Post Exploitation
Impacket
To get TGT (Ticket Granting Ticket with impacket):
getTGT.py domain.htb/userTo dump hashes:
secretsdump.py htb.local/aditya:aditya@<ip>Bloodhound
To use TGT with bloodhound
KRB5CCNAME=user.ccache ./bloodhound.py -k -dc dc.domain.htb -ns <ip> -c All -d domain.htb -u user@domain.htbNetExec
mimikatz module:
Password Bruteforce:
Kerbrute
To check if users exist and then get their hashes:
Enumeration
To check domain details
To check group details
To add new user to domain:
To add user to a group:
To check users in the group:
To check password policy, lockout policy, etc:
To reset other user's password if permission present use:
If username already present in format of : then:
Powershell:
For groups:
For domains:
Change Password:
Last updated
Was this helpful?