crackmapexec

Credential spraying across an Active Directory subnet is automated by testing a common password against a list of usernames over SMB or WinRM. This Skill targets entire subnets, like 192.168.1.0/24, to quickly identify valid login credentials.

Enumerating Active Directory environments involves discovering available users, groups, computers, and network shares. This Skill automates host enumeration across SMB and WinRM protocols to map domain resources and identify potential attack surfaces.

Remote command execution supports plaintext passwords, NTLM hashes, and Kerberos authentication. You can run commands and scripts on target systems via SMB or WinRM protocols using pass-the-hash techniques without needing the original plaintext password.

Active Directory post-exploitation dumps sensitive security data by extracting SAM databases, LSA secrets, and NTDS.dit files. This Skill automates the extraction of these credentials from remote targets via SMB or WinRM protocols.

Running Mimikatz and BloodHound collectors remotely is fully supported as executable modules. The Skill integrates these post-exploitation modules to dump credentials and collect Active Directory attack path data directly from targeted hosts.

Use WinRM versus SMB for lateral movement based on open ports and allowed authentication protocols. This Skill executes remote commands and performs lateral movement across both protocols, supporting plaintext, NTLM hash, and Kerberos authentication methods.