index.md

Tool Index

This index lists the tools by command name as well as by task.

• List of tools by name
• List of tools by task

Tools by Name

Command	Description
CredCoerce	Sends RPC calls to coerce a system to authenticate to a remote system
Epm	Commands for interacting with the RPC endpoint mapper
Epm lsep	Lists the dynamic RPC endpoints registered with the endpoint mapper
Kerb	Commands for working with Kerberos authentication
Kerb asreq	Requests a TGT from the KDC.
Kerb changepw	Changes an account password
Kerb getasinfo	Gets server time and encryption types (with salts) for a user account.
Kerb renew	Renews a ticket
Kerb s2k	Generates a protocol key from a string, such as a password
Kerb select	Selects and displays tickets from a file.
Kerb setpw	Sets the password of (another) account
Kerb tgsreq	Requests a ticket from the KDC.
Lsa	Commands for interacting with the LSA
Lsa addpriv	Adds one or more privileges to an account
Lsa createaccount	Creates an account
Lsa enumaccounts	Enumerates accounts
Lsa enumprivaccounts	Enumerates accounts that have a specific privilege or user right
Lsa getprivs	Gets the privileges assigned to an account.
Lsa getrights	Gets the user rights and privileges granted to an account
Lsa getsysaccess	Gets the system access rights granted to an account
Lsa lookupname	Gets the SID for one or more account names
Lsa lookupsid	Translates one or more SIDs to their account names
Lsa rmpriv	Removes one or more privileges from an account
Lsa setsysaccess	Sets the system access rights granted to an account
Lsa whoami	Gets the name and domain of the connected user
Sam	Commands for interacting with a remote Security Accounts Manager
Sam enumusers	Enumerates the users
Scm	Provides functionality for interacting with the service control manager on a remote Windows system
Scm create	Creates and optionally starts a new service
Scm delete	Deletes a service
Scm qtriggers	Queries the status of a service
Scm query	Queries the status of a service
Scm start	Starts a service
Scm stop	Stops a service
Smb2Client	Performs operations on an SMB2 server.
Smb2Client enumnics	Queries the server for a list of network interfaces.
Smb2Client enumopenfiles	Lists files open on the server.
Smb2Client enumsessions	Lists active sessions on the server.
Smb2Client enumshares	Lists shares on the server
Smb2Client enumsnapshots	Lists the available snapshots for a file or directory.
Smb2Client enumstreams	Lists the data streams of a file or directory.
Smb2Client get	Gets the contents of a file.
Smb2Client ls	Lists the contents of a directory (including named pipes).
Smb2Client mkdir	Creates a directory.
Smb2Client mklink	Creates a symbolic link.
Smb2Client mount	Creates a mount point or junction.
Smb2Client put	Sends a file to the server.
Smb2Client rm	Deletes a file.
Smb2Client rmdir	Deletes a directory.
Smb2Client touch	Updates the timestamps or attributes of a file or directory on an SMB share.
Smb2Client umount	Unmounts a mount point.
Smb2Client watch	Watches for modifications to a directory or subtree.
Wmi	Commands for interacting with the Windows Management Instrumentation service
Wmi backup	Backs up the WMI repository
Wmi delete	Deletes a WMI object
Wmi exec	Executes a command on a remote system via WMI
Wmi get	Gets an object with a WMI path
Wmi invoke	Invokes a method on a WMI class or object
Wmi lsclass	Lists the classes within a namespace.
Wmi lsmethod	Lists the methods of a class or object.
Wmi lsns	Lists the available namespaces within a namespace.
Wmi lsprop	Lists the properties of a class or object.
Wmi query	Executes a WMI query
Wmi restore	Restores the WMI repository

