# Active Directory Exploitation Cheat Sheet ⭐

**URL:** <https://onehack.st/t/active-directory-exploitation-cheat-sheet/230069>\
**Category:** Tools & Scripts\
**Tags:** tools, freebies\
**Created:** [December 20, 2022, 9:13pm UTC](https://onehack.st/t/active-directory-exploitation-cheat-sheet/230069 "2022-12-20T21:13:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\
**Post date:** [December 20, 2022, 9:13pm UTC](https://onehack.st/t/active-directory-exploitation-cheat-sheet/230069/1 "2022-12-20T21:13:36Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/0/8/082eaa93c2051e16b67e7840d8550b2f70e519e1.jpeg)

This cheat sheet contains common enumeration and attack methods for Windows Active Directory.

This cheat sheet is inspired by the [PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) repo.

## Summary

- Active Directory Exploitation Cheat Sheet
- Summary
- Tools
- Domain Enumeration
- Using PowerView
- Using AD Module
- Using BloodHound
- Remote BloodHound
- On Site BloodHound
- Using Adalanche
- Remote adalanche
- Useful Enumeration Tools
- Local Privilege Escalation
- Useful Local Priv Esc Tools
- Lateral Movement
- Powershell Remoting
- Remote Code Execution with PS Credentials
- Import a PowerShell Module and Execute its Functions Remotely
- Executing Remote Stateful commands
- Mimikatz
- Remote Desktop Protocol
- URL File Attacks
- Useful Tools
- Domain Privilege Escalation
- Kerberoast
- ASREPRoast
- Password Spray Attack
- Force Set SPN
- Abusing Shadow Copies
- List and Decrypt Stored Credentials using Mimikatz
- Unconstrained Delegation
- Constrained Delegation
- Resource Based Constrained Delegation
- DNSAdmins Abuse
- Abusing Active Directory-Integraded DNS
- Abusing Backup Operators Group
- Abusing Exchange
- Weaponizing Printer Bug
- Abusing ACLs
- Abusing IPv6 with mitm6
- SID History Abuse
- Exploiting SharePoint
- Zerologon
- PrintNightmare
- Active Directory Certificate Services
- No PAC
- Domain Persistence
- Golden Ticket Attack
- DCsync Attack
- Silver Ticket Attack
- Skeleton Key Attack
- DSRM Abuse
- Custom SSP
- Cross Forest Attacks
- Trust Tickets
- Abuse MSSQL Servers
- Breaking Forest Trusts

## Tools

- [Powersploit](https://github.com/PowerShellMafia/PowerSploit/tree/dev)
- [PowerUpSQL](https://github.com/NetSPI/PowerUpSQL)
- [Powermad](https://github.com/Kevin-Robertson/Powermad)
- [Impacket](https://github.com/SecureAuthCorp/impacket)
- [Mimikatz](https://github.com/gentilkiwi/mimikatz)
- [Rubeus](https://github.com/GhostPack/Rubeus) → [Compiled Version](https://github.com/r3motecontrol/Ghostpack-CompiledBinaries)
- [BloodHound](https://github.com/BloodHoundAD/BloodHound)
- [AD Module](https://github.com/samratashok/ADModule)
- [ASREPRoast](https://github.com/HarmJ0y/ASREPRoast)
- [Adalanche](https://github.com/lkarlslund/adalanche)

## GitHub:

> **[GitHub - S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet: A cheat sheet that contains common enumeration and...](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)**
>
> A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

# **ENJOY & HAPPY LEARNING!** ❤