introduction

🛠️ My AD Lab Pentesting Learning Journey – Tools Guide & Checklist

Welcome to my personal blog documenting my journey into Active Directory (AD) penetration testing in a lab environment. This post serves as both a learning resource and a checklist to help me track my progress and understanding of essential tools used in AD attacks.

🔐 Disclaimer: This content is for educational purposes only. Use only in authorized environments like your own lab or with proper permissions.

---

🔍 Tool Overview & Usage Guide

Below are the tools I'm learning, along with their purpose and usage.

---

1. GetADUsers.py

Purpose: Enumerate users from Active Directory using LDAP queries. Use Case: Discover user accounts in the domain. How to Use:

bash1python GetADUsers.py -u 'user' -p 'password' -d 'domain.com' ldap://dc.domain.com

Notes: Requires LDAP access. Useful for initial reconnaissance.

---

2. GetNPUsers.py

Purpose: Enumerate users with DoNotRequirePreauth (Kerberos) enabled. Use Case: Find users that can be cracked offline via Kerberos AS-REP. How to Use:

bash1python GetNPUsers.py domain.com/user -dc-ip 192.168.1.10 -no-pass -request

Notes: No password needed if DoNotRequirePreauth is enabled.

---

3. Get-GPPPassword.py

Purpose: Extract passwords from Group Policy Preferences (GPP). Use Case: Find plaintext passwords in .xml files (e.g., saved credentials in user profiles). How to Use:

bash1python Get-GPPPassword.py -u 'user' -p 'password' -d 'domain.com' -dc-ip 192.168.1.10

Notes: GPP is outdated but still found in legacy environments.

---

4. GetUserSPNs.py

Purpose: Enumerate users with Service Principal Names (SPNs). Use Case: Identify users that can be targeted for Kerberoasting. How to Use:

bash1python GetUserSPNs.py domain.com/user -k -no-pass -dc-ip 192.168.1.10

Notes: Requires valid credentials. Output is encrypted TGS tickets for cracking.

---

5. nxc (NetExec)

Purpose: Modern, fast, multi-protocol network scanner and exploit tool. Use Case: Execute commands, scan for vulnerabilities, and perform lateral movement. How to Use:

bash1nxc smb 192.168.1.10 -u 'user' -p 'password' -x 'whoami'

Notes: Supports SMB, WinRM, SSH, RDP, and more. Great for automation.

---

6. smbmap.py

Purpose: Enumerate SMB shares and access files. Use Case: Find accessible shares and download sensitive files. How to Use:

bash1python smbmap.py -u 'user' -p 'password' -H 192.168.1.10 -r 'C$'

Notes: Useful for finding C$, ADMIN$, and other shares.

---

7. evil-winrm

Purpose: Connect to Windows machines via WinRM (Remote Management). Use Case: Execute commands on remote Windows systems. How to Use:

bash1evil-winrm -i 192.168.1.10 -u 'user' -p 'password'

Notes: Requires WinRM enabled on target.

---

8. psexec.py

Purpose: Execute commands via PsExec (SMB-based). Use Case: Remote command execution without installing agents. How to Use:

bash1python psexec.py domain/user:password@192.168.1.10

Notes: Requires SMB access and valid credentials.

---

9. lookupsid.py

Purpose: Enumerate SID (Security Identifier) information for users/groups. Use Case: Map users to their domain roles and privileges. How to Use:

bash1python lookupsid.py -u 'user' -p 'password' -d 'domain.com' 192.168.1.10

Notes: Helps identify privileged users and groups.

---

10. kerbrute

Purpose: Bruteforce Kerberos authentication and enumerate users. Use Case: User enumeration and password spraying. How to Use:

bash1kerbrute userenum --dc 192.168.1.10 --users users.txt --domain domain.com

Notes: Fast and efficient for user enumeration.

---

11. secretsdump.py

Purpose: Dump NTLM hashes, LM hashes, and DPAPI secrets from LSASS memory or SAM. Use Case: Extract credentials from domain controllers or compromised machines. How to Use:

bash1python secretsdump.py domain/user:password@192.168.1.10

Notes: Requires valid domain credentials. Outputs hashes for cracking.

---

12. crackmapexec

Purpose: Multi-protocol scanner and exploit tool (like nxc). Use Case: Scan for vulnerabilities, execute commands, and perform lateral movement. How to Use:

bash1crackmapexec smb 192.168.1.10 -u 'user' -p 'password' -d 'domain.com'

Notes: Supports SMB, WinRM, SSH, RDP, and more. Great for automation.

---

13. smbpasswd

Purpose: Change or reset SMB passwords (used with smbclient). Use Case: Password reset on SMB shares. How to Use:

bash1smbpasswd -U 'username' -p 'newpassword' -r '192.168.1.10'

Notes: Requires valid credentials. Used in post-exploitation.