Tool Index

This index lists the tools by command name as well as by task.

List of tools by name
List of tools by task

Tools by Name

Command	Description
Cert	Work with X.509 certificates
Cert selfcert	Create a self-signed certificate
CredCoerce	Sends RPC calls to coerce a system to authenticate to a remote system
Dcom	Utility for working with DCOM
Dcom activate	Activates an object over DCOM
Dcom invoke	Invokes a method on an OLE automation object over DCOM
Dsrep	Interacts with Directory Replication Service
Dsrep dcinfo	Gets information on domain controllers
Dsrep rep	Requests replica changes
Epm	Commands for interacting with the RPC endpoint mapper
Epm lsep	Lists the dynamic RPC endpoints registered with the endpoint mapper
Kerb	Commands for working with Kerberos authentication
Kerb asreq	Requests a TGT from the KDC.
Kerb changepw	Changes an account password
Kerb getasinfo	Gets server time and encryption types (with salts) for a user account.
Kerb keytab	Display and edit keytab files
Kerb keytab list	Lists the entries in a keytab file
Kerb renew	Renews a ticket
Kerb s2k	Generates a protocol key from a string, such as a password
Kerb select	Selects and displays tickets from a file.
Kerb setpw	Sets the password of (another) account
Kerb tgsreq	Requests a ticket from the KDC.
Ldap	Performs LDAP operations
Ldap add	Adds an object to the directory
Ldap addcomputer	Adds a computer account to the directory
Ldap addou	Adds a new organizational unit
Ldap adduser	Adds a new user
Ldap listsyntax	Lists AD syntaxes
Ldap lspart	Gets a list of partitions in the Active Directory forest
Ldap mod	Modifies an object in the directory
Ldap moduser	Modifies a directory entry
Ldap mountfs	Mounts a directory as a file system
Ldap namedbits	Prints the bits with symbolic names
Ldap query	Queries the directory
Ldap rm	Deletes an object from the directory
Ldap schema	Gets the schema
Ldap search	Searches the directory by name
Ldap timestamp	Converts between the Active Directory timestamp value and a UTC date/time
Ldap watch	Watches for changes to an object or subtree
Ldap whoami	Gets the name of the authenticated user
Lsa	Commands for interacting with the LSA
Lsa addpriv	Adds one or more privileges to an account
Lsa createaccount	Creates an account
Lsa enumaccounts	Enumerates accounts
Lsa enumprivaccounts	Enumerates accounts that have a specific privilege or user right
Lsa getprivs	Gets the privileges assigned to an account.
Lsa getrights	Gets the user rights and privileges granted to an account
Lsa getsysaccess	Gets the system access rights granted to an account
Lsa lookupname	Gets the SID for one or more account names
Lsa lookupsid	Translates one or more SIDs to their account names
Lsa rmpriv	Removes one or more privileges from an account
Lsa setsysaccess	Sets the system access rights granted to an account
Lsa whoami	Gets the name and domain of the connected user
Reg	Interacts with the registry
Reg dumplsasecrets	Dumps the LSA secrets of a remote system
Reg dumpsam	Dumps the SAM of a remote system
Reg getdcomapp	Gets information about a DCOM application
Reg getsd	Gets the security descriptor of a registry key
Reg keyinfo	Gets key info
Reg list	Lists the contents of a key
Reg save	Saves a key to a file
Reg set	Sets one or more values in a registry key
Reg setsd	Sets the security descriptor of a registry key
Reg syskey	Prints the system key of a remote system
Sam	Commands for interacting with a remote Security Accounts Manager
Sam aliasmembers	Gets the members of an alias
Sam enumaliases	Enumerates aliases
Sam enumgroups	Enumerates groups
Sam enumusers	Enumerates user accounts
Scm	Provides functionality for interacting with the service control manager on a remote Windows system
Scm create	Creates and optionally starts a new service
Scm delete	Deletes a service
Scm qtriggers	Queries the status of a service
Scm query	Queries the status of a service
Scm start	Starts a service
Scm stop	Stops a service
Sddl	Works with security descriptors represented in SDDL
Sddl describe	Describes a security descriptor
Sddl lookupguid	Looks up a GUID representing an AD extended right, property, or property set
Sddl lookupwks	Looks up a well-known SID
Smb2Client	Performs operations on an SMB2 server.
