Performing Active Directory Vulnerability Assessment

Performing Active Directory Vulnerability Assessment

Overview

Active Directory (AD) is the primary identity and access management system in most enterprise environments, making it a critical attack target. This skill covers comprehensive AD security assessment using PingCastle for health checks, BloodHound for attack path analysis, and Purple Knight for security posture scoring. These tools identify misconfigurations, excessive privileges, Kerberos weaknesses, and lateral movement opportunities.

When to Use

• When conducting security assessments that involve performing active directory vulnerability assessment
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Detection Gaps & Validation

• Read-only scope limits — without sufficient rights, PingCastle/SharpHound miss ACLs and sessions. Validate the scan account can read AdminSDHolder, GPOs, and session data.
• Stale BloodHound data — sessions change constantly, so a single collection misses live admin logons. Validate by re-running SharpHound near the assessment window.
• DC-only vs full forest — single-domain collection misses trust-based paths. Validate all domains/trusts are enumerated.
• Tool overlap and gaps — PingCastle, BloodHound, and Purple Knight each miss what the others catch; validate findings across at least two tools.
• Kerberoast/AS-REP confirmation — validate a flagged SPN account is actually crackable and enabled before rating it Critical.
• Delegation findings — validate unconstrained delegation is on a reachable non-DC before reporting it as exploitable.

Prerequisites

• Domain-joined workstation or domain admin access for scanning
• PingCastle (https://github.com/netwrix/pingcastle)
• BloodHound Community Edition with SharpHound collector
• Purple Knight from Semperis (free community tool)
• Python 3.9+ for analysis scripts
• .NET Framework 4.7+ for PingCastle on Windows

Tool 1: PingCastle Health Check

Installation and Execution

# Download PingCastle
Invoke-WebRequest -Uri "https://github.com/netwrix/pingcastle/releases/latest/download/PingCastle.zip" `
  -OutFile "PingCastle.zip"
Expand-Archive PingCastle.zip -DestinationPath C:\Tools\PingCastle

# Run health check against current domain
cd C:\Tools\PingCastle
.\PingCastle.exe --healthcheck

# Run health check against specific domain
.\PingCastle.exe --healthcheck --server dc01.corp.local --user CORP\scanner_account --password P@ssw0rd

# Run in scanner mode for multiple domains
.\PingCastle.exe --scanner --scannerlp

# Generate consolidated report
.\PingCastle.exe --healthcheck --level Full

PingCastle Scoring Categories

Key PingCastle Checks

# Critical items to review in PingCastle report:
- Accounts with "Password Never Expires" flag
- Accounts with Kerberos pre-authentication disabled (AS-REP roastable)
- Accounts with Kerberos delegation (unconstrained/constrained)
- Domain Controllers running unsupported OS versions
- AdminSDHolder permission modifications
- Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins)
- Trust relationships with SID filtering disabled
- GPO vulnerabilities allowing privilege escalation

Tool 2: BloodHound Attack Path Analysis

SharpHound Data Collection

# Download SharpHound collector
# https://github.com/SpecterOps/BloodHound/tree/main/packages/csharp/SharpHound

# Run SharpHound collection (all methods)
.\SharpHound.exe --collectionmethods All --domain corp.local --zipfilename bloodhound_data.zip

# Stealthy collection (minimal noise)
.\SharpHound.exe --collectionmethods Session,LoggedOn --domain corp.local --stealth

# Collection with specific domain controller
.\SharpHound.exe --collectionmethods All --domain corp.local --domaincontroller dc01.corp.local

# Run via PowerShell
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain corp.local -OutputDirectory C:\BH_Data

BloodHound CE Setup

# Deploy BloodHound Community Edition with Docker
curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose up -d

# Access BloodHound CE at http://localhost:8080
# Default credentials shown in docker compose logs

# Upload SharpHound data through web UI or API
curl -X POST "http://localhost:8080/api/v2/file-upload/start" \
  -H "Authorization: Bearer $BH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"fileName": "bloodhound_data.zip"}'

Critical BloodHound Queries

# Find shortest path to Domain Admin
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"}))
WHERE u.name <> "ADMINISTRATOR@CORP.LOCAL"
RETURN p

# Find Kerberoastable accounts with admin privileges
MATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group)
WHERE g.name CONTAINS "ADMIN"
RETURN u.name, u.serviceprincipalnames

# Find computers where Domain Admins are logged in
MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})
RETURN c.name, u.name

# Find AS-REP roastable accounts
MATCH (u:User {dontreqpreauth:true})
RETURN u.name, u.description

# Find unconstrained delegation hosts
MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name CONTAINS "DC"
RETURN c.name

# Find GPO abuse paths
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)
RETURN p

Tool 3: Purple Knight Assessment

# Download Purple Knight from https://www.purple-knight.com/
# Run as domain admin or with appropriate read permissions

.\PurpleKnight.exe

# Purple Knight checks 130+ security indicators across:
# - Account Security (password policies, privileged accounts)
# - AD Infrastructure (replication, DNS, LDAP signing)
# - Group Policy (GPO permissions, security settings)
# - Kerberos Security (delegation, encryption types, SPN)
# - AD Delegation (AdminSDHolder, OU permissions)

Purple Knight Score Categories

Common AD Vulnerabilities

1. Kerberoasting Exposure

# Find SPNs assigned to user accounts (Kerberoasting targets)
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName |
  Select-Object Name, ServicePrincipalName, PasswordLastSet, Enabled

2. AS-REP Roasting Exposure

# Find accounts with pre-auth disabled
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |
  Select-Object Name, DoesNotRequirePreAuth, Enabled

3. LLMNR/NBT-NS Poisoning Risk

# Check if LLMNR is disabled via GPO
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name EnableMulticast -ErrorAction SilentlyContinue

4. Excessive Privileged Group Membership

# Count members in critical groups
$groups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Account Operators", "Backup Operators")
foreach ($group in $groups) {
    $count = (Get-ADGroupMember -Identity $group -Recursive).Count
    Write-Output "$group : $count members"
}

Remediation Priorities

References

• PingCastle GitHub
• BloodHound CE
• Purple Knight
• MITRE ATT&CK - Active Directory
• Microsoft AD Security Best Practices