# Situational Awareness

> Enumerating AD objects, trusts, ACLs, and privilege paths post-compromise to map attack surface and identify lateral movement or escalation opportunities.

- **URL:** https://hackindex.io/platforms/active-directory/post-exploitation/ad-post-exploitation-situational-awareness
- **Path:** Active Directory > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/active-directory/post-exploitation.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

After gaining elevated access in an AD environment, orient yourself before moving laterally or collecting credentials. Understand what you have, what you can reach, and what trust relationships exist that extend your access beyond the current domain.

- Current account privileges and group memberships
- Domain and forest trust relationships
- Active sessions and logged-in privileged users
- Domain controller locations and OS versions
- Writable objects and exploitable ACLs

## Confirm current access level

#### Kali (nxc / bloodyAD)

**Confirm identity and rights (Kali)**

```bash
# Confirm current account and domain
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --get-sid

# Check if local admin (Pwn3d! = yes)
nxc smb $TARGET_IP -u $USER -p $PASSWORD

# Group memberships
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $USER --attr memberOf

# Check DCSync rights
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" --attr nTSecurityDescriptor

# Writable objects from current context
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable --detail
```

#### Windows (built-in / PowerView)

**Confirm identity and rights (Windows)**

```powershell
# Current user, groups, and privileges: no tools needed
whoami /all

# Domain group membership
net user $USER /domain
net group "Domain Admins" /domain

# PowerView: group memberships
Get-DomainUser -Identity $USER | Select-Object memberof

# Check DCSync rights for current user
Get-DomainObjectAcl "DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" -ResolveGUIDs | Where-Object {
    $_.IdentityReferenceName -match $USER -and
    $_.ObjectAceType -match 'Replication'
}

# Writable objects for current user
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match $USER}
```

## Domain and forest trusts

Trusts extend your access beyond the current domain. A bidirectional trust means you can potentially move into the trusted domain with the right credentials.

#### Kali (bloodyAD / nxc)

**Trust enumeration (Kali)**

```bash
# BloodyAD: query trust objects
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(objectClass=trustedDomain)' --attr name trustDirection trustType trustAttributes flatName

# ldapsearch
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=System,$BASE_DN" "(objectClass=trustedDomain)" name trustDirection trustAttributes

# nxc
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M enum_trusts
# name: dev.corp.local
# trustDirection: 3 (Bidirectional)
# trustAttributes: 8 (Transitive)
#
# name: partner.local
# trustDirection: 2 (Outbound)
```

#### Windows (PowerView / nltest)

**Trust enumeration (Windows)**

```powershell
# PowerView
Get-DomainTrust | Select-Object SourceName, TargetName, TrustDirection, TrustAttributes
Get-ForestTrust | Select-Object SourceName, TargetName, TrustDirection

# Built-in: no tools needed
nltest /domain_trusts
nltest /trusted_domains
```

`trustDirection: 3` (bidirectional) and `trustAttributes: 8` (transitive) is the most useful: accounts from the trusted domain can reach resources in both directions. See [Domain Trust Abuse](https://hackindex.io/platforms/active-directory/post-exploitation/ad-domain-trust-abuse) for exploitation.

## Active sessions and logged-in users

Knowing who is currently authenticated on which host tells you where high-value credentials are in memory and where to move next.

#### Kali (nxc)

**Find active sessions (Kali)**

```bash
# Sessions on specific host
nxc smb $TARGET_IP -u $USER -p $PASSWORD --sessions

# Logged-in users on specific host
nxc smb $TARGET_IP -u $USER -p $PASSWORD --loggedon-users

# Sweep subnet: find where Domain Admins are logged in
nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD --loggedon-users | grep -i 'domain admins\|administrator'
# SMB  10.10.10.20  445  WS01  [+] Logged on users
# SMB  10.10.10.20  445  WS01  CORP\Administrator - Active
# SMB  10.10.10.20  445  WS01  CORP\jsmith - Active
```

#### Windows (PowerView)

**Find active sessions (Windows)**

```powershell
# Find where Domain Admins are logged in: queries all domain hosts
Find-DomainUserLocation -UserGroupIdentity "Domain Admins"

# Sessions on specific host
Get-NetSession -ComputerName $TARGET_COMPUTER
Get-NetLoggedon -ComputerName $TARGET_COMPUTER

# Quick local check: who is on this machine
query user
qwinsta
```

A Domain Admin with an active session on a workstation means their credentials are in LSASS memory on that host. If you can reach the host and have local admin, dumping LSASS gives you their hash or ticket. See [Windows Token and Credential Harvesting](https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting).

## Domain controller discovery

#### Kali (bloodyAD / nxc)

**Find domain controllers (Kali)**

```bash
# BloodyAD LDAP filter: SERVER_TRUST_ACCOUNT bit
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' --attr dNSHostName operatingSystem

# nxc
nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD --dc-list

# DNS SRV records
nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN
nslookup -type=SRV _gc._tcp.$DOMAIN
```

#### Windows (PowerView / nltest)

**Find domain controllers (Windows)**

```powershell
# Built-in: no tools needed
nltest /dclist:$DOMAIN

# DNS SRV records
Resolve-DnsName "_ldap._tcp.dc._msdcs.$DOMAIN" -Type SRV

# PowerView
Get-DomainController | Select-Object Name, IPAddress, OSVersion

# AD module
Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, OperatingSystem
```

## References

- [BloodyAD (GitHub)](https://github.com/CravateRouge/bloodyAD) - get writable, get search trust enumeration reference
- [NetExec / nxc (GitHub)](https://github.com/Pennyw0rth/NetExec) - sessions, loggedon-users, dc-list, enum_trusts modules
- [PowerSploit / PowerView (GitHub)](https://github.com/PowerShellMafia/PowerSploit) - Get-DomainTrust, Find-DomainUserLocation, Get-NetSession reference