Smb2Client enumnics	Queries the server for a list of network interfaces.
Smb2Client enumopenfiles	Lists files open on the server.
Smb2Client enumsessions	Lists active sessions on the server.
Smb2Client enumshares	Lists shares on the server
Smb2Client enumsnapshots	Lists the available snapshots for a file or directory.
Smb2Client enumstreams	Lists the data streams of a file or directory.
Smb2Client get	Gets the contents of a file.
Smb2Client ls	Lists the contents of a directory (including named pipes).
Smb2Client mkdir	Creates a directory.
Smb2Client mklink	Creates a symbolic link.
Smb2Client mount	Creates a mount point or junction.
Smb2Client mountfs	Mounts an SMB2 server or share to the local file system.
Smb2Client put	Sends a file to the server.
Smb2Client rm	Deletes a file.
Smb2Client rmdir	Deletes a directory.
Smb2Client touch	Updates the timestamps or attributes of a file or directory on an SMB share.
Smb2Client umount	Unmounts a mount point.
Smb2Client watch	Watches for modifications to a directory or subtree.
Wmi	Commands for interacting with the Windows Management Instrumentation service
Wmi backup	Backs up the WMI repository
Wmi delete	Deletes a WMI object
Wmi exec	Executes a command on a remote system via WMI
Wmi get	Gets an object with a WMI path
Wmi invoke	Invokes a method on a WMI class or object
Wmi lsclass	Lists the classes within a namespace.
Wmi lsmethod	Lists the methods of a class or object.
Wmi lsns	Lists the available namespaces within a namespace.
Wmi lsprop	Lists the properties of a class or object.
Wmi mountfs	Mounts a WMI namespace as a file system
Wmi query	Executes a WMI query
Wmi restore	Restores the WMI repository

Tools by Task

Task	Command
**
Coerce a system to authenticate to a remote target	CredCoerce
DCOM
Activate a COM object on a remote computer	Dcom activate
Invoke a method on a COM object on a remote computer	Dcom invoke
Directory Replication
Export Kerberos keys for domain accounts to a .keytab file	Dsrep rep
Replicate secret attributes from a domain controller (DCSync)	Dsrep rep
Enumeration
Check the encryption types supported for a user account	Kerb getasinfo
Check the encryption types supported for a user account	Kerb asreq
Check whether a user account requires pre-authentication	Kerb getasinfo
Check whether a user account requires pre-authentication	Kerb asreq
Check whether a user name is valid	Kerb getasinfo
Check whether a user name is valid	Kerb asreq
Enumerate accounts that are granted a privilege	Lsa enumprivaccounts
Enumerate aliases in the Security Accounts Manager database	Sam enumaliases
Enumerate dynamic RPC endpoints	Epm lsep
Enumerate groups in the Security Accounts Manager database	Sam enumgroups
Enumerate policy accounts	Lsa enumaccounts
Enumerate the data streams of a file on an SMB server	Smb2Client enumstreams
Enumerate the network interfaces and network addresses of an SMB server	Smb2Client enumnics
Enumerate the open files on an SMB server	Smb2Client enumopenfiles
Enumerate the privileges granted to an account	Lsa getprivs
Enumerate the rights and privileges granted to an account	Lsa getrights
Enumerate the sessions of users connected to an SMB server	Smb2Client enumsessions
Enumerate the shares of an SMB server	Smb2Client enumshares
Enumerate the system access rights granted to an account	Lsa getsysaccess
Enumerate the volume snapshots on an SMB server	Smb2Client enumsnapshots
Enumerate user accounts in the Security Accounts Manager database	Sam enumusers
Executes a WMI query	Wmi query
Export Kerberos keys for domain accounts to a .keytab file	Dsrep rep
Get a list of registered DCOM applications	Reg getdcomapp
Get a WMI object	Wmi get
Get info on domain controllers	Dsrep dcinfo
Get the members of an alias (group)	Sam aliasmembers
Get the system key	Reg syskey
Get user hashes from the SAM	Reg dumpsam
