APT

$ tldr RPC IPv6 enum → SMB hash spray → NTDS dump → DA

·	·
Operating system	Windows
Difficulty	Insane
Vector	Active Directory
IP	`10.10.10.213`
Retirement date	2021-04-10
Skills	RPC Enumeration Abusing RPC - IOXIDResolver.py (Obtaining the IPV6 machine address) Port scanning with nmap via ipv6 SMB enumeration via ipv6 Cracking ZIP file NTDS enumeration (secretsdump.py) Abusing Kerberos - Kerbrute (Valid user enumeration) SMB Hash Sprying Attempt (Our attack is blocked) PyKerbrute Script Manipulation - Adapting the script to our needs (Kerberos attack) Reg.py - Reading machine registers remotely (Registry Hives Enumeration) Abusing WinRM - Evil-WinRM WinPeas - System Enumeration Windows Defender Evasion Windows Defender Evasion - Bypass-4MSI to disable AMSI (Evil-WinRM) Windows Defender Evasion - Playing with Invoke-Binary to load an EXE into memory (Evil-WinRM) NTLM clients and services support NTLMv1 Collecting Net-NTLMv1 Hash via Responder (1122334455667788 Challenge) Cracking Hashes (Net-NTLMv1) [crack.sh] Secretsdump.py - Dumping the hashes for the rest of the AD users (Using the DRSUAPI method)

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Cracking Hashes (hashcat / John)	HackTricks	Open
winPEAS	PEASS-ng	Open
SMB (139/445)	HackTricks	Open

Brute Force / Rate-Limit Bypass · Active Directory · EternalBlue (MS17-010) · MS08-067 (NetAPI)

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-07-13