windows-ad-methodologylisted

# Windows / Active Directory Methodology For readers who live in Linux: Windows CTF is a different surface. Instead of web/SSH → SUID/sudo, the game is SMB/LDAP/Kerberos → tokens/ACLs/tickets. Follow this flow. ## Recognizing a Windows box Open 135/139/445 (SMB), 3389 (RDP), 5985 (WinRM), and especially 88 (Kerberos) + 389/636 (LDAP) → domain-joined AD. Kerberos (88) present = treat it as full AD. ## 0. Setup - /vpn-check the target - Add the DC's FQDN to /etc/hosts (Kerberos needs name resolution) - Watch clock skew: sync to the DC if Kerberos tooling errors (`sudo rdate -n <DC-IP>`) ## 1. Recon - /recon as usual. Note the domain name, DC hostname, OS build. - Consider /enum-udp too — SNMP can leak users/processes on Windows hosts. ## 2. AD / SMB enumeration - /enum-ad — null/guest sessions, shares, RPC, LDAP, build a user list - Harvest usernames from RID cycling, shares, LDAP. Save to users.txt. ## 3. Get a foothold credential (try in order) - AS-REP roast the user list (/kerberos) — no creds needed - Password spray weak/found passwords across users (careful of lockout) - Anonymous/guest readable shares — look for creds, configs, scripts - Any web app on the box → normal web enum (/enum-web) - Any database on the box → /db-enum (MSSQL especially — xp_cmdshell) ## 4. Situational awareness (once you have ANY valid cred) - Run BloodHound collection — let the ad-attack-advisor agent read the results - Validate the cred everywhere: `nxc smb <IP/range> -u <u> -p <p>` (loo