corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a087e9-df4b-7148-b79a-ef8d4570d03c

Active Directory Pentesting from Linux

tbhaxor.com · published 9 June 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at tbhaxor.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
141
Words captured
9,202

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.alteredsecurity.com/linuxad
alteredsecurity.com
https://www.credential.net/de3330d7-8a46-4cdc-a0b6-48f91734ba7b
credential.net
https://en.wikipedia.org/wiki/Telephone_directory
en.wikipedia.org
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview
learn.microsoft.com
https://en.wikipedia.org/wiki/Active_Directory
en.wikipedia.org
https://twitter.com/nikhil_mitt
twitter.com
https://www.oreilly.com/library/view/dns-on-windows/0596005628/ch08s01s01.html
oreilly.com
https://www.alteredsecurity.com/adlab
alteredsecurity.com
https://learn.microsoft.com/en-us/windows/win32/ad/about-the-active-directory-schema
learn.microsoft.com
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/use-ntdsutil-manage-ad-files
learn.microsoft.com
https://twitter.com/tbhaxor
twitter.com
https://attack.mitre.org/techniques/T1046/
attack.mitre.org
https://nmap.org/book/synscan.html
nmap.org
https://aws.amazon.com/what-is/cidr
aws.amazon.com
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts
learn.microsoft.com
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements
learn.microsoft.com
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/guest-access-in-smb2-is-disabled-by-default
learn.microsoft.com
https://attack.mitre.org/techniques/T1021/002/
attack.mitre.org
https://www.varonis.com/blog/smb-port
varonis.com
https://nmap.org/nsedoc/scripts/smb-enum-shares.html
nmap.org
https://docs.metasploit.com/docs/pentesting/metasploit-guide-smb.html
docs.metasploit.com
https://en.wikipedia.org/wiki/Administrative_share
en.wikipedia.org
https://www.samba.org/samba/docs/current/man-html/smbclient.1.html
samba.org
https://en.wikipedia.org/wiki/Windows_Task_Scheduler
en.wikipedia.org
https://attack.mitre.org/techniques/T1053/
attack.mitre.org
https://www.offsec.com/metasploit-unleashed/msfvenom/
offsec.com
https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb
github.com
https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
learn.microsoft.com
https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
github.com
https://attack.mitre.org/techniques/T1562/001/
attack.mitre.org
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.4
learn.microsoft.com
https://unix.stackexchange.com/questions/23111/what-is-the-eval-command-in-bash
unix.stackexchange.com
https://docs.rapid7.com/metasploit/use-meterpreter-locally-without-an-exploit/
docs.rapid7.com
https://security.stackexchange.com/questions/206922/prevent-handler-from-starting-on-exploit
security.stackexchange.com
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/start-sleep?view=powershell-7.5
learn.microsoft.com
https://learn.microsoft.com/en-gb/windows/win32/services/localsystem-account
learn.microsoft.com
https://www.oreilly.com/library/view/mastering-metasploit/9781788990615/4d7912bf-2a5e-4c45-abf4-0d11b38f5e45.xhtml
oreilly.com
https://en.wikipedia.org/wiki/Mimikatz
en.wikipedia.org
https://www.windowscentral.com/how-manage-microsoft-defender-antivirus-powershell-windows-10
windowscentral.com
https://book.hacktricks.xyz/windows-hardening/stealing-credentials
book.hacktricks.xyz
https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/update-windows-settings-and-scripts-create-your-own-answer-file-sxs?view=windows-11
learn.microsoft.com
https://answers.microsoft.com/en-us/windows/forum/all/what-is-panther-directory/424ed2df-ce11-4967-8f59-42ab9d6c9757
answers.microsoft.com
https://powersploit.readthedocs.io/en/latest/Recon/
powersploit.readthedocs.io
https://github.com/samratashok/ADModule
github.com
https://www.offsec.com/metasploit-unleashed/meterpreter-basics/
offsec.com
https://attack.mitre.org/techniques/T1087/002/
attack.mitre.org
https://attack.mitre.org/software/S0194/
attack.mitre.org