Tools by Task

Task	Command
****
Coerce a system to authenticate to a remote target	CredCoerce
Enumeration
Check whether a user name is valid	Kerb getasinfo
Check whether a user name is valid	Kerb asreq
Enumerate policy accounts	Lsa enumaccounts
Enumerate the accounts in the Security Accounts Manager database	Sam enumusers
Enumerate the data streams of a file on an SMB server	Smb2Client enumstreams
Enumerate the network interfaces and network addresses of an SMB server	Smb2Client enumnics
Enumerate the open files on an SMB server	Smb2Client enumopenfiles
Enumerate the privileges granted to an account	Lsa getprivs
Enumerate the rights and privileges granted to an account	Lsa getrights
Enumerate the sessions of users connected to an SMB server	Smb2Client enumsessions
Enumerate the shares of an SMB server	Smb2Client enumshares
Enumerate the system access rights granted to an account	Lsa getsysaccess
Enumerate the volume snapshots on an SMB server	Smb2Client enumsnapshots
Executes a WMI query	Wmi query
Get a WMI object	Wmi get
Invoke a method on a WMI class or object	Wmi invoke
List the classes within a WMI namespace	Wmi lsclass
List the methods of a WMI class or object	Wmi lsmethod
List the namespaces within a WMI namespace	Wmi lsns
List the properties of a WMI class or object	Wmi lsprop
Query the status of a service	Scm query
Query the triggers configured to start or stop a service	Scm qtriggers
Translate an a SID to its account name and domain	Lsa lookupsid
Translate an account name to its SID and domain name	Lsa lookupname
Expanding Access
Change a password	Kerb changepw
Create an LSA policy account	Lsa createaccount
Get ticket hash for hash cracking	Kerb tgsreq
Grant a privilege to an account	Lsa addpriv
Request a ticket for a service	Kerb tgsreq
Request a ticket-granting-ticket	Kerb asreq
Set the password of another user account	Kerb setpw
Set the system access rights for an account	Lsa setsysaccess
Kerberos
Change a password	Kerb changepw
Check the encryption types supported for a user account	Kerb getasinfo
Check the encryption types supported for a user account	Kerb asreq
Check whether a user account requires pre-authentication	Kerb getasinfo
Check whether a user account requires pre-authentication	Kerb asreq
Convert between a .ccache file and a .kirbi file	Kerb select
Describe a Kerberos ticket	Kerb select
Generate protocol key from password	Kerb s2k
Get ticket hash for hash cracking	Kerb tgsreq
Print the contents of a .ccache file	Kerb select
Print the contents of a .kirbi file	Kerb select
Query tickets within a .ccache file or .kirbi file	Kerb select
Renew a ticket	Kerb renew
Request a ticket for a service	Kerb tgsreq
Request a ticket-granting-ticket	Kerb asreq
Set the password of another user account	Kerb setpw
Lateral Movement
Create a service	Scm create
Execute a command line on a remote system	Wmi exec
Invoke a method on a WMI class or object	Wmi invoke
Start a service	Scm start
LSA
Create an LSA policy account	Lsa createaccount
Enumerate policy accounts	Lsa enumaccounts
Enumerate the privileges granted to an account	Lsa getprivs
Enumerate the rights and privileges granted to an account	Lsa getrights
Enumerate the system access rights granted to an account	Lsa getsysaccess
Grant a privilege to an account	Lsa addpriv
Revoke a privilege from an account	Lsa rmpriv
Set the system access rights for an account	Lsa setsysaccess
Translate an a SID to its account name and domain	Lsa lookupsid
Translate an account name to its SID and domain name	Lsa lookupname
RPC
Enumerate dynamic RPC endpoints	Epm lsep
SAM
Enumerate the accounts in the Security Accounts Manager database	Sam enumusers
SCM
Create a service	Scm create
Delete a service	Scm delete
Query the status of a service	Scm query
Query the triggers configured to start or stop a service	Scm qtriggers
Start a service	Scm start
Stop a service	Scm stop
SMB
Create a directory junction or mount point on an SMB share	Smb2Client mount
Create a directory on an SMB share	Smb2Client mkdir
Create a file on an SMB share	Smb2Client touch
Create a filesystem link on an SMB share	Smb2Client mklink
Delete a directory on an SMB share	Smb2Client rmdir
Delete a file in SMB share	Smb2Client rm
Get a file from an SMB server	Smb2Client get
List the contents of directory on an SMB share	Smb2Client ls
Remove a directory junction or mount point within an SMB share	Smb2Client umount
Timestomp a file on an SMB share	Smb2Client touch
Update directory entry attributes and timestamps for a new or existing file on an SMB share	Smb2Client touch
Upload a file to an SMB share	Smb2Client put
Watch a file or directory on an SMB server for changes	Smb2Client watch
WMI
Back up the WMI MOF repository	Wmi backup
Delete a WMI object	Wmi delete
Execute a command line on a remote system	Wmi exec
Executes a WMI query	Wmi query
Get a WMI object	Wmi get
Invoke a method on a WMI class or object	Wmi invoke
List the classes within a WMI namespace	Wmi lsclass
List the methods of a WMI class or object	Wmi lsmethod
List the namespaces within a WMI namespace	Wmi lsns
List the properties of a WMI class or object	Wmi lsprop
Restore the WMI MOF repository	Wmi restore