Credential Graph

Credential Graph — “I Have X, What Can I Do?”

The fastest AD/box solver during OSCP: map each artifact to actions. Pair with Attack Path Graph (service → foothold) and tool deep-dives.

---

📌 Mental Model

When you find an artifact, immediately ask:

What is it?
    ↓
What access does it grant?
    ↓
Can it authenticate?
    ↓
Can it be abused?
    ↓
Can it become DA?

---

📌 Ultimate OSCP Question Tree

What Did I Find?
 
Password?        → Login everywhere          → [[Hydra]] · [[nxcspray]] · [[CrackMapExec - nxc]] · [[RunasCs]] (Windows shell)
Must change pwd? → kpasswd / smbpasswd       → [[Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE]] · [[krb5-user]] · port **464**
NTLM Hash?         → Pass-the-Hash             → [[Impacket]] · [[evil-winrm]]
TGT?               → Request TGS               → [[Rubeus]] · [[Impacket]] getST
SPN?               → Kerberoast                → [[Kerberoast]]
No Preauth?        → ASREP Roast               → [[Kerberos Scripts]] GetNPUsers
Certificate?       → PKINIT                    → [[Certipy & Certify]]
GenericWrite?      → Shadow Creds / RBCD       → **[[Shadow Credentials - pywhisker]]** · [[bloodyAD]]
WriteDACL?         → Grant yourself rights     → [[bloodyAD]] add genericAll/dcsync
DCSync?            → KRBTGT                    → **[[DCSync]]** · **[[secretsdump]]**
HasSession?        → Steal logged-on creds     → **[[HasSession]]** · **[[LSASS]]**
KRBTGT?            → Golden Ticket             → [[Rubeus]] · [[Mimikatz]]
Admin?             → LSASS                     → [[Mimikatz]] · [[secretsdump]]
LSASS?             → Everything
SSH Key?           → Shell / pivot               → [[SSH]]
Cookie?            → Session hijack            → [[Cookie Decoding]]

---

PASSWORD

Password
│
├── SMB · WinRM · RDP · SSH · LDAP · MSSQL · VPN login
├── Kerberos → Request TGT → Kerberos attacks
├── Password reuse (every service)
├── BloodHound enumeration
└── Domain user access

Think: Password → Can I login? → TGT? → Enumerate AD? → Move laterally?

Action	Tool
Spray / brute	Hydra, Kerbrute, CrackMapExec - nxc
WinRM shell	evil-winrm
SMB	smbclient, CrackMapExec - nxc
Get TGT (Linux)	Kerberos Setup - krb5.conf first → Kerberos Scripts getTGT
AD enum	ldapsearch, Bloodhound + Sharphound

---

NTLM HASH

NTLM Hash
│
├── Pass-the-Hash → SMB · PsExec · WMI · WinRM · scheduled tasks
├── Crack offline → [[Hashcat]] · [[John]]
├── Password reuse
└── Local admin? → lateral movement

Think: Hash → Authenticate without cracking? → PtH → Admin? → Dump more creds

Action	Tool
PtH SMB/WinRM	Impacket psexec/wmiexec/smbexec, CrackMapExec - nxc
PtH WinRM	evil-winrm -H
Dump more	secretsdump, Mimikatz
Relay instead of crack	ntlmrelayx, Responder

---

KERBEROS TGT

(Ticket Granting Ticket)

TGT
│
├── Request TGS
├── Access Kerberos services
├── Enumerate domain resources
├── S4U / delegation abuse
└── Lateral movement

Think: TGT = I am this user → request any service ticket I need.

Action	Tool
Import ticket	export KRB5CCNAME=... · Impacket -k -no-pass
Request TGS	Impacket getST · Rubeus asktgs
Overpass-the-hash	Rubeus / Mimikatz

Chain: Password → TGT → TGS → service access · See Kerberos · Setup: Kerberos Setup - krb5.conf

---

KERBEROS TGS

(Service Ticket)

TGS
│
├── Access specific service
├── CIFS · HTTP · MSSQL · HOST · LDAP · RPC
└── Example: TGS for CIFS/DC01 → SMB to DC01

Think: TGS = already authenticated to one service.

Action	Tool
Use ccache	Impacket wmiexec/psexec -k -no-pass
Forge (silver)	Rubeus · Kerberos Scripts ticketer (needs service hash)

---

SERVICE ACCOUNT SPN

SPN
│
├── Kerberoast → request TGS → extract hash → crack offline
└── Recover service account password

Think: SPN → Kerberoast? → Crack? → Service account access

→ Kerberoast · Kerberos Scripts GetUserSPNs · Rubeus kerberoast · Hashcat -m 13100

---

AS-REP ROASTABLE USER

User (DONT_REQ_PREAUTH)
│
├── Request AS-REP → extract hash → crack offline → password

Think: No preauth = free offline crack (no creds needed if user known).

