AD first pass, without menus

Four direct collectors for relationships, readable inventory, writable objects and shares.

Use the collector for the information you need. Start with the directory graph; add readable inventory when it helps you inspect users/groups, and query rights/shares for actionable leads. All commands run without menu selection or a password prompt.

Why direct commands? linWinPwn has no selective noninteractive collection flag. Its menus read from /dev/tty; --auto also runs attack routines. These direct invocations avoid that wrapper's startup scans, authentication-repair prompts and automatic batch. Automated enumeration fits OffSec's feature-based rules; this is not blanket tool approval. Official restrictions.

1. Prepare one private working directory

Run in Kali with the tools installed, one valid domain identity, working AD DNS and routes to the selected services. Replace DOMAIN with the DNS domain, DOMAIN_NETBIOS with its short domain name, DC_HOST with the DC FQDN, DC_IP with its IP, and TARGET with one approved SMB host. The examples use passwords; they do not claim interchangeable hash/ticket support.

mkdir -p ~/oscp/work/TARGET/evidence/ad-first-pass
cd ~/oscp/work/TARGET/evidence/ad-first-pass

Use a fresh directory for each identity/run. Secrets appear in process arguments, and NetExec also stores data locally; keep the working directory, shell history and tool databases private.

2. Run the selected collectors

A. Directory relationships — start here

bloodhound-ce-python -d DOMAIN -u USER -p 'PASSWORD' -dc DC_HOST -ns DC_IP -c DCOnly --disable-autogc --zip

Get: groups, trusts, object properties, ACLs and containers as CE graph data. Limit: no member-host sessions/local groups. DNS and DC/GC discovery still need scoped connectivity; this is not a network endpoint allowlist. The normal authentication path can obtain a TGT and fall back to NTLM. Owning procedure & limits.

B. Readable domain inventory

ldapdomaindump -u 'DOMAIN_NETBIOS\USER' -p 'PASSWORD' -o ldap-inventory ldap://DC_IP

Get: users/groups/computers/policy reports in ldap-inventory/. This queries LDAP and writes local reports; it does not test object writes. Extra hostname resolution is off. LDAP referrals can still expand contacted endpoints; a supplied IP is not an enforced boundary. Signing/channel-binding support differs across forks. Owning procedure.

C. Writable directory objects

bloodyAD --host DC_HOST --dc-ip DC_IP -d DOMAIN -u USER -p 'PASSWORD' get writable --detail --partition DOMAIN > writable.txt

Get: writable attributes, security-descriptor rights and creatable child classes in the domain naming context. The selected path searches effective-right attributes; it does not add, modify or delete an object. Configuration/schema/DNS partitions are omitted. Leave trust traversal and BloodHound export options off. Requires help showing --partition. Owning procedure.

D. Shares on one approved host

Version gate: use this form only if nxc smb --help documents --file-write-check and --no-admin-check. Leave --file-write-check off.

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares --no-admin-check --log shares.log

Get: share visibility, directory-listing access and access-right probes against existing share roots. In this version profile, no temporary files/directories are created; the separate SCM admin probe is skipped. WRITE (ACL) reports a requested right, not an ACL change or demonstrated file creation. SMB owner & next checks.

Older NetExec with --no-write-check (including v1.4.0)

Older plain --shares can create/delete temporary files and directories. Use this complete form only when local help supports the older flag:

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares --no-write-check --log shares.log

Write testing is skipped, and the older release can still query SCM permissions during login. A READ filter alone does not suppress its write check. If neither documented version profile matches, stop and check that installed version before using it.

3. Turn a result into one next check

Result	Interpretation / next check
BloodHound ZIP	Import into compatible BloodHound CE. Validate the useful edge's identity, object, effective permissions and prerequisites; a graph path is a candidate.
LDAP inventory	Inspect relevant users, memberships, descriptions, hosts and policies. Broad object visibility does not imply control.
`writable.txt`	Check the exact attribute/right, object type, protection and privileged consumer/trigger before choosing a change. Writable does not automatically mean escalation.
Readable share	Read one relevant file through the SMB procedure. Share access is not proof of local administration or execution.
Denied/empty/failed collection	Keep the gap. Confirm credential, protocol support, connectivity and visibility before ruling out a path.

Stop collecting when you have a useful lead. Re-enumerate after a new identity or access change; save which identity and command produced each decisive observation.

4. Boundaries that matter

Authentication failure: stop retries; confirm account/domain, validity and state. Separate collectors perform separate logons, even though they share one identity.
LDAP/Kerberos failure: check routing, AD DNS/time, signing and channel binding. Do not weaken target policy to make collection succeed.
Scope: discovered hosts/trusts are evidence, not permission to contact them. DCOnly is directory-focused, not a universal one-IP network sandbox.
Host collection: linWinPwn's all,LoggedOn is excluded from the baseline. It adds member-host RPC and remote-registry queries, which can trigger RemoteRegistry service startup.
Inventory is active: logons, audit events, network traffic and local evidence writes still occur. No target writes in a selected path does not mean no observable effects.
Tool versions: use local help and the owning procedures. Do not extrapolate behavior from a tool name or another release.

Sources & setup

Tooling for this section: BloodHound.py CE for directory relationships, ldapdomaindump for readable inventory, bloodyAD for an effective-rights query, and NetExec for selected-host shares. Extra tools preparation and owning AD setup keep installation/help checks separate from collection. These are reference examples for later scoped practice; no live target execution is established here.

BloodHound.py CE source · ldapdomaindump source · bloodyAD source · NetExec shares documentation · linWinPwn source · OffSec FAQ

← Back to Misc