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.archive/expand-archive?view=powershell-7.3
learn.microsoft.com
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-7.4
learn.microsoft.com
https://www.virustotal.com/gui/file/c5cd774cef0b57a6afbd35970972862c0a273a6b6a0a88d18418a6333be1cd8e
virustotal.com
https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addomain?view=windowsserver2022-ps
learn.microsoft.com
https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2022-ps
learn.microsoft.com
https://www.ravenswoodtechnology.com/ad-roles-enterprise-admins-and-schema-admins/
ravenswoodtechnology.com
https://itfreetraining.com/lesson/gp-restricted-groups/
itfreetraining.com
https://hunter2.gitbook.io/darthsidious/enumeration/powerview
hunter2.gitbook.io
https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-ps
learn.microsoft.com
https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps
learn.microsoft.com
https://attack.mitre.org/tactics/TA0008/
attack.mitre.org
https://attack.mitre.org/tactics/TA0006/
attack.mitre.org
https://mpgn.gitbook.io/crackmapexec/
mpgn.gitbook.io
https://doubleoctopus.com/security-wiki/threats-and-tools/password-spraying/
doubleoctopus.com
https://attack.mitre.org/techniques/T1110/003/
attack.mitre.org
https://www.ivoidwarranties.tech/posts/pentesting-tuts/cme/crackmapexec/
ivoidwarranties.tech
https://attack.mitre.org/techniques/T1021/006/
attack.mitre.org
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
learn.microsoft.com
https://www.oreilly.com/library/view/mastering-windows-powershell/9781787126305/1f19101b-c338-4dff-b423-52461f6f7761.xhtml
oreilly.com
https://www.perplexity.ai/search/there-is-a-fully-qualified-use-wXuY.nWcS8GisbOcV6wNdg
perplexity.ai
https://learn.microsoft.com/en-us/powershell/module/psreadline/about/about_psreadline?view=powershell-7.4
learn.microsoft.com
https://attack.mitre.org/techniques/T1552/001/
attack.mitre.org
https://en.wikipedia.org/wiki/Pass_the_hash
en.wikipedia.org
https://attack.mitre.org/techniques/T1550/002/
attack.mitre.org
https://book.hacktricks.xyz/windows-hardening/lateral-movement/smbexec
book.hacktricks.xyz
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
learn.microsoft.com
https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/
devblogs.microsoft.com
https://learn.microsoft.com/en-us/powershell/scripting/learn/application-control?view=powershell-7.4
learn.microsoft.com
https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html
gnu.org
https://learn.microsoft.com/en-us/dotnet/api/microsoft.powershell.commands.deviceguardconfigcodeintegritystatus?view=powershellsdk-1.1.0
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control
learn.microsoft.com
https://learn.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy?view=windowsserver2022-ps
learn.microsoft.com
https://lolbas-project.github.io/lolbas/Libraries/comsvcs/
lolbas-project.github.io
https://attack.mitre.org/techniques/T1003/001/
attack.mitre.org
https://tbhaxor.com/about/
tbhaxor.com
https://github.com/skelsec/pypykatz/wiki/lsa-minidump-command
github.com
https://answers.microsoft.com/en-us/windows/forum/all/inetpub-folder/aec3dd2c-f55a-4fc6-b88b-5b7c38835334
answers.microsoft.com
https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/aspnet-core-module?view=aspnetcore-7.0
learn.microsoft.com
https://learn.microsoft.com/en-us/previous-versions/aspnet/zhhddkxy(v=vs.100
learn.microsoft.com
https://stackoverflow.com/questions/1075245/encrypting-web-config
stackoverflow.com
https://www.red-gate.com/simple-talk/devops/data-privacy-and-protection/introduction-to-sql-server-security-part-4/
red-gate.com
https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-ver16
learn.microsoft.com
https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option?view=sql-server-ver16&redirectedfrom=MSDN
learn.microsoft.com
https://codebeautify.org/sql-minifier/y25ba9395
codebeautify.org
https://attack.mitre.org/techniques/T1059/003/
attack.mitre.org
https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-server-services-transact-sql?view=azuresqldb-current