Invoke a method on a WMI class or object	Wmi invoke
List partitions (naming contexts) within an Active Directory forest	Ldap lspart
List the classes within a WMI namespace	Wmi lsclass
List the methods of a WMI class or object	Wmi lsmethod
List the namespaces within a WMI namespace	Wmi lsns
List the properties of a WMI class or object	Wmi lsprop
Lists attributes defined within an Active Directory forest	Ldap schema
Mount an LDAP directory as a file system	Ldap mountfs
Query objects in Active Directory	Ldap query
Query the status of a service	Scm query
Query the triggers configured to start or stop a service	Scm qtriggers
Replicate secret attributes from a domain controller (DCSync)	Dsrep rep
Search for objects by name in Active Directory	Ldap search
Translate an a SID to its account name and domain	Lsa lookupsid
Translate an account name to its SID and domain name	Lsa lookupname
Expanding Access
Add an object to Active Directory	Ldap add
Change a password	Kerb changepw
Create a computer account	Ldap add
Create a computer account	Ldap addcomputer
Create a user account	Ldap add
Create a user account	Ldap adduser
Create an LSA policy account	Lsa createaccount
Get ticket hash for hash cracking	Kerb tgsreq
Grant a privilege to an account	Lsa addpriv
Modify a user account in Active Directory	Ldap moduser
Modify an object in Active Directory	Ldap mod
Request a ticket for a service	Kerb tgsreq
Request a ticket-granting-ticket	Kerb asreq
Set the password of another user account	Kerb setpw
Set the security descriptor on a registry key	Reg setsd
Set the system access rights for an account	Lsa setsysaccess
Kerberos
Change a password	Kerb changepw
Check the encryption types supported for a user account	Kerb getasinfo
Check the encryption types supported for a user account	Kerb asreq
Check whether a user account requires pre-authentication	Kerb getasinfo
Check whether a user account requires pre-authentication	Kerb asreq
Convert between a .ccache file and a .kirbi file (offline)	Kerb select
Decrypt tickets (offline)	Kerb select
Describe a Kerberos ticket (offline)	Kerb select
Generate protocol key from password (offline)	Kerb s2k
Get ticket hash for hash cracking	Kerb tgsreq
List entries in a keytab file.	Kerb keytab list
Print the contents of a .ccache file (offline)	Kerb select
Print the contents of a .kirbi file (offline)	Kerb select
Print ticket authorization data (offline)	Kerb select
Query tickets within a .ccache file or .kirbi file (offline)	Kerb select
Renew a ticket	Kerb renew
Request a ticket for a service	Kerb tgsreq
Request a ticket-granting-ticket	Kerb asreq
Set the password of another user account	Kerb setpw
Lateral Movement
Activate a COM object on a remote computer	Dcom activate
Create a service	Scm create
Execute a command line on a remote system	Wmi exec
Invoke a method on a COM object on a remote computer	Dcom invoke
Invoke a method on a WMI class or object	Wmi invoke
Start a service	Scm start
LDAP
Add an object to Active Directory	Ldap add
Convert between date/times and LDAP timestamps	Ldap timestamp
Create a computer account	Ldap add
Create a computer account	Ldap addcomputer
Create a user account	Ldap add
Create a user account	Ldap adduser
Create an organizational unit (OU)	Ldap addou
Delete a computer account	Ldap rm
Delete a user account	Ldap rm
Delete an object from Active Directory	Ldap rm
Get your current user name	Ldap whoami
List named bit flags used by LDAP attributes (offline)	Ldap namedbits
List partitions (naming contexts) within an Active Directory forest	Ldap lspart
List syntaxes used by LDAP (offline)	Ldap listsyntax
Lists attributes defined within an Active Directory forest	Ldap schema
Modify a user account in Active Directory	Ldap moduser
Modify an object in Active Directory	Ldap mod
Mount an LDAP directory as a file system	Ldap mountfs
