Posts on: Enumeration

---

Windows privilege escalation is usually a configuration flaw, not a missing patch. The highest-value paths are token-impersonation privileges, weak service ACLs, credential material left on disk, and Active Directory misconfigurations. Kernel exploits exist but are secondary. This file is organized by payoff-per-minute, not by category. Helpful Tools Miscellaneous Ghostpack Compiled Binaries UACME — UAC bypass techniques Impacket NetCat for Windows Exploit Suggesters winPEAS — broad automated enumeration Seatbelt — C# host-survey tool PowerUp / SharpUp — PowerShell/C# privilege-escalation checks JAWS — PowerShell 2.0 enumeration Watson — missing-KB enumeration WES-NG — Windows Exploit Suggester Next Generation Metasploit — use post/multi/recon/local_exploit_suggester on a backgrounded meterpreter session Credentials and Token Abuse LaZagne — credential recovery from many sources Mimikatz — LSASS dumping, PtH, PtT, golden tickets SessionGopher — saved remote-access session information SharpDPAPI — DPAPI triage and decryption (triage, rdg, credentials, masterkeys, machinetriage) SharpChrome — Chrome credential extraction Current 2026 tooling Tool What it adds Install Certipy AD CS enumeration and exploitation (certipy find -u … -p … -dc-ip … -stdout -vulnerable) — covers ESC1 through ESC17 as of 2026 pip install certipy-ad Certify C# AD CS enumeration — often more reliable in restricted PowerShell environments Ghostpack binaries SharpWSUS Fake-update injection via WSUS to push a signed binary with malicious arguments GitHub: netero1010/SharpWSUS Rubeus Kerberos abuse — unconstrained delegation capture, S4U, ticket extraction Ghostpack binaries FullPowers Recovers the default privilege set on LOCAL SERVICE / NETWORK SERVICE tokens that have been filtered GitHub: itm4n/FullPowers SigmaPotato / PrintNotifyPotato Modern Potato variants with reflection/in-memory execution; the latter abuses PrintNotify COM when the Spooler is disabled GitHub forks Nanodump / lsassy Stealthy LSASS dumping and remote parsing pip install lsassy DonPwner / nxcspray Safe password spraying respecting AD lockout policy pipx install nxc Priority Execution Order — Stop at the First Root-Equivalent Primitive Run this before the detailed sections. Most HTB/OSCP hosts fall in the first four checks.

After gaining access to the network segment where the AD environment resides — often through pivoting from a previously compromised host — the goal is to find the Domain Controller, enumerate the domain without credentials if possible, and convert unauthenticated reconnaissance into a valid credential or session. The techniques below are ordered roughly by noise level and prerequisite: unauthenticated enumeration first, then poisoning and relay, then credential-based spraying, then modern coercion/relay chains that bypass SMB signing entirely.

A consolidated reference for enumerating attack vectors on Linux targets, from first shell to root. Commands are grouped by category; exploitation primitives follow each enumeration section where relevant. Table of Contents Helpful Tools Processes and Jobs Kernel and OS User-Related Network Related Finding Interesting Files and Directories Process Memory and Sudo Token Reuse Systemd Unit Abuse Logrotate ld.so.preload — Universal Linker Hijack SUID / SGID / Capabilities Sudo Abuse Kernel and Userland Exploits Container and Namespace Escape D-Bus, Screen, and Tmux Session Abuse SUID Shared-Library and Linker Abuse Writable /etc/passwd / /etc/shadow Credential Hunting Open File Descriptors Consolidated Enumeration One-Liners Priority Quick Actions Field Notes from the HTB List Helpful Tools Tool Notes LinPEAS Broad automated enumeration; default first pass LinEnum Lighter-weight shell alternative pspy Watches process spawns without root — exposes cron and systemd timer execution paths unix-privesc-check Legacy file-permission auditing linux-exploit-suggester Kernel exploit correlation lse.sh Linux smart enumeration CDK Container-specific enumeration and escape primitives deepce Docker/container enumeration from inside a container uptux Single-file Python script specialized in systemd, D-Bus, socket units, and writable unit paths SUDO_KILLER Focused on sudo misconfigurations, CVE detection, and token reuse privmap Graph-based path modeling — traces www-data → writable logrotate config → root cron → root, reporting paths rather than isolated findings # uptux wget https://raw.githubusercontent.com/initstring/uptux/master/uptux.py python3 uptux.py # SUDO_KILLER wget https://raw.githubusercontent.com/TH3xACE/SUDO_KILLER/master/SUDO_KILLER.sh bash SUDO_KILLER.sh # privmap pip install privmap sudo privmap Processes and Jobs Command Description ps aux | grep root See processes running as root ./pspy64 -pf -i 1000 View running processes with pspy cat /etc/crontab System-wide cron table ls -la /etc/cron.daily Check for daily Cron jobs ls -la /etc/cron.* /etc/at* /var/spool/cron/crontabs/ 2>/dev/null Enumerate all cron locations crontab -l Current user’s cron grep -i cron /var/log/syslog /var/log/cron 2>/dev/null Enumerate cron jobs (second file on RHEL/CentOS) journalctl -u cron --no-pager Cron activity on journald-only hosts systemctl list-timers --all systemd timers — frequently missed because they are not cron atq List queued at jobs ls -la /var/spool/cron/atjobs/ 2>/dev/null at job files busctl --system list D-Bus services that may expose privileged methods lpstat Active or queued print jobs (sensitive information) Cron exploitation notes: If a cron job runs a script that calls another binary by relative name, the job’s PATH or the script’s writable directory becomes the target. pspy is the fastest way to confirm a job is firing and to observe its exact command line and working directory. at/batch jobs are cron-adjacent and less scrutinized — a root-scheduled at job running a script in a writable directory is exploitable exactly like a writable cron script:

After finding valid credentials for the Active Directory environment, the objective is to compromise the entire forest. That means moving laterally between users and machines until you hold privileged access to a domain controller — and in 2026, that path is more often a chain of misconfigurations and coercion primitives than a single exploit. This page covers the enumeration that finds those paths, the tooling that maps them, and the lateral-movement techniques that traverse them.