Skip to content
HackIndex logo

HackIndex

Situational Awareness

4 min read Jun 11, 2026

After gaining elevated access in an AD environment, orient yourself before moving laterally or collecting credentials. Understand what you have, what you can reach, and what trust relationships exist that extend your access beyond the current domain.

Confirm current access level

┌──(kali㉿kali)-[~]
└─$ # Confirm current account and domain
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --get-sid
 
┌──(kali㉿kali)-[~]
└─$ # Check if local admin (Pwn3d! = yes)
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # Group memberships
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $USER --attr memberOf
 
┌──(kali㉿kali)-[~]
└─$ # Check DCSync rights
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" --attr nTSecurityDescriptor
 
┌──(kali㉿kali)-[~]
└─$ # Writable objects from current context
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable --detail
PS C:\Users\Guest\Desktop> # Current user, groups, and privileges — no tools needed
PS C:\Users\Guest\Desktop> whoami /all
 
PS C:\Users\Guest\Desktop> # Domain group membership
PS C:\Users\Guest\Desktop> net user $USER /domain
PS C:\Users\Guest\Desktop> net group "Domain Admins" /domain
 
PS C:\Users\Guest\Desktop> # PowerView — group memberships
PS C:\Users\Guest\Desktop> Get-DomainUser -Identity $USER | Select-Object memberof
 
PS C:\Users\Guest\Desktop> # Check DCSync rights for current user
PS C:\Users\Guest\Desktop> Get-DomainObjectAcl "DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" -ResolveGUIDs | Where-Object {
$_.IdentityReferenceName -match $USER -and
$_.ObjectAceType -match 'Replication'
}
 
PS C:\Users\Guest\Desktop> # Writable objects for current user
PS C:\Users\Guest\Desktop> Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match $USER}

Domain and forest trusts

Trusts extend your access beyond the current domain. A bidirectional trust means you can potentially move into the trusted domain with the right credentials.

┌──(kali㉿kali)-[~]
└─$ # BloodyAD — query trust objects
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(objectClass=trustedDomain)' --attr name trustDirection trustType trustAttributes flatName
 
┌──(kali㉿kali)-[~]
└─$ # ldapsearch
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=System,$BASE_DN" "(objectClass=trustedDomain)" name trustDirection trustAttributes
 
┌──(kali㉿kali)-[~]
└─$ # nxc
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M enum_trusts 
name: dev.corp.local
trustDirection: 3 (Bidirectional)
trustAttributes: 8 (Transitive)

name: partner.local
trustDirection: 2 (Outbound)
PS C:\Users\Guest\Desktop> # PowerView
PS C:\Users\Guest\Desktop> Get-DomainTrust | Select-Object SourceName, TargetName, TrustDirection, TrustAttributes
PS C:\Users\Guest\Desktop> Get-ForestTrust | Select-Object SourceName, TargetName, TrustDirection
 
PS C:\Users\Guest\Desktop> # Built-in — no tools needed
PS C:\Users\Guest\Desktop> nltest /domain_trusts
PS C:\Users\Guest\Desktop> nltest /trusted_domains

trustDirection: 3 (bidirectional) and trustAttributes: 8 (transitive) is the most useful: accounts from the trusted domain can reach resources in both directions. See Domain Trust Abuse for exploitation.

Active sessions and logged-in users

Knowing who is currently authenticated on which host tells you where high-value credentials are in memory and where to move next.

┌──(kali㉿kali)-[~]
└─$ # Sessions on specific host
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --sessions
 
┌──(kali㉿kali)-[~]
└─$ # Logged-in users on specific host
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --loggedon-users
 
┌──(kali㉿kali)-[~]
└─$ # Sweep subnet — find where Domain Admins are logged in
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD --loggedon-users | grep -i 'domain admins\|administrator' 
SMB  10.10.10.20  445  WS01  [+] Logged on users
SMB  10.10.10.20  445  WS01  CORP\Administrator - Active
SMB  10.10.10.20  445  WS01  CORP\jsmith - Active
PS C:\Users\Guest\Desktop> # Find where Domain Admins are logged in — queries all domain hosts
PS C:\Users\Guest\Desktop> Find-DomainUserLocation -UserGroupIdentity "Domain Admins"
 
PS C:\Users\Guest\Desktop> # Sessions on specific host
PS C:\Users\Guest\Desktop> Get-NetSession -ComputerName $TARGET_COMPUTER
PS C:\Users\Guest\Desktop> Get-NetLoggedon -ComputerName $TARGET_COMPUTER
 
PS C:\Users\Guest\Desktop> # Quick local check — who is on this machine
PS C:\Users\Guest\Desktop> query user
PS C:\Users\Guest\Desktop> qwinsta

A Domain Admin with an active session on a workstation means their credentials are in LSASS memory on that host. If you can reach the host and have local admin, dumping LSASS gives you their hash or ticket. See Windows Token and Credential Harvesting.

Domain controller discovery

┌──(kali㉿kali)-[~]
└─$ # BloodyAD LDAP filter — SERVER_TRUST_ACCOUNT bit
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' --attr dNSHostName operatingSystem
 
┌──(kali㉿kali)-[~]
└─$ # nxc
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD --dc-list
 
┌──(kali㉿kali)-[~]
└─$ # DNS SRV records
┌──(kali㉿kali)-[~]
└─$ nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN
┌──(kali㉿kali)-[~]
└─$ nslookup -type=SRV _gc._tcp.$DOMAIN
PS C:\Users\Guest\Desktop> # Built-in — no tools needed
PS C:\Users\Guest\Desktop> nltest /dclist:$DOMAIN
 
PS C:\Users\Guest\Desktop> # DNS SRV records
PS C:\Users\Guest\Desktop> Resolve-DnsName "_ldap._tcp.dc._msdcs.$DOMAIN" -Type SRV
 
PS C:\Users\Guest\Desktop> # PowerView
PS C:\Users\Guest\Desktop> Get-DomainController | Select-Object Name, IPAddress, OSVersion
 
PS C:\Users\Guest\Desktop> # AD module
PS C:\Users\Guest\Desktop> Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, OperatingSystem

References