> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/enumeration.md).

# Active Directory 枚举

使用原生命令、PowerView、LDAP、rpcclient、SharpHound 和 BloodHound，从 Windows 和 Linux 对 Active Directory 域进行映射的枚举手册。

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>PowerView</h4></td><td>用于 PowerView 的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/8779049a250698f49dc962f657eb3cff6bd10467">/pages/8779049a250698f49dc962f657eb3cff6bd10467</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>本地机器枚举</h4></td><td>用于本地机器枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/fd0fa9d628a10ffd320b32625327fd1ce65c9c62">/pages/fd0fa9d628a10ffd320b32625327fd1ce65c9c62</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>远程 SAM 枚举</h4></td><td>用于远程 SAM 枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/0beafbaab5a2483ba5cc42e972de0126a2be505d">/pages/0beafbaab5a2483ba5cc42e972de0126a2be505d</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>Impacket 和 rpcclient</h4></td><td>用于 Impacket 和 rpcclient 的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/ff542e400381876b5eb400ef604ac72cb5167c35">/pages/ff542e400381876b5eb400ef604ac72cb5167c35</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>Active Directory PowerShell 模块</h4></td><td>用于 Active Directory PowerShell 模块的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/cb827b7c005991a99a14a01aadabe17e65dddfa3">/pages/cb827b7c005991a99a14a01aadabe17e65dddfa3</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>NTDS 和域控制器</h4></td><td>用于 NTDS 和域控制器枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/802215c7ac3b0bc7a8db5798ecd6fcecef752ebc">/pages/802215c7ac3b0bc7a8db5798ecd6fcecef752ebc</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>域用户</h4></td><td>用于域用户枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/5a854ca56751980260a30d785476f21e88a42a03">/pages/5a854ca56751980260a30d785476f21e88a42a03</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>域计算机</h4></td><td>用于域计算机枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/741fc49b058f470c79e39b9cdcc407789afeb9f6">/pages/741fc49b058f470c79e39b9cdcc407789afeb9f6</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>域组</h4></td><td>用于域组枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/4b21cf1c4c5fb428c44631ba8403baabf7a6f941">/pages/4b21cf1c4c5fb428c44631ba8403baabf7a6f941</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>网络共享</h4></td><td>用于网络共享枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/ddbb5c1b373b9ec352cadffed3c60b6fcc8c43bf">/pages/ddbb5c1b373b9ec352cadffed3c60b6fcc8c43bf</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>组织单位</h4></td><td>用于组织单位枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/62077e15f6b9d4508c386af0b2f5b0d99b70a818">/pages/62077e15f6b9d4508c386af0b2f5b0d99b70a818</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>GPO 枚举</h4></td><td>用于 GPO 枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/65abfcbe597604c2267e60da4eb54053e3e31c0f">/pages/65abfcbe597604c2267e60da4eb54053e3e31c0f</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>Active Directory ACL</h4></td><td>用于 Active Directory ACL 枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/fae72ac43689da56bc9b0eb1d096ec8bfca96250">/pages/fae72ac43689da56bc9b0eb1d096ec8bfca96250</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>林枚举</h4></td><td>用于林枚举的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/f74e22ae81c6eebc33b37d4f427005a6a4491dd0">/pages/f74e22ae81c6eebc33b37d4f427005a6a4491dd0</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>本地管理员访问</h4></td><td>用于搜索本地管理员访问权限的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/3268c236cc93a3b1b574d1e35a27510438381631">/pages/3268c236cc93a3b1b574d1e35a27510438381631</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>LDAP 搜索</h4></td><td>用于 LDAP 搜索的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/0b8a1d27379748b84e6087e19a745ac458291d7a">/pages/0b8a1d27379748b84e6087e19a745ac458291d7a</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>Pywerview</h4></td><td>用于 Pywerview 的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/0eb1d5af022de33e847f9fa0d6c5204477d3d9c7">/pages/0eb1d5af022de33e847f9fa0d6c5204477d3d9c7</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>JXplorer</h4></td><td>用于 JXplorer 的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/c7d9d1216406db7e3162df991d7b501c6dd27f83">/pages/c7d9d1216406db7e3162df991d7b501c6dd27f83</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>BloodHound 安装</h4></td><td>用于 BloodHound 安装的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/21f8a3bdebf07b6cce877dbb11eeee955c9839eb">/pages/21f8a3bdebf07b6cce877dbb11eeee955c9839eb</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>SharpHound 采集</h4></td><td>用于使用 SharpHound 进行采集的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/9fd5524968eef50988c4a44b43f7cac202e453a8">/pages/9fd5524968eef50988c4a44b43f7cac202e453a8</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>BloodHound 分析</h4></td><td>用于 BloodHound 分析的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/9540b5148879406b26207d0bf8ce4b451ed263df">/pages/9540b5148879406b26207d0bf8ce4b451ed263df</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>BloodHound 自定义查询</h4></td><td>用于 BloodHound 自定义查询的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/f60e77ef3c13b85a24c96b6a68d81f2ba8668139">/pages/f60e77ef3c13b85a24c96b6a68d81f2ba8668139</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/active-directory/enumeration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.