A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
2019. A financial services client in London. They handed me a managed Windows 10 laptop, connected to their internal network, with AppLocker blocking everything except signed Microsoft binaries. No internet. No USB. No way to get PowerView or BloodHound onto the box. I had SYSTEM access via a service exploit, and I needed to enumerate the domain. So I used what was already there.
dsquery.dll ships with every modern Windows system. The net.exe binary has been there since NT 4.0. WMI is baked into the OS. The ActiveDirectory module loads on any machine with RSAT installed, which includes most admin workstations. You don't need to upload a single byte to enumerate this domain.
That LDAP filter uses the OID 1.2.840.113556.1.4.803 which is the bitwise AND matching rule. The value 32 is the PASSWD_NOTREQD flag. These accounts don't require a password. NAGIOSAGENT with a UAC value of 544 (NORMAL_ACCOUNT + PASSWD_NOTREQD) might have no password at all. Worth testing.
One trick for evading command monitoring: type net1 instead of net. The net1.exe binary performs identical functions but doesn't match the common detection rule looking for 'net.exe' in process creation logs (Event ID 4688). Lazy SOC analysts miss this. Good ones don't. Know your audience.
Living off the land isn't just a fallback. It's often the stealthiest option. No file writes, no memory injection, no network connections to external C2. Just native binaries doing what admins do every day. The next module takes the credentials you've gathered and turns them into Kerberos tickets. And Kerberos tickets turn into domain compromise.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.