Active Directory and Windows domain exploitation for enterprise penetration testing. Use when attacking Windows domains, exploiting AD misconfigurations, or performing lateral movement in enterprise environments.
Active Directory and Windows domain exploitation for enterprise penetration testing. Use when attacking Windows domains, exploiting AD misconfigurations, or performing lateral movement in enterprise environments.
Compromise Windows Active Directory domains from low-privileged domain user to Domain Admin. Covers the full AD exploitation kill chain: reconnaissance with BloodHound, credential harvesting via Kerberoasting and DCSync, ACL abuse path climbing, ADCS certificate escalation (ESC1-ESC8), and post-exploitation lateral movement across the domain. Every technique maps to MITRE ATT&CK tactics (TA0006 Credential Access, TA0008 Lateral Movement, TA0004 Privilege Escalation).
This skill turns a foothold on one workstation into complete domain compromise, then translates that capability into paid AD penetration testing services for enterprise clients.
Authorized internal pentest against a Windows domain
Post-exploitation after gaining initial access to a domain-joined workstation
AD security audit for compliance (PCI DSS 4.0, SOC 2, ISO 27001)
Purple team exercise validating AD detection controls
Ransomware simulation — test if AD misconfigurations accelerate lateral spread
When NOT to Use
Without signed authorization (ROE document) from the domain owner
On production domain controllers without prior change management approval
When the test scope explicitly excludes AD infrastructure
When you are inside a law enforcement or military AD environment without special written approval
When the goal is long-term persistence or data theft rather than demonstrating compromise paths
Money-Making Overview
Buyer persona: CISOs and IT directors at mid-market enterprises (200-5,000 employees) who know Active Directory is the backbone of their security but have never had it professionally attacked. These organizations run on AD but have unpatched domain controllers, legacy trusts, weak service account passwords, and misconfigured ACLs. They need to see how a real attacker would move from a workstation to Domain Admin before a ransomware group shows them.
What they'll pay for: Technical proof that their AD is (or isn't) resilient against common domain escalation paths. BloodHound attack path maps with supporting evidence, Kerberoastable service account inventory, ADCS ESC findings with Certipy output, and clear fix guidance that IT can action.
Pricing tiers (service model):
Tier
Price
Scope
Deliverable
Timeline
AD Health Scan
$500
Remote — domain user credentials provided. Run BloodHound collector + automated Impacket checks. No exploitation.
First-dollar timeline: Deliver AD Health Scan within 48 hours of receiving credentials. Use findings as upsell to full Penetration Test. Typical close rate: 40% of Health Scan clients convert within 30 days.
First Action in 60 Minutes
Run this script from your Kali VM to collect BloodHound data and run initial attack path analysis. It requires domain user credentials (low-privilege is fine) and the domain controller hostname or IP.
What to do next: Import the BloodHound ZIP file from $OUTDIR/bloodhound/ into the BloodHound CE GUI (ensure neo4j is running). Run these Cypher queries immediately:
// Shortest paths from owned users to Domain Admins
MATCH p=shortestPath((n)-[:MemberOf|HasSession|AdminTo|AllExtendedRights|GenericAll|WriteDACL|WriteOwner|Owns|ForceChangePassword|AddMember|Contains|GpLink|AllowedToDelegate|TrustedBy|CanRDP|ExecuteDCOM*1..]->(m:Group {name:'DOMAIN ADMINS@CORP.LOCAL'})) RETURN p
// Find kerberoastable users with shortest path
MATCH (u:User {hasspn:true}) RETURN u.name, u.samaccountname
// Find AS-REP roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.samaccountname
// Find all users with admin sessions on high-value targets
MATCH (u:User)-[:HasSession]->(c:Computer)-[:AdminTo|MemberOf|Contains|GpLink*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}) RETURN u.name, c.name
Follow each path to its root cause (an ACL permission, a group membership, a session), document the evidence, and add it to the deliverable report.
Prerequisites
Kali Linux or Parrot OS with: impacket, bloodhound-python, neo4j, crackmapexec, hashcat, ldap3 (Python)
Domain credentials (low-privilege domain user account — you don't need admin rights to enumerate most AD attack paths)
Network access to domain controller on ports 389 (LDAP), 88 (Kerberos), 445 (SMB)
ADCS CA(s) found and templates enumerated with Certipy
At least one (or documented zero) attack path from starting user to Domain Admin
DCSync executed to confirm domain compromise
Every exploit step captured with timestamped evidence (screenshots/logs)
Recommendations are specific, actionable, and sorted by impact
No persistence mechanisms left in client environment; credentials handled per ROE
Report includes raw data appendix for client review
Anti-Rationalization Table
Rationalization
Reality
"We use strong passwords, so Kerberoasting won't work"
Kerberoasting cracks the service account password, not the user's. Most service accounts have auto-generated 20-char passwords set once and never changed for years — and often those passwords ARE in rockyou.txt because the AD installer used a default pattern.
"We have MFA, so credential theft is useless"
MFA protects interactive logon. Kerberos tickets and NTLM hashes are reusable offline — attackers don't need MFA to reuse a stolen ticket. DCSync extracts password hashes without triggering any login event.
"Our AD is patched, so we're immune to these attacks"
AD attacks are 90% configuration abuse, not unpatched CVEs. Kerberoasting, ACL abuse, ADCS misconfigurations (ESC1-8), and delegation abuse all work on fully patched 2025 domain controllers.
"We isolated AD from the internet — internal attacks are unlikely"
Ransomware groups routinely enter via VPN, email phishing, or third-party vendor access. Once inside, they are internal. 80% of breaches involve AD credential abuse from inside the network.
"BloodHound is just for red teams; we don't need it"
BloodHound was designed as a defense tool. Running it proactively shows you the same attack paths an adversary would find. Ignorance is not security — the paths exist whether you look or not.
"Service accounts don't matter — they aren't interactive users"
A Kerberoasted service account with GenericAll on an OU is effectively Domain Admin. Automated service accounts often have wildly excessive ACL permissions because nobody traces delegation chains.
"Our domain is only 200 users — we can't be a target"
Small domains are common targets because they lack dedicated AD security staff. The techniques scale