CrackMapExec VS BloodHound

Let’s walk through a typical attack against the Administrator account using a popular tool, CrackMapExec.

Attackers like to use crackmapexec to exploit Windows networks and machines. It can achieve various goals like enumerating users, cracking SMB shares, and injecting shellcode into memory.

After gaining a local administrator NTLM password hash using SMB relay attacks, Redbot Security used the “CrackMapExec” tool to pass the local administrator hash to all systems and found multiple systems using the same password:

ntlmrelayx2proxychains aims to connect the tool of the SecureAuthCorps' impacket suite, ntlmrelayx.py (hereafter referred to as "ntlmrelayx"), along with @byt3bl33d3r's tool, CrackMapExec (hereafter referred to as "CME"), over proxychains, developped by haad.

CrackMapExec - Swiss army knife for pentesting networks.

Regarding network shares, I personally tend to use crackmapexec with a list of systems. It won't list the ACLs but it is very good at finding out what a standard domain user could access (if this is what you are after) https://github.com/byt3bl33d3r/CrackMapExec

I put this tool together a few years back, and just recently got around to making it robust enough to share: https://github.com/pangolinsec/shihtzu

It parses ldapsearch or dsquery output and writes markdown files with some extra logic added in so you can visualize nested memberships when you open the folder with Obsidian and use the graph view--it's kind of like a very low-powered Bloodhound (https://github.com/SpecterOps/BloodHound) in that sense, but it is also much quieter. It also parses `useraccountcontrol` and some of the logon-relevant attributes in AD to automatically tag accounts that are particularly interesting or uninteresting to attackers.

Some core features: