ADExplorer on Engagements

This post is a practical walkthrough showing how to use ADExplorer from a local Windows host over a SOCKS proxy (Cobalt Strike) by injecting a machine account NTLM hash with Mimikatz to authenticate against a domain controller; it covers proxy setup (Proxifier), launching ADExplorer with a pass-the-hash process, and offline snapshotting, and provides reconnaissance tips for locating sites, domain settings (including ms-DS-MachineAccountQuota), trusts, LAPS passwords, and other attributes that may contain plaintext credentials.