→ Kerberos Scripts GetNPUsers · Kerbrute · Hashcat -m 18200

---

SILVER TICKET

Service account hash + SPN
│
├── Forge service ticket (TGS)
├── Impersonate user on that service
└── Access service only (not full domain)

→ Kerberos Scripts ticketer · Rubeus silver · Mimikatz

---

GOLDEN TICKET

KRBTGT hash
│
├── Forge TGT for any user
├── Domain Admin equivalent
└── Full domain compromise

Think: KRBTGT hash = game over.

→ Rubeus golden · Mimikatz · Kerberos Scripts ticketer · Obtain KRBTGT via secretsdump / DCSync

---

CERTIFICATE (AD CS)

Certificate
│
├── PKINIT → request TGT
├── Authenticate as user
└── Persistence

Think: Certificate ≈ password for that identity.

→ Certipy & Certify · AD CS ESC — ESC1–ESC16 · certipy auth · ESC9 UPN swap

---

SSH PRIVATE KEY

SSH Key
│
├── SSH login · pivot · enumerate · privesc on target host

Think: Private key → shell.

→ SSH -i key · Crack encrypted key: ssh2john → John / Hashcat · Match pubkey: ssh-keygen -y -f key

---

SESSION COOKIE

Cookie
│
├── Web session hijack · admin panel · portal access

Think: Cookie = already logged in.

→ Cookie Decoding — flask-unsign, JWT, forge admin session · Burp Suite

---

ACCESS TOKEN (API / Cloud)

Token
│
├── API · Graph · Azure · AWS access

→ AWS CLI · Cookie Decoding (JWT/Bearer) · What API trusts this token?

---

LSASS ACCESS

LSASS (admin on box)
│
├── Cleartext passwords · NTLM hashes · Kerberos tickets · TGTs · service creds

Think: Admin → LSASS → everything.

→ LSASS · Mimikatz sekurlsa · secretsdump (remote) · CrackMapExec - nxc -M lsassy / handlekatz / nanodump

---

SAM DATABASE

Local account store — Windows equivalent of Linux /etc/passwd + /etc/shadow. See Registry Hives and Linux Equivalents.

SAM
│
├── Local user hashes → crack or PtH → local admin movement

→ secretsdump (local) · Mimikatz · Hashcat

---

BloodHound ACL edges

When BloodHound shows these edges → typical abuse:

GENERICWRITE

GenericWrite
│
├── Add SPN → Kerberoast target
├── Reset password (if allowed)
├── Shadow credentials → **[[Shadow Credentials - pywhisker]]**
├── RBCD on computer objects
└── Modify user attributes

Think: GenericWrite → modify object → often become that object.

→ bloodyAD add shadowCredentials · add rbcd · add uac · Kerberoast (after add SPN) · Deep dive → GenericWrite

GENERICALL

GenericAll
│
├── Reset password · add member · add SPN · shadow creds · RBCD · full control

Think: GenericAll = own object.

→ bloodyAD add genericAll · set password · add groupMember · Deep dive → GenericAll

FORCECHANGEPASSWORD

→ Reset user password → become user → bloodyAD set password · ForceChangePassword · (not Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE — that’s your own account)

ADDMEMBER

→ Add self to group → inherit group rights → bloodyAD add groupMember · AddMember

WRITEDACL

WriteDACL
│
├── Grant GenericAll · GenericWrite · DCSync to yourself

Think: WriteDACL → rewrite permissions → usually own object or domain.

→ bloodyAD add dcsync · add genericAll · Deep dive → WriteDacl

DCSYNC RIGHTS

DCSync
│
├── Replicate secrets · dump all NTLM · dump KRBTGT → golden ticket

Think: DCSync → KRBTGT → golden ticket.

→ bloodyAD add dcsync · Impacket secretsdump · Mimikatz lsadump::dcsync · Deep dive → DCSync

SHADOW CREDENTIALS

Write on user → Add KeyCredentialLink → PKINIT → TGT → become user

→ Shadow Credentials - pywhisker · Certipy & Certify shadow auto · bloodyAD add shadowCredentials

RESOURCE-BASED CONSTRAINED DELEGATION (RBCD)

Write on computer → configure msDS-AllowedToActOnBehalfOfOtherIdentity
│
├── S4U2Proxy → impersonate user on target host

→ bloodyAD add computer · add rbcd · Impacket getST · Rubeus

Full BloodHound workflow: Bloodhound + Sharphound · ACL abuse: AD Permissions · DCSync · HasSession

---

Related Tools

• Impacket
• Mimikatz
• Rubeus
• bloodyAD
• Kerberoast
• secretsdump
• Hashcat
• Bloodhound + Sharphound
• Certipy & Certify
• Cookie Decoding

Related Notes

• Attack Path Graph
• Credential Discovery
• Kerberos
• AD
• LatMovement
• Active Directory
• Sheet
• Training