6.2.6 Validate host-specific access rights
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
Known credentials and scoped candidate hosts. A directory group or graph edge suggests a host right but does not prove service reachability.
Where to look: Check host-specific administrative and remote-logon rights, reachable service ports and endpoint policy. Prioritize hosts connected to your group memberships or application clues instead of trying every execution tool everywhere.
Expected behavior / secure boundary: Ordinary domain membership does not grant local administration on every computer. SMB authentication, share access, WinRM execution and RDP logon are separate authorizations. Administrative SMB context is host-specific.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.2.6.1 Baseline — Shell
Run: Kali / Linux. Requires: SMB route, explicit credentials and correctly scoped account identity. Effect: Authenticates to the selected host; authentication may generate logs and affect lockout state.
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares
What this checks: NetExec validates the selected SMB account context. A success label concerns that protocol and host. Its administrative indicator is a lead for service-control access, not proof of an existing shell or rights over the directory.
6.2.6.2 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
SMB APP01 445 [+] EXAMPLE\analyst:PASSWORD (Pwn3d!)
SMB DB01 445 [+] EXAMPLE\analyst:PASSWORD
WinRM APP01: Access is denied
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| APP01 administrative indicator | The tool reports administrative SMB context on APP01. | Check an appropriate SMB execution mechanism and its prerequisites. | §6.4.3.1 — Execute using SMB or WMI mechanisms |
| DB01 authentication success | The identity authenticated over SMB. | Enumerate relevant shares/rights; no execution follows automatically. | §6.2.2.1 — Enumerate shares, SYSVOL and NETLOGON |
| WinRM denied | That endpoint denied this attempt. | Check endpoint authorization and account syntax; preserve SMB evidence. | §6.4.2.1 — Access using WinRM or RDP |
Stop when: The selected protocol authentication and operation-specific authorization are distinguished.
Revisit only when: New credentials, host policy, endpoint rights or connectivity appears.
6.2.6.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | A reachable service authorizes the needed operation: choose its matching access method. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Ruled out in this context | One endpoint denies access: rule out only that endpoint/current context. | §6.2.2.1 — Enumerate shares, SYSVOL and NETLOGON |
| Inconclusive / failed check | Port or protocol preflight failed: diagnose routing before judging credentials. | §6.1.2.1 — Validate routes, naming and pivot connectivity |
6.2.6.4 Tooling and complete procedure
NetExec provides protocol-specific candidates on Kali. Built-in/native checks and PowerView Find-LocalAdminAccess are alternatives; host RPC/firewall restrictions affect coverage. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.