CrackMapExec, SMBMap, and BloodHound.py: Linux-Side AD Enumeration That Actually Works

#You Have Credentials. Now Map the Entire Domain from a Linux Box.#link

Here's the situation most pentesters find themselves in: you've cracked a hash or sprayed a password, you have forend:Klmcargo2, and you're sitting on a Parrot Linux box that isn't domain-joined. No PowerShell. No ActiveDirectory module. No problem. The Impacket toolkit and CrackMapExec give you 90% of what PowerView provides, and you never have to touch a Windows host.

Notice the badpwdcount field. That's your safety net for future password spraying. Any account with badpwdcount: 3 or 4 is one bad attempt from lockout. Filter those out of your target lists. Also note svc_qualys with zero bad passwords. Service accounts are prime Kerberoasting targets.

Why is BloodHound.py the single most important enumeration step?

Because it maps every relationship in the domain into a graph database. Users, groups, computers, ACLs, GPOs, sessions, RDP rights, WinRM rights, SQL admin access. All of it. Visualized. You upload the JSON output into the BloodHound GUI, run "Find Shortest Paths to Domain Admins," and it draws you a literal attack path. What would take hours of manual PowerView queries takes thirty seconds with a Cypher query.

564 computers. 2951 users. 183 groups. 2 trusts. That's the full picture of INLANEFREIGHT.LOCAL collected in 83 seconds from a non-domain-joined Linux box. The --zip flag compresses the output for easy upload into the BloodHound GUI. Start neo4j, launch BloodHound, upload the zip, and start querying.

You've mapped the domain from Linux. You know the users, the groups, the trusts, the ACLs, and the attack paths. But some things still require a Windows host. SharpHound collects session data more accurately. PowerView gives you real-time ACL queries. And some clients will hand you a managed Windows box and say "work from this." Time to learn the Windows side.