Selected Node
AD Methodology
addomainstart
Purpose
Start from domain context and map users, groups, computers, sessions, shares, ACLs, SPNs, trusts, and paths to administrative control.
Why It Matters
AD is graph-driven. The goal is to identify the next edge and prove impact, not randomly run tools.
If You See This
- •Domain creds available.
- •DC reachable.
- •LDAP/Kerberos accessible.
- •Need path to higher privilege.
Commands
Validate domain creds
nxc smb DC_IP -u USER -p PASS -d DOMAIN
nxc ldap DC_IP -u USER -p PASS -d DOMAIN
Confirms credentials against SMB and LDAP.
BloodHound Python
bloodhound-python -u USER -p PASS -d DOMAIN -ns DC_IP -c All --zip
Collects AD graph data from Linux.
Rabbit Holes
- •Bad DNS setup.
- •Time skew.
- •Reading BloodHound edge direction wrong.
- •Looking only for DA shortest path.
Evidence to Capture
- •Valid creds
- •Domain
- •DC
- •BloodHound zip
- •Attack path