Credential Management

ADscan automatically discovers and stores credentials during enumeration and exploitation. Use these commands to view and work with discovered credentials.

Commands

creds show

Display all discovered credentials in the current workspace.

Syntax:

creds show

Example:

(ADscan:htb_forest) > creds show

# TODO: Add real output from 'creds show' command
# Expected format:
# - Username
# - Domain
# - Password (if available)
# - NTLM hash (if available)
# - Source (AS-REP, Kerberoast, DCSync, etc.)

What it shows:

• All discovered usernames
• Associated domains
• Cleartext passwords (when cracked)
• NTLM hashes
• Source of credential discovery (AS-REP roasting, Kerberoasting, DCSync, etc.)

creds select

Select a specific credential to use for further enumeration and exploitation.

Syntax:

creds select <domain>

Parameters:

• domain: The domain name of the credentials to select

Example:

(ADscan:htb_forest) > creds select htb.local

# TODO: Add real output from 'creds select' command
# Expected behavior:
# - Prompts to select from available credentials for the domain
# - Sets the selected credential as active for enumeration
# - May show available actions with selected credential

What it does: When you select credentials, ADscan will:

1. Show available credentials for the specified domain
2. Allow you to choose which credential to use
3. Enumerate privileges and access for the selected user:
   • Accessible SMB shares
   • ACL permissions
   • Group memberships
   • Special privileges
   • Attack paths in BloodHound

Use cases:

• Switch between different compromised accounts
• Test access levels of different users
• Enumerate lateral movement opportunities
• Identify privilege escalation paths

System Command

system

Execute shell commands on your local system (where ADscan is running).

Syntax:

system <command>

Parameters:

• command: Any shell command to execute locally

Examples:

# Check local user
(ADscan:workspace) > system whoami
kali

# List files in workspace directory
(ADscan:workspace) > system ls -la ~/.adscan/workspaces/htb_forest/

# View network interfaces
(ADscan:workspace) > system ip addr show

# Check VPN connection
(ADscan:workspace) > system ping -c 1 10.10.10.161

Important Notes:

• system runs commands on your local machine (Kali, Ubuntu, etc.)
• It does NOT execute commands on the target domain
• Useful for checking local system state, files, and network connectivity
• All standard Linux/bash commands are available

Common Use Cases:

# Verify VPN connectivity
system ping <target_ip>

# Check available disk space
system df -h

# View workspace files
system ls ~/.adscan/workspaces/

# Copy results to external location
system cp ~/.adscan/workspaces/client/report.json /tmp/

# Check network routes
system ip route

# Verify tool installations
system which hashcat
system docker ps

Credential Storage

Credentials are automatically saved in the workspace:

~/.adscan/workspaces/<workspace>/
└── credentials.json       # All discovered credentials

Security:

• Credentials file has restrictive permissions (600)
• NTLM hashes are stored securely
• Cleartext passwords are only stored when explicitly cracked

Credential Sources

ADscan discovers credentials through various techniques:

Workflow Example

Complete credential management workflow:

# 1. Run authenticated scan
(ADscan:pentest) > start_auth corp.local 10.0.0.1 jdoe Password123

# 2. View all discovered credentials
(ADscan:pentest) > creds show

# TODO: Real output showing discovered credentials

# 3. Select high-privilege account
(ADscan:pentest) > creds select corp.local

# TODO: Real output showing credential selection menu

# 4. ADscan enumerates with selected credential:
#    - SMB shares accessible
#    - ACL permissions
#    - Group memberships
#    - Privilege escalation paths

# 5. Use system command to verify local files
(ADscan:pentest) > system ls ~/.adscan/workspaces/pentest/

Best Practices

Credential Rotation

When you discover new credentials:

1. Use creds show to view all accounts
2. Test each credential with creds select
3. Document which accounts have which access
4. Prioritize high-privilege accounts for further exploitation

Secure Storage

• Never share credentials.json publicly
• Encrypt workspace backups before transferring
• Delete old workspaces after engagement completion
• Use clear_all to wipe workspace data when done

Credential Testing

# Select different credentials to test access
creds select corp.local  # Test user1
creds select corp.local  # Test user2

# Compare access levels between accounts
# Identify which accounts have DA/EA privileges

Related Commands

• Scanning Commands - Discover credentials through scanning
• Workspace Management - Manage workspace data

Next Steps

After discovering credentials:

1. Use creds show to view all credentials
2. Select high-value credentials with creds select
3. Enumerate privileges and accessible resources
4. Follow BloodHound attack paths to escalate privileges