Query objects in Active Directory	Ldap query
Search for objects by name in Active Directory	Ldap search
Watch for changes to Active Directory	Ldap watch
LSA
Create an LSA policy account	Lsa createaccount
Enumerate accounts that are granted a privilege	Lsa enumprivaccounts
Enumerate policy accounts	Lsa enumaccounts
Enumerate the privileges granted to an account	Lsa getprivs
Enumerate the rights and privileges granted to an account	Lsa getrights
Enumerate the system access rights granted to an account	Lsa getsysaccess
Get the name of the current user account	Lsa whoami
Grant a privilege to an account	Lsa addpriv
Revoke a privilege from an account	Lsa rmpriv
Set the system access rights for an account	Lsa setsysaccess
Translate an a SID to its account name and domain	Lsa lookupsid
Translate an account name to its SID and domain name	Lsa lookupname
Registry
Create a registry key	Reg set
Get a list of registered DCOM applications	Reg getdcomapp
Get a security descriptor of a registry key	Reg getsd
Get information on a registry key	Reg keyinfo
Get the system key	Reg syskey
Get user hashes from the SAM	Reg dumpsam
List the contents of a registry key	Reg list
Saves a registry key to a file on the remote host	Reg save
Set a value in a registry key	Reg set
Set the security descriptor on a registry key	Reg setsd
RPC
Enumerate dynamic RPC endpoints	Epm lsep
Get info on domain controllers	Dsrep dcinfo
SAM
Enumerate aliases in the Security Accounts Manager database	Sam enumaliases
Enumerate groups in the Security Accounts Manager database	Sam enumgroups
Enumerate user accounts in the Security Accounts Manager database	Sam enumusers
Get the members of an alias (group)	Sam aliasmembers
SCM
Create a service	Scm create
Delete a service	Scm delete
Query the status of a service	Scm query
Query the triggers configured to start or stop a service	Scm qtriggers
Start a service	Scm start
Stop a service	Scm stop
SDDL
Describe a security descriptor (SDDL or hex) (offline)	Sddl describe
Look up a property by GUID (offline)	Sddl lookupguid
Look up a property set by GUID (offline)	Sddl lookupguid
Look up a well-known SID (offline)	Sddl lookupwks
Look up an extended right by GUID (offline)	Sddl lookupguid
Security
Describe a security descriptor (SDDL or hex) (offline)	Sddl describe
Look up a property by GUID (offline)	Sddl lookupguid
Look up a property set by GUID (offline)	Sddl lookupguid
Look up a well-known SID (offline)	Sddl lookupwks
Look up an extended right by GUID (offline)	Sddl lookupguid
SMB
Create a directory junction or mount point on an SMB share	Smb2Client mount
Create a directory on an SMB share	Smb2Client mkdir
Create a file on an SMB share	Smb2Client touch
Create a filesystem link on an SMB share	Smb2Client mklink
Delete a directory on an SMB share	Smb2Client rmdir
Delete a file in SMB share	Smb2Client rm
Get a file from an SMB server	Smb2Client get
List the contents of directory on an SMB share	Smb2Client ls
Remove a directory junction or mount point within an SMB share	Smb2Client umount
Timestomp a file on an SMB share	Smb2Client touch
Update directory entry attributes and timestamps for a new or existing file on an SMB share	Smb2Client touch
Upload a file to an SMB share	Smb2Client put
Watch a file or directory on an SMB server for changes	Smb2Client watch
WMI
Back up the WMI MOF repository	Wmi backup
Delete a WMI object	Wmi delete
Execute a command line on a remote system	Wmi exec
Executes a WMI query	Wmi query
Get a WMI object	Wmi get
Invoke a method on a WMI class or object	Wmi invoke
List the classes within a WMI namespace	Wmi lsclass
List the methods of a WMI class or object	Wmi lsmethod
List the namespaces within a WMI namespace	Wmi lsns
List the properties of a WMI class or object	Wmi lsprop
Restore the WMI MOF repository	Wmi restore