nmap, nxc, SMB shares, RDP, xfreerdp3,Exploiting ESC1 vulnerable template, certipy, Active Directory, Windows, ldap-shell, Certificates.