g., user → group → admin).
bloodyAD: Exploits AD permissions like adding users to privileged groups.
impacket tools: Used for dumping hashes (secretsdump.py) and remote command execution.
dpapi.py: Decrypts DPAPI-protected credentials (e.g., user secrets, Wi-Fi keys).
rockyou.txt: Common password wordlist used in brute-force attacks.
PowerShell (remote): Used via evil-winrm to navigate the file system and capture the flags.53/tcp (DNS)#
- Tool:
dig,nslookup,dnsrecon,fierce - Commands:
bash
dig @IP_domain domain.local
dig @IP_domain domain.local AXFR
dnsrecon -d domain.local -t axfr -n IP_domain
fierce --domain domain.local --dns-servers IP_domain88/tcp (Kerberos)#
- Tool:
impacket-getTGT,impacket-GetNPUsers,Rubeus
Commands:
bash
## AS-REP Roasting
GetNPUsers.py domain.local/ -dc-ip IP_domain -no-pass
## Request TGT
getTGT.py domain.local/username:password -dc-ip IP_domain135/tcp (MSRPC)#
- Tools: rpcclient, impacket-rpcdump
- Commands:
bash
rpcclient -U "" IP_domain
rpcdump.py @IP_domain139 & 445/tcp (NetBIOS / SMB)#
- Tools: smbclient, enum4linux, impacket-smbmap, crackmapexec
- Commands:
bash
smbclient -L //IP_domain -N
smbclient //IP_domain/SHARE -N
enum4linux -a IP_domain
smbmap -H IP_domain
crackmapexec smb IP_domain -u '' -p '' --shares389/tcp (LDAP)#
- Tools: ldapsearch, windapsearch, ldapdomaindump
- Commands:
bash
ldapsearch -x -h IP_domain -b "dc=domain,dc=local"
windapsearch.py -d domain.local -u '' -p '' -dc-ip IP_domain
ldapdomaindump ldap://IP_domain -u '' -p ''636/tcp (LDAPS)#
- Tools: ldapsearch (with SSL), ldapdomaindump
- Commands:
bash
ldapsearch -x -H ldaps://IP_domain -b "dc=domain,dc=local"
ldapdomaindump ldaps://IP_domain -u '' -p ''464/tcp (Kerberos kpasswd)#
- Tools: Impacket Kerberos tools
- Commands:
bash
# Usually abused after Kerberos tickets are obtained
python3 kpasswd.py -target-ip IP_domain593/tcp (HTTP RPC)#
- Tools: rpcdump, rpcinfo
- Commands:
bash
rpcdump.py @IP_domain5985/tcp (WinRM / WSMan)#
- Tools: evil-winrm, crackmapexec
- Commands:
bash
crackmapexec winrm IP_domain -u USER -p PASS
evil-winrm -i IP_domain -u USER -p PASS9389/tcp (ADWS)#
- Tools: PowerShell (ADWS modules)
- Commands:
powershell
Import-Module ActiveDirectory
Get-ADUser -Server IP_domain -Filter *111 & 2049/tcp (NFS)#
- Tools: showmount, nmap, mount
- Commands:
bash
showmount -e IP_domain
sudo mount -t nfs IP_domain:/share /mnt/nfs3260/tcp (iSCSI)#
- Tools: iscsiadm
- Commands:
bash
iscsiadm -m discovery -t sendtargets -p IP_domain
iscsiadm -m node -T iqn_name -p IP_domain --loginDynamic RPC High Ports#
- Tools: rpcdump, msrpc, crackmapexec
- Usage: Often linked back to MSRPC (135), not directly enumerated.
Recommended Workflow#
- DNS (53) → Zone transfer → subdomains.
- SMB (445/139) → Shares, users, GPP, password files.
- LDAP (389/636) → User/group enumeration.
- Kerberos (88/464) → Kerberoasting, AS-REP roasting.
- MSRPC (135) → User & group enumeration.
- WinRM (5985) → Remote code execution once creds are found.
- ADWS (9389) → Query AD via PowerShell.
- NFS/iSCSI (111/2049/3260) → Check for misconfigured file shares.