Symptom Index

Start here when you don’t think “I’m in phase 04” — you think “why the hell doesn’t this valid credential work?” Match what you’re seeing to its likely cause, route to the page that fixes it, and know what proof to grab on the way.

This index aggregates the 🛠️ Troubleshooting tables across the manual and the 🧭 Diagnostic Map sections in the write-ups — it doesn’t replace them. The routed page holds the fix in full; its ⏱️ Stop condition (on the decision pages) tells you when to abandon the thread.

---

🔐 Authentication & Kerberos

Symptom	Likely class	Route	Proof to capture
STATUS_NOT_SUPPORTED, NTLM:False on SMB/LDAP	NTLM disabled — wrong mechanism, not bad creds	NetExec_LDAP_Kerberos · Have_Creds	error + same cred succeeding via Kerberos
Valid creds rejected over SMB/LDAP, accepted elsewhere	NTLM disabled or wrong realm/FQDN	NetExec_LDAP_Kerberos	failing vs working auth command
Tool targets HTB:88 / wrong realm	domain/realm inference wrong	NetExec_LDAP_Kerberos	corrected krb5.conf + FQDN target
Kerberos fails after config looks correct	clock skew or wrong ccache	Have_Creds	klist before/after ntpdate
KRB_AP_ERR_SKEW	attacker/DC time drift	run sudo ntpdate [DC_IP]	skew resolved
NetExec prints (Guest)	auth fell back to guest — not success	Have_Creds	(Pwn3d!)/[+] vs (Guest)
evil-winrm -H fails as Administrator	NTLM disabled	use NT hash → Kerberos TGT	TGT request + Kerberos WinRM
smbclient Could not find a suitable mechtype	local Samba SPNEGO/Kerberos issue	use impacket/nxc --use-kcache	working nxc command
klist: No credentials cache found after getST succeeds	getST wrote a long-named ccache (<user>@<spn>@REALM.ccache), not dc.ccache	ls *.ccache then export KRB5CCNAME the exact file	klist showing the delegated cifs/... ticket

🩸 Active Directory & BloodHound

Symptom	Likely class	Route	Proof to capture
BloodHound shows no path to DA	stale collection / owned not marked / missing ADCS or shares	Stuck_In_AD · NetExec_BloodHound	fresh collection + owned marks
BloodHound says a user isn’t in the DB	collected before the object existed/was restored	Stuck_In_AD	recollection showing the object
SPN write succeeds but Get-DomainSPNTicket fails in WinRM	WinRM/Kerberos context, not the ACL	AD_ACL_Abuse · AD_Kerberoasting	SPN read-back proving the write landed
ACL/WriteDACL change has no effect	AD replication delay	AD_ACL_Abuse	re-check after ~60s
Set-DomainObject/Set-DomainUserPassword not recognized	PowerView not loaded	AD_ACL_Abuse	PowerView load + cmdlet working
Restore-ADObject returns nothing	normal — no output on success	Stuck_In_AD	re-enum of deleted objects
MachineAccountQuota: 0 but you hold SeEnableDelegationPrivilege + write over a computer object	abuse an existing computer for constrained delegation (no new machine needed)	Attack_Patterns · Stuck_In_AD	the priv + the control edge + DCSync output
MSSQL login works but not sysadmin / xp_cmdshell disabled	not RCE — pivot to domain SID/RID account enumeration	Attack_Patterns · Stuck_In_AD	enumerated user list from the RID sweep
DC has no explicit cifs/ SPN for an S4U target	HOST SPN mappings cover CIFS — the target still works	AD_Privileged_Access	sPNMappings showing cifs under host=
Restored AD object lacks rights / keeps getting purged	inherited OU rights aren’t reapplied on un-tombstone + a cleanup task re-deletes it	AD_ACL_Abuse · Pass_the_Certificate	dacledit … -inheritance re-push; restore→reset→enrol in one pass

