Active Directory глазами Impacket

usage: addcomputer.py [-h] [-domain-netbios NETBIOSNAME] [-computer-name COMPUTER-NAME$] [-computer-pass password] [-no-add] [-delete] [-debug] [-method {SAMR,LDAPS}]                       [-port {139,445,636}] [-baseDN DC=test,DC=local] [-computer-group CN=Computers,DC=test,DC=local] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key]                       [-dc-host hostname] [-dc-ip ip]                       [domain/]username[:password]  positional arguments:   [domain/]username[:password]                         Account used to authenticate to DC.  optional arguments:   -h, --help            show this help message and exit   -domain-netbios NETBIOSNAME                         Domain NetBIOS name. Required if the DC has multiple domains.   -computer-name COMPUTER-NAME$                         Name of computer to add.If omitted, a random DESKTOP-[A-Z0-9]{8} will be used.   -computer-pass password                         Password to set to computerIf omitted, a random [A-Za-z0-9]{32} will be used.   -no-add               Don't add a computer, only set password on existing one.   -delete               Delete an existing computer.   -debug                Turn DEBUG output ON   -method {SAMR,LDAPS}  Method of adding the computer.SAMR works over SMB.LDAPS has some certificate requirementsand isn't always available.   -port {139,445,636}   Destination port to connect to. SAMR defaults to 445, LDAPS to 636.  LDAP:   -baseDN DC=test,DC=local                         Set baseDN for LDAP.If ommited, the domain part (FQDN) specified in the account parameter will be used.   -computer-group CN=Computers,DC=test,DC=local                         Group to which the account will be added.If omitted, CN=Computers will be used,  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on account parameters. If valid credentials cannot be found, it will                         use the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -dc-host hostname     Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be used   -dc-ip ip             IP of the domain controller to use. Useful if you can't translate the FQDN.specified in the account parameter will be used

usage: atexec.py [-h] [-session-id SESSION_ID] [-ts] [-silentcommand] [-debug] [-codec CODEC] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address]                  [-keytab KEYTAB]                  target [command ...]  positional arguments:   target                [[domain/]username[:password]@]<targetName or address>   command               command to execute at the target  optional arguments:   -h, --help            show this help message and exit   -session-id SESSION_ID                         an existed logon session to use (no output, no cmd.exe)   -ts                   adds timestamp to every logging output   -silentcommand        does not execute cmd.exe to run given command (no output)   -debug                Turn DEBUG output ON   -codec CODEC          Sets encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with                         https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py again with -codec and the corresponding codec  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter   -keytab KEYTAB        Read keys for SPN from keytab file 

usage: dcomexec.py [-h] [-share SHARE] [-nooutput] [-ts] [-debug] [-codec CODEC] [-object [{ShellWindows,ShellBrowserWindow,MMC20}]] [-com-version MAJOR_VERSION:MINOR_VERSION]                    [-shell-type {cmd,powershell}] [-silentcommand] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-A authfile] [-keytab KEYTAB]                    target [command ...]  positional arguments:   target                [[domain/]username[:password]@]<targetName or address>   command               command to execute at the target. If empty it will launch a semi-interactive shell  optional arguments:   -h, --help            show this help message and exit   -share SHARE          share where the output will be grabbed from (default ADMIN$)   -nooutput             whether or not to print the output (no SMB connection created)   -ts                   Adds timestamp to every logging output   -debug                Turn DEBUG output ON   -codec CODEC          Sets encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with                         https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py again with -codec and the corresponding codec   -object [{ShellWindows,ShellBrowserWindow,MMC20}]                         DCOM object to be used to execute the shell command (default=ShellWindows)   -com-version MAJOR_VERSION:MINOR_VERSION                         DCOM version, format is MAJOR_VERSION:MINOR_VERSION e.g. 5.7   -shell-type {cmd,powershell}                         choose a command processor for the semi-interactive shell   -silentcommand        does not execute cmd.exe to run given command (no output, cannot run dir/cd/etc.)  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -dc-ip ip address     IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter   -A authfile           smbclient/mount.cifs-style authentication file. See smbclient man page's -A option.   -keytab KEYTAB        Read keys for SPN from keytab file