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/services/networkservice-account
learn.microsoft.com
https://stackoverflow.com/a/24621039/10362396
stackoverflow.com
https://docs.rapid7.com/metasploit/meterpreter-getsystem/
docs.rapid7.com
https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
devblogs.microsoft.com
https://learn.microsoft.com/en-us/windows-server/networking/dns/dns-top
learn.microsoft.com
https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
learn.microsoft.com
https://www.offsec.com/metasploit-unleashed/msfconsole-commands/
offsec.com
https://learn.microsoft.com/en-us/windows/win32/ad/how-access-control-works-in-active-directory-domain-services
learn.microsoft.com
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee617261(v=technet.10
learn.microsoft.com
https://www.speedguide.net/port.php?port=5985
speedguide.net
https://github.com/Hackplayers/evil-winrm?tab=readme-ov-file
github.com
https://learn.microsoft.com/en-us/windows/win32/ad/delegation
learn.microsoft.com
https://cloud.google.com/iam/docs/roles-overview
cloud.google.com
https://github.com/fortra/impacket/blob/impacket_0_11_0/examples/findDelegation.py
github.com
https://attack.mitre.org/techniques/T1558/003/
attack.mitre.org
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation
ired.team
https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/ps-remoting-second-hop?view=powershell-7.4
learn.microsoft.com
https://yougottahackthat.com/blog/339/what-is-aad3b435b51404eeaad3b435b51404ee
yougottahackthat.com
https://github.com/dirkjanm/krbrelayx
github.com
https://attack.mitre.org/techniques/T1557/
attack.mitre.org
https://www.techtarget.com/searchwindowsserver/definition/Directory-Services-Restore-Mode-DSRM
techtarget.com
https://medium.com/r3d-buck3t/enumerating-access-controls-in-active-directory-c06e2efa8b89
medium.com
https://www.varonis.com/blog/active-directory-domain-services
varonis.com
https://ubuntu.com/server/docs/samba-active-directory
ubuntu.com
https://medium.com/@harikrishnanp006/understanding-ntds-dit-the-core-of-active-directory-faac54cc628a
medium.com
https://nmap.org/
nmap.org
https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4
medium.com
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/direct-hosting-of-smb-over-tcpip
learn.microsoft.com
https://www.bdrsuite.com/blog/nfs-vs-smb-whats-the-difference/
bdrsuite.com
https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/get-scheduledtask?view=windowsserver2022-ps
learn.microsoft.com
https://www.offsec.com/metasploit-unleashed/scanner-smb-auxiliary-modules
offsec.com
https://superuser.com/questions/858553/where-is-the-unattend-file-stored-after-you-install-windows
superuser.com
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/hh824950(v=win.10
learn.microsoft.com
https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
learn.microsoft.com
https://stackoverflow.com/questions/67589348/wheres-the-command-history-in-powershell-ise-stored-at
stackoverflow.com
https://www.sans.org/blog/pen-test-poster-white-board-powershell-built-in-port-scanner/
sans.org
https://0xss0rz.gitbook.io/0xss0rz/pentest-htb/windows-1/winrm
0xss0rz.gitbook.io
https://aas-s3curity.gitbook.io/cheatsheet/internalpentest/active-directory/post-exploitation/extracting-credentials/retrieve-windows-hashes
aas-s3curity.gitbook.io
https://learn.microsoft.com/en-gb/archive/blogs/askds/understanding-kerberos-double-hop
learn.microsoft.com
https://github.com/PowerShell/PSReadLine
github.com
https://learn.microsoft.com/en-us/windows/win32/debug/minidump-files
learn.microsoft.com
https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
threathunterplaybook.com
https://www.netwrix.com/active_directory_delegation.html
netwrix.com
https://learn.microsoft.com/en-gb/archive/blogs/autz_auth_stuff/kerberos-delegation
learn.microsoft.com
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation
book.hacktricks.xyz
https://adsecurity.org/?p=1640
adsecurity.org
https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html
web.mit.edu