🖥️ Shell & privilege escalation

Symptom	Likely class	Route	Proof to capture
WinRM works but AD cmdlets crash/fail	Kerberos double-hop / no delegated creds	AD_Kerberos_Double_Hop	in-session klist (no TGT) + working PSCredential/RunasCs
Shell, but no privesc vector found	not yet enumerated as the user, or it isn’t here	Have_Shell	automated-enum output + whoami /priv
$Cred/PowerShell command errors in zsh	you’re on Kali, not in the PS session	AD_Kerberos_Double_Hop	reconnected session
Shell lands as root but /.dockerenv exists	container root, not host root	Have_Shell	/.dockerenv + app config holding internal creds
/dev/tcp or /bin/bash reverse shell fails	minimal container (no bash)	Shell_Stabilization	working /bin/sh + named-pipe nc shell
.vault-token (or similar secrets token) in a home dir	HashiCorp Vault — check token policy + secrets engines	Attack_Patterns	vault token lookup (root policy) + SSH OTP role
Outbound callback hits 22/2222 but no shell; client banner says paramiko/SSH-2.0	it’s an SSH client, not a reverse shell — honeypot it	Attack_Patterns · Linux_Remote_Management_SSH_Rsync_RServices	sshesame log capturing the offered username/password
pam_exec SSH capture logs the username but an empty password	the user has no local account — sshd ran a dummy auth path and never fed the token into PAM	Linux_Auth_Process · Attack_Patterns	first pass user: (empty) → useradd → second pass user:<cleartext>
sudo -l pins a file-processing binary to a tight regex/fixed flags	not a flag-escape — attack the file format it ingests (patch symlink write, parser XXE)	Attack_Patterns · Linux_PrivEsc_Permissions_Sudo	the file-write/file-read landing as the target user/root
Privileged clamscan/patch/parser says OK / “applied cleanly” but no leak shown	success is the side effect; disclosure rides stderr	Linux_PrivEsc_Permissions_Sudo	the leaked content captured via 2>&1
Expected file/flag/credential “missing” from a normal dir/listing	hidden in an NTFS Alternate Data Stream	Windows_PrivEsc_Credential_Hunting	dir /R / Get-Content -Stream revealing the stream
Modified Fail2Ban action never runs after a restart	restart ≠ run — actionban only fires on an actual ban	Linux_PrivEsc_Services_Cron · Attack_Patterns	a triggered ban executing the payload as root
PowerShell reverse shell silently never connects back	bare IP in TCPClient(...) parsed as integer arithmetic	Shell_Bind_Reverse	quoted TCPClient("[LHOST]",[LPORT]) connecting

🌐 Web & application

Symptom	Likely class	Route	Proof to capture
App has a login but no obvious exploit	undiscovered vhost/param, known-app CVE, or default creds	Virtual_Hosts · Common_Apps_Discovery_Notable	vhost/content fuzz results + app+version
Found a file/share/config — noise or not?	check for secrets before discarding	Credential_Hunting_Network_Shares	grep hits for pass|secret|key|connectionstring
”Test connection” feature stores creds	abusable to leak the stored credential	Have_Creds	listener capture of the bind
Injected math (2.4+2.4) changes behaviour but raw ;id/wget does nothing	sink is code (Python eval, template), not shell — payload must be valid in that language	Command_Injection_Fundamentals	the evaluated-expression behaviour
Attacker HTTP server logs a 404 from the target IP	blind code execution proven (missing path is irrelevant)	Command_Injection_Fundamentals	the inbound request log line
API/app rejects auth (Authentication failed / Invalid token)	the creds live in the app’s source — read its repo, issues, and commit history	Common_Apps_GitLab_osTicket	creds recovered from git history
Download/export feature returns a ZIP/archive, not the raw file	LFI still works — the file is wrapped	LFI_Path_Traversal_Bypasses	unzip -p showing the traversed file (e.g. /etc/passwd)
Password reset says “failed to send” for one address but errors differently for invalid ones	username oracle + the flow trusts DNS mail routing	Attack_Patterns · Attacking_Email_Services	the differing responses + captured reset email
Readable BIND config shows key "rndc-key" + zone allow-update	authenticated dynamic DNS update is possible	Attack_Patterns · Attacking_DNS	nsupdate adding a test record, confirmed by dig
dig returns NXDOMAIN / ignores /etc/hosts	query is hitting local DNS, not the target’s	Attacking_DNS	same query succeeding with @[TARGET_IP]
Leaked/readable ASP.NET web.config with a <machineKey>	forge a signed __VIEWSTATE → deserialization RCE	Common_Apps_IIS_Tilde_LDAP_ThickClient · Attack_Patterns	ysoserial.net -p ViewState payload executing as the app pool
Redis answers PING/INFO with no NOAUTH	it’s a file-write primitive, not just data exposure	Attacking_Redis · Attack_Patterns	SSH key flushed to authorized_keys via config set dir