usage: exchanger.py [-h] [-debug] [-rpc-hostname RPC_HOSTNAME] [-hashes LMHASH:NTHASH] target {nspi} ...   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>   {nspi}                A module name     nspi                Attack NSPI interface  optional arguments:   -h, --help            show this help message and exit   -debug                Turn DEBUG and EXTENDED output ON   -rpc-hostname RPC_HOSTNAME                         A name of the server in GUID (preferred) or NetBIOS name format (see description in the beggining of this file)  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH

usage: findDelegation.py [-h] [-target-domain TARGET_DOMAIN] [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] target   positional arguments:   target                domain/username[:password]  optional arguments:   -h, --help            show this help message and exit   -target-domain TARGET_DOMAIN                         Domain to query/request if different than the domain of the user. Allows for retrieving delegation info across trusts.   -debug                Turn DEBUG output ON  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -dc-ip ip address     IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter. Ignoredif -target-domain is specified.

usage: GetADUsers.py [-h] [-user username] [-all] [-ts] [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] target   positional arguments:   target                domain/username[:password]  optional arguments:   -h, --help            show this help message and exit   -user username        Requests data for specific user   -all                  Return all users, including those with no email addresses and disabled accounts. When used with -user it will return user's info even if the account is                         disabled   -ts                   Adds timestamp to every logging output   -debug                Turn DEBUG output ON  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -dc-ip ip address     IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter

usage: getArch.py [-h] [-target TARGET] [-targets TARGETS] [-timeout TIMEOUT] [-debug]  optional arguments:   -h, --help        show this help message and exit   -target TARGET    <targetName or address>   -targets TARGETS  input file with targets system to query Arch from (one per line).   -timeout TIMEOUT  socket timeout out when connecting to the target (default 2 sec)   -debug            Turn DEBUG output ON

usage: GetNPUsers.py [-h] [-request] [-outputfile OUTPUTFILE]                      [-format {hashcat,john}] [-usersfile USERSFILE] [-ts]                      [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k]                      [-aesKey hex key] [-dc-ip ip address]                      target  positional arguments:   target                domain/username[:password]  optional arguments:   -h, --help            show this help message and exit   -request              Requests TGT for users and output them in JtR/hashcat                         format (default False)   -outputfile OUTPUTFILE                         Output filename to write ciphers in JtR/hashcat format   -format {hashcat,john}                         format to save the AS_REQ of users without pre-                         authentication. Default is hashcat   -usersfile USERSFILE  File with user per line to test   -ts                   Adds timestamp to every logging output   -debug                Turn DEBUG output ON  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from                         ccache file (KRB5CCNAME) based on target parameters.                         If valid credentials cannot be found, it will use the                         ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256                         bits)   -dc-ip ip address     IP Address of the domain controller. If ommited it use                         the domain part (FQDN) specified in the target                         parameter  There are a few modes for using this script  1. Get a TGT for a user:          GetNPUsers.py contoso.com/john.doe -no-pass  For this operation you don't need john.doe's password. It is important tho, to specify -no-pass in the script, otherwise a badpwdcount entry will be added to the user  2. Get a list of users with UF_DONT_REQUIRE_PREAUTH set          GetNPUsers.py contoso.com/emily:password or GetNPUsers.py contoso.com/emily  This will list all the users in the contoso.com domain that have UF_DONT_REQUIRE_PREAUTH set. However it will require you to have emily's password. (If you don't specify it, it will be asked by the script)  3. Request TGTs for all users          GetNPUsers.py contoso.com/emily:password -request or GetNPUsers.py contoso.com/emily  4. Request TGTs for users in a file          GetNPUsers.py contoso.com/ -no-pass -usersfile users.txt  For this operation you don't need credentials.

usage: getPac.py [-h] -targetUser TARGETUSER [-debug] [-hashes LMHASH:NTHASH] credentials  positional arguments:   credentials           domain/username[:password]. Valid domain credentials to use for grabbing targetUser's PAC  optional arguments:   -h, --help            show this help message and exit   -targetUser TARGETUSER                         the target user to retrieve the PAC of   -debug                Turn DEBUG output ON  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH

usage: GetUserSPNs.py [-h] [-target-domain TARGET_DOMAIN] [-usersfile USERSFILE] [-request] [-request-user username] [-save] [-outputfile OUTPUTFILE] [-debug]                       [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address]                       target  positional arguments:   target                domain/username[:password]  optional arguments:   -h, --help            show this help message and exit   -target-domain TARGET_DOMAIN                         Domain to query/request if different than the domain of the user. Allows for Kerberoasting across trusts.   -usersfile USERSFILE  File with user per line to test   -request              Requests TGS for users and output them in JtR/hashcat format (default False)   -request-user username                         Requests TGS for the SPN associated to the user specified (just the username, no domain needed)   -save                 Saves TGS requested to disk. Format is <username>.ccache. Auto selects -request   -outputfile OUTPUTFILE                         Output filename to write ciphers in JtR/hashcat format   -debug                Turn DEBUG output ON  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -dc-ip ip address     IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter. Ignoredif -target-domain is specified.

usage: lookupsid.py [-h] [-ts] [-target-ip ip address] [-port [destination port]] [-domain-sids] [-hashes LMHASH:NTHASH] [-no-pass] target [maxRid]   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>   maxRid                max Rid to check (default 4000)  optional arguments:   -h, --help            show this help message and exit   -ts                   Adds timestamp to every logging output  connection:   -target-ip ip address                         IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot                         resolve it   -port [destination port]                         Destination port to connect to SMB Server   -domain-sids          Enumerate Domain SIDs (will likely forward requests to the DC)  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful when proxying through smbrelayx)

usage: mimikatz.py [-h] [-file FILE] [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-target-ip ip address] target   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>  optional arguments:   -h, --help            show this help message and exit   -file FILE            input file with commands to execute in the mini shell   -debug                Turn DEBUG output ON  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)  connection:   -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter   -target-ip ip address                         IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot                         resolve it

usage: ntlmrelayx.py [-h] [-ts] [-debug] [-t TARGET] [-tf TARGETSFILE] [-w]                      [-i] [-ip INTERFACE_IP] [--no-smb-server]                      [--no-http-server] [--no-wcf-server] [--no-raw-server]                      [--smb-port SMB_PORT] [--http-port HTTP_PORT]                      [--wcf-port WCF_PORT] [--raw-port RAW_PORT]                      [--no-multirelay] [-ra] [-r SMBSERVER] [-l LOOTDIR]                      [-of OUTPUT_FILE] [-codec CODEC] [-smb2support]                      [-ntlmchallenge NTLMCHALLENGE] [-socks] [-wh WPAD_HOST]                      [-wa WPAD_AUTH_NUM] [-6] [--remove-mic]                      [--serve-image SERVE_IMAGE] [-c COMMAND] [-e FILE]                      [--enum-local-admins] [-rpc-mode {TSCH}] [-rpc-use-smb]                      [-auth-smb [domain/]username[:password]]                      [-hashes-smb LMHASH:NTHASH] [-rpc-smb-port {139,445}]                      [-q QUERY] [-machine-account MACHINE_ACCOUNT]                      [-machine-hashes LMHASH:NTHASH] [-domain DOMAIN]                      [-remove-target] [--no-dump] [--no-da] [--no-acl]                      [--no-validate-privs] [--escalate-user ESCALATE_USER]                      [--add-computer [COMPUTERNAME [PASSWORD ...]]]                      [--delegate-access] [--sid] [--dump-laps] [--dump-gmsa]                      [--dump-adcs] [-k KEYWORD] [-m MAILBOX] [-a]                      [-im IMAP_MAX] [--adcs] [--template TEMPLATE]                      [--altname ALTNAME] [--shadow-credentials]                      [--shadow-target SHADOW_TARGET]                      [--pfx-password PFX_PASSWORD] [--export-type {PEM, PFX}]                      [--cert-outfile-path CERT_OUTFILE_PATH]   Main options:   -h, --help            show this help message and exit   -ts                   Adds timestamp to every logging output   -debug                Turn DEBUG output ON   -t TARGET, --target TARGET                         Target to relay the credentials to, can be an IP,                         hostname or URL like domain\username@host:port                         (domain\username and port are optional, and don't                         forget to escape the '\'). If unspecified, it will                         relay back to the client')   -tf TARGETSFILE       File that contains targets by hostname or full URL,                         one per line   -w                    Watch the target file for changes and update target                         list automatically (only valid with -tf)   -i, --interactive     Launch an smbclient or LDAP console insteadof                         executing a command after a successful relay. This                         console will listen locally on a tcp port and can be                         reached with for example netcat.   -ip INTERFACE_IP, --interface-ip INTERFACE_IP                         IP address of interface to bind SMB and HTTP servers   --smb-port SMB_PORT   Port to listen on smb server   --http-port HTTP_PORT                         Port(s) to listen on HTTP server. Can specify multiple                         ports by separating them with `,`, and ranges with                         `-`. Ex: `80,8000-8010`   --wcf-port WCF_PORT   Port to listen on wcf server   --raw-port RAW_PORT   Port to listen on raw server   --no-multirelay       If set, disable multi-host relay (SMB and HTTP                         servers)   -ra, --random         Randomize target selection   -r SMBSERVER          Redirect HTTP requests to a file:// path on SMBSERVER   -l LOOTDIR, --lootdir LOOTDIR                         Loot directory in which gathered loot such as SAM                         dumps will be stored (default: current directory).   -of OUTPUT_FILE, --output-file OUTPUT_FILE                         base output filename for encrypted hashes. Suffixes                         will be added for ntlm and ntlmv2   -codec CODEC          Sets encoding used (codec) from the target's output                         (default "utf-8"). If errors are detected, run                         chcp.com at the target, map the result with https://do                         cs.python.org/3/library/codecs.html#standard-encodings                         and then execute ntlmrelayx.py again with -codec and                         the corresponding codec   -smb2support          SMB2 Support   -ntlmchallenge NTLMCHALLENGE                         Specifies the NTLM server challenge used by the SMB                         Server (16 hex bytes long. eg: 1122334455667788)   -socks                Launch a SOCKS proxy for the connection relayed   -wh WPAD_HOST, --wpad-host WPAD_HOST                         Enable serving a WPAD file for Proxy Authentication                         attack, setting the proxy host to the one supplied.   -wa WPAD_AUTH_NUM, --wpad-auth-num WPAD_AUTH_NUM                         Prompt for authentication N times for clients without                         MS16-077 installed before serving a WPAD file.                         (default=1)   -6, --ipv6            Listen on both IPv6 and IPv4   --remove-mic          Remove MIC (exploit CVE-2019-1040)   --serve-image SERVE_IMAGE                         local path of the image that will we returned to                         clients   -c COMMAND            Command to execute on target system (for SMB and RPC).                         If not specified for SMB, hashes will be dumped                         (secretsdump.py must be in the same directory). For                         RPC no output will be provided.    --no-smb-server       Disables the SMB server   --no-http-server      Disables the HTTP server   --no-wcf-server       Disables the WCF server   --no-raw-server       Disables the RAW server  SMB client options:   -e FILE               File to execute on the target system. If not                         specified, hashes will be dumped (secretsdump.py must                         be in the same directory)   --enum-local-admins   If relayed user is not admin, attempt SAMR lookup to                         see who is (only works pre Win 10 Anniversary)  RPC client options:   -rpc-mode {TSCH}      Protocol to attack, only TSCH supported   -rpc-use-smb          Relay DCE/RPC to SMB pipes   -auth-smb [domain/]username[:password]                         Use this credential to authenticate to SMB (low-                         privilege account)   -hashes-smb LMHASH:NTHASH   -rpc-smb-port {139,445}                         Destination port to connect to SMB  MSSQL client options:   -q QUERY, --query QUERY                         MSSQL query to execute(can specify multiple)  HTTP options:   -machine-account MACHINE_ACCOUNT                         Domain machine account to use when interacting with                         the domain to grab a session key for signing, format                         is domain/machine_name   -machine-hashes LMHASH:NTHASH                         Domain machine hashes, format is LMHASH:NTHASH   -domain DOMAIN        Domain FQDN or IP to connect using NETLOGON   -remove-target        Try to remove the target in the challenge message (in                         case CVE-2019-1019 patch is not installed)  LDAP client options:   --no-dump             Do not attempt to dump LDAP information   --no-da               Do not attempt to add a Domain Admin   --no-acl              Disable ACL attacks   --no-validate-privs   Do not attempt to enumerate privileges, assume                         permissions are granted to escalate a user via ACL                         attacks   --escalate-user ESCALATE_USER                         Escalate privileges of this user instead of creating a                         new one   --add-computer [COMPUTERNAME [PASSWORD ...]]                         Attempt to add a new computer account   --delegate-access     Delegate access on relayed computer account to the                         specified account   --sid                 Use a SID to delegate access rather than an account                         name   --dump-laps           Attempt to dump any LAPS passwords readable by the                         user   --dump-gmsa           Attempt to dump any gMSA passwords readable by the                         user   --dump-adcs           Attempt to dump ADCS enrollment services and                         certificate templates info  IMAP client options:   -k KEYWORD, --keyword KEYWORD                         IMAP keyword to search for. If not specified, will                         search for mails containing "password"   -m MAILBOX, --mailbox MAILBOX                         Mailbox name to dump. Default: INBOX   -a, --all             Instead of searching for keywords, dump all emails   -im IMAP_MAX, --imap-max IMAP_MAX                         Max number of emails to dump (0 = unlimited, default:                         no limit)  AD CS attack options:   --adcs                Enable AD CS relay attack   --template TEMPLATE   AD CS template. Defaults to Machine or User whether                         relayed account name ends with `$`. Relaying a DC                         should require specifying `DomainController`   --altname ALTNAME     Subject Alternative Name to use when performing ESC1                         or ESC6 attacks.  Shadow Credentials attack options:   --shadow-credentials  Enable Shadow Credentials relay attack (msDS-                         KeyCredentialLink manipulation for PKINIT pre-                         authentication)   --shadow-target SHADOW_TARGET                         target account (user or computer$) to populate msDS-                         KeyCredentialLink from   --pfx-password PFX_PASSWORD                         password for the PFX stored self-signed certificate                         (will be random if not set, not needed when exporting                         to PEM)   --export-type {PEM, PFX}                         choose to export cert+private key in PEM or PFX (i.e.                         #PKCS12) (default: PFX))   --cert-outfile-path CERT_OUTFILE_PATH                         filename to store the generated self-signed PEM or PFX                         certificate and key

usage: rpcdump.py [-h] [-debug] [-target-ip ip address] [-port [destination port]] [-hashes LMHASH:NTHASH] target   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>  optional arguments:   -h, --help            show this help message and exit   -debug                Turn DEBUG output ON  connection:   -target-ip ip address                         IP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot                         resolve it   -port [destination port]                         Destination port to connect to RPC Endpoint Mapper  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH

usage: samrdump.py [-h] [-csv] [-ts] [-debug] [-dc-ip ip address] [-target-ip ip address] [-port [destination port]] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key]                    target   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>  optional arguments:   -h, --help            show this help message and exit   -csv                  Turn CSV output   -ts                   Adds timestamp to every logging output   -debug                Turn DEBUG output ON  connection:   -dc-ip ip address     IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter   -target-ip ip address                         IP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot                         resolve it   -port [destination port]                         Destination port to connect to SMB Server  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)

usage: secretsdump.py [-h] [-ts] [-debug] [-system SYSTEM] [-bootkey BOOTKEY]                       [-security SECURITY] [-sam SAM] [-ntds NTDS]                       [-resumefile RESUMEFILE] [-outputfile OUTPUTFILE]                       [-use-vss] [-rodcNo RODCNO] [-rodcKey RODCKEY]                       [-use-keylist]                       [-exec-method [{smbexec,wmiexec,mmcexec}]]                       [-just-dc-user USERNAME] [-just-dc] [-just-dc-ntlm]                       [-pwd-last-set] [-user-status] [-history]                       [-hashes LMHASH:NTHASH] [-no-pass] [-k]                       [-aesKey hex key] [-keytab KEYTAB] [-dc-ip ip address]                       [-target-ip ip address]                       target   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>                         or LOCAL (if you want to parse local files)  optional arguments:   -h, --help            show this help message and exit   -ts                   Adds timestamp to every logging output   -debug                Turn DEBUG output ON   -system SYSTEM        SYSTEM hive to parse   -bootkey BOOTKEY      bootkey for SYSTEM hive   -security SECURITY    SECURITY hive to parse   -sam SAM              SAM hive to parse   -ntds NTDS            NTDS.DIT file to parse   -resumefile RESUMEFILE                         resume file name to resume NTDS.DIT session dump (only                         available to DRSUAPI approach). This file will also be                         used to keep updating the session's state   -outputfile OUTPUTFILE                         base output filename. Extensions will be added for                         sam, secrets, cached and ntds   -use-vss              Use the VSS method instead of default DRSUAPI   -rodcNo RODCNO        Number of the RODC krbtgt account (only avaiable for                         Kerb-Key-List approach)   -rodcKey RODCKEY      AES key of the Read Only Domain Controller (only                         avaiable for Kerb-Key-List approach)   -use-keylist          Use the Kerb-Key-List method instead of default                         DRSUAPI   -exec-method [{smbexec,wmiexec,mmcexec}]                         Remote exec method to use at target (only when using                         -use-vss). Default: smbexec  display options:   -just-dc-user USERNAME                         Extract only NTDS.DIT data for the user specified.                         Only available for DRSUAPI approach. Implies also                         -just-dc switch   -just-dc              Extract only NTDS.DIT data (NTLM hashes and Kerberos                         keys)   -just-dc-ntlm         Extract only NTDS.DIT data (NTLM hashes only)   -pwd-last-set         Shows pwdLastSet attribute for each NTDS.DIT account.                         Doesn't apply to -outputfile data   -user-status          Display whether or not the user is disabled   -history              Dump password history, and LSA secrets OldVal  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from                         ccache file (KRB5CCNAME) based on target parameters.                         If valid credentials cannot be found, it will use the                         ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256                         bits)   -keytab KEYTAB        Read keys for SPN from keytab file  connection:   -dc-ip ip address     IP Address of the domain controller. If ommited it use                         the domain part (FQDN) specified in the target                         parameter   -target-ip ip address                         IP Address of the target machine. If omitted it will                         use whatever was specified as target. This is useful                         when target is the NetBIOS name and you cannot resolve                         it

usage: smbclient.py [-h] [-file FILE] [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-target-ip ip address] [-port [destination port]]                     target   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>  optional arguments:   -h, --help            show this help message and exit   -file FILE            input file with commands to execute in the mini shell   -debug                Turn DEBUG output ON  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)  connection:   -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter   -target-ip ip address                         IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot                         resolve it   -port [destination port]                         Destination port to connect to SMB Server

usage: smbexec.py [-h] [-share SHARE] [-mode {SERVER,SHARE}] [-ts] [-debug] [-codec CODEC] [-shell-type {cmd,powershell}] [-dc-ip ip address] [-target-ip ip address]                   [-port [destination port]] [-service-name service_name] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-keytab KEYTAB]                   target  positional arguments:   target                [[domain/]username[:password]@]<targetName or address>  optional arguments:   -h, --help            show this help message and exit   -share SHARE          share where the output will be grabbed from (default C$)   -mode {SERVER,SHARE}  mode to use (default SHARE, SERVER needs root!)   -ts                   adds timestamp to every logging output   -debug                Turn DEBUG output ON   -codec CODEC          Sets encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with                         https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec   -shell-type {cmd,powershell}                         choose a command processor for the semi-interactive shell  connection:   -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter   -target-ip ip address                         IP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot                         resolve it   -port [destination port]                         Destination port to connect to SMB Server   -service-name service_name                         The name of theservice used to trigger the payload  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -keytab KEYTAB        Read keys for SPN from keytab file

usage: ticketConverter.py [-h] input_file output_file   positional arguments:   input_file   File in kirbi (KRB-CRED) or ccache format   output_file  Output file  optional arguments:   -h, --help   show this help message and exit

