Attacking Active Directory Using Only Linux

Most AD attack guides assume you’re on Windows. This one flips the script: pivot from Linux and take a full AD domain — end to end.

This 80+ page lab manual walks you through a complete kill chain, using nothing but Linux-based tooling.

🧠 Enumeration & Recon
Network + host discovery with Nmap
SMB share hunting
Metasploit auxiliary modules for information gathering

💾 Initial Exploitation
Abusing scheduled tasks to gain SYSTEM
Delivering and triggering PowerShell payloads from Linux

🔑 Credential Extraction
Pulling NTLM hashes
Looting unattend.xml and autologon secrets
Turning credentials into real access

🧩 Domain Enumeration
Mapping AD with PowerView / SharpView
Using the Microsoft AD module to understand privilege paths

🚀 Lateral Movement
Moving via WinRM
Pass-the-Hash from Linux
Abusing PowerShell Remoting for expansion

🏁 Privilege Escalation Path
Chaining access: fileadmin → sarah → sshagent → Domain Admin

⚔️ What Makes This Guide Stand Out
✔️ Entire attack path run from Linux
✔️ Copy-paste-ready commands for each phase
✔️ A realistic end-to-end AD compromise you can repeat in your home lab

#pentest #windows