AD-Tools

PowerShell scripts to help with enumerating and abusing common misconfigurations. Inspired by HTB CAPE Path

Enumerate Foreign-ACLs

1. Requires PowerView
2. Provides syntax for next steps

Child to Parent Domain Elevation

1. Assumes mimikatz and powerview loaded into memory
2. Bi-directional trust

Enumerate Foreign Security Principals

1. PowerView

Enable SID and SAN (ESC7 > ESC16 > ESC6)

1. Enables SAN override (ESC7)
2. Disables SID security extension (ESC16)
3. Prepares the CA for SAN-based impersonation (ESC6)
4. Performs CA-level configuration abuse via ADCS COM
5. Request cert with certipy

certipy req -u user@tgest.local -p 'password' -ca test-DC1-CA -template User -upn administrator@test.local -sid admin_sid -dc-ip 10.0.0.0