usage: ticketer.py [-h] [-spn SPN] [-request] -domain DOMAIN -domain-sid DOMAIN_SID [-aesKey hex key] [-nthash NTHASH] [-keytab KEYTAB] [-groups GROUPS] [-user-id USER_ID]                    [-extra-sid EXTRA_SID] [-duration DURATION] [-ts] [-debug] [-user USER] [-password PASSWORD] [-hashes LMHASH:NTHASH] [-dc-ip ip address]                    target   positional arguments:   target                username for the newly created ticket  optional arguments:   -h, --help            show this help message and exit   -spn SPN              SPN (service/server) of the target service the silver ticket will be generated for. if omitted, golden ticket will be created   -request              Requests ticket to domain and clones it changing only the supplied information. It requires specifying -user   -domain DOMAIN        the fully qualified domain name (e.g. contoso.com)   -domain-sid DOMAIN_SID                         Domain SID of the target domain the ticker will be generated for   -aesKey hex key       AES key used for signing the ticket (128 or 256 bits)   -nthash NTHASH        NT hash used for signing the ticket   -keytab KEYTAB        Read keys for SPN from keytab file (silver ticket only)   -groups GROUPS        comma separated list of groups user will belong to (default = 513, 512, 520, 518, 519)   -user-id USER_ID      user id for the user the ticket will be created for (default = 500)   -extra-sid EXTRA_SID  Comma separated list of ExtraSids to be included inside the ticket's PAC   -duration DURATION    Amount of days till the ticket expires (default = 365*10)   -ts                   Adds timestamp to every logging output   -debug                Turn DEBUG output ON  authentication:   -user USER            domain/username to be used if -request is chosen (it can be different from domain/username   -password PASSWORD    password for domain/username   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -dc-ip ip address     IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter  Examples:         ./ticketer.py -nthash <krbtgt/service nthash> -domain-sid <your domain SID> -domain <your domain FQDN> baduser          will create and save a golden ticket for user 'baduser' that will be all encrypted/signed used RC4.         If you specify -aesKey instead of -ntHash everything will be encrypted using AES128 or AES256         (depending on the key specified). No traffic is generated against the KDC. Ticket will be saved as         baduser.ccache.          ./ticketer.py -nthash <krbtgt/service nthash> -aesKey <krbtgt/service AES> -domain-sid <your domain SID> -domain <your domain FQDN> -request -user <a valid domain user> -password <valid domain user's password> baduser          will first authenticate against the KDC (using -user/-password) and get a TGT that will be used         as template for customization. Whatever encryption algorithms used on that ticket will be honored,         hence you might need to specify both -nthash and -aesKey data. Ticket will be generated for 'baduser'         and saved as baduser.ccache

usage: wmiexec.py [-h] [-share SHARE] [-nooutput] [-ts] [-silentcommand] [-debug] [-codec CODEC] [-shell-type {cmd,powershell}] [-com-version MAJOR_VERSION:MINOR_VERSION]                   [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-A authfile] [-keytab KEYTAB]                   target [command ...]   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>   command               command to execute at the target. If empty it will launch a semi-interactive shell  optional arguments:   -h, --help            show this help message and exit   -share SHARE          share where the output will be grabbed from (default ADMIN$)   -nooutput             whether or not to print the output (no SMB connection created)   -ts                   Adds timestamp to every logging output   -silentcommand        does not execute cmd.exe to run given command (no output)   -debug                Turn DEBUG output ON   -codec CODEC          Sets encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with                         https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py again with -codec and the corresponding codec   -shell-type {cmd,powershell}                         choose a command processor for the semi-interactive shell   -com-version MAJOR_VERSION:MINOR_VERSION                         DCOM version, format is MAJOR_VERSION:MINOR_VERSION e.g. 5.7  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -dc-ip ip address     IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter   -A authfile           smbclient/mount.cifs-style authentication file. See smbclient man page's -A option.   -keytab KEYTAB        Read keys for SPN from keytab file

usage: psexec.py [-h] [-c pathname] [-path PATH] [-file FILE] [-ts] [-debug] [-codec CODEC] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-keytab KEYTAB]                  [-dc-ip ip address] [-target-ip ip address] [-port [destination port]] [-service-name service_name] [-remote-binary-name remote_binary_name]                  target [command ...]   positional arguments:   target                [[domain/]username[:password]@]<targetName or address>   command               command (or arguments if -c is used) to execute at the target (w/o path) - (default:cmd.exe)  optional arguments:   -h, --help            show this help message and exit   -c pathname           copy the filename for later execution, arguments are passed in the command option   -path PATH            path of the command to execute   -file FILE            alternative RemCom binary (be sure it doesn't require CRT)   -ts                   adds timestamp to every logging output   -debug                Turn DEBUG output ON   -codec CODEC          Sets encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with                         https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec  authentication:   -hashes LMHASH:NTHASH                         NTLM hashes, format is LMHASH:NTHASH   -no-pass              don't ask for password (useful for -k)   -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use                         the ones specified in the command line   -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)   -keytab KEYTAB        Read keys for SPN from keytab file  connection:   -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter   -target-ip ip address                         IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot                         resolve it   -port [destination port]                         Destination port to connect to SMB Server   -service-name service_name                         The name of the service used to trigger the payload   -remote-binary-name remote_binary_name                         This will be the name of the executable uploaded on the target