🪪 Certificates (AD CS)

Symptom	Likely class	Route	Proof to capture
certipy find: enrollee-supplies-subject + client-auth template	ESC1	Pass_the_Certificate	the vulnerable template output
certipy auth → KDC_ERR_PADATA_TYPE_NOSUPP	PKINIT unsupported — cert still valid	Pass_the_Certificate	error + Schannel/Pass-the-Cert whoami
Certificate “has no object SID”	strong mapping enforced	Pass_the_Certificate	re-request with -sid <DOMAIN_SID>-500
OpenSSL Mac verify error: invalid password?	PFX has a blank import password	Pass_the_Certificate	extraction with -passin pass:
certipy find -vulnerable shows no vulnerable templates	doesn’t rule out ESC16 — it’s a CA-wide setting, not per-template	Pass_the_Certificate · Attack_Patterns	the CA-level ESC16/“Security Extension Disabled” flag
certipy find flags ESC15 (schema-v1 + enrollee-supplies-subject)	escalate via application-policies injection	Pass_the_Certificate	req … -application-policies 'Client Authentication' -sid <target> succeeding
Unresolved/orphaned SID in a template’s enrollment ACL	clue to a tombstoned principal — restore it to recover enrollment	Pass_the_Certificate · Stuck_In_AD	the SID matched via Get-ADObject -IncludeDeletedObjects

🧭 Pivoting & tunneling

Symptom	Likely class	Route	Proof to capture
proxychains tools hang / nmap finds nothing	SYN scan can’t traverse SOCKS	NetExec_Proxychains_Pivot · Need_To_Pivot	working -sT -Pn scan
scp/tool resolves target to 127.0.1.1	run from inside the SSH session	Need_To_Pivot	command run from the attack box
Can’t reach internal hostnames	not in /etc/hosts	Need_To_Pivot	hosts entry + resolution
Internal DB/host (e.g. db) only resolves from the foothold/container	service lives on the internal/container network	Need_To_Pivot · Attacking_SQL_Databases	query run from inside the container with the app’s deps
SSH fails: no matching host key type … ssh-rsa	modern client rejects the legacy algorithm	Linux_Remote_Management_SSH_Rsync_RServices	connect with -o HostKeyAlgorithms=+ssh-rsa (or pivot elsewhere)

🔑 Credentials & hashes

Symptom	Likely class	Route	Proof to capture
Have a hash but NTLM disabled	use the hash to request a Kerberos TGT	Have_Creds · Pass_the_Hash	getTGT -hashes + Kerberos auth
Cracked value doesn’t work as the password	it’s an intermediate key (e.g. Ansible Vault)	Have_Creds	the real secret it decrypts
New identity found	retest everything as this identity	Have_Creds	validation matrix + BloodHound re-mark
Recovered password fails as a login but an SSH key is encrypted	password reused as the key passphrase	Have_Creds	key unlocks with the recovered password
Recovered cred fails over SMB/LDAP but looks service-specific (e.g. SQLGuest)	it’s a local service account, not a domain user	Have_Creds · Attacking_KeePass	cred succeeding via --local-auth against its service
Recovered an infrastructure key (RNDC/TSIG, API token), not a user password	test it against its own service, not auth endpoints	Have_Creds · Attacking_DNS	the key driving its service (e.g. nsupdate zone change)
sqlmap-exfiltrated key/cert/archive is truncated or unusable	binary content mangled without hex encoding	SQLMap_Advanced	re-run --file-read … --hex yielding an intact file

📸 Evidence & reporting

Symptom	Likely class	Route	Proof to capture
About to move on but didn’t capture proof	stop and capture first	Reporting_SysReptor	command + output + screenshot saved

---

🔗 Related Nodes

• Decision_Trees — route by access state instead of symptom
• Engagement_Cockpit — the always-open driver page
• Reporting_SysReptor — capture the “proof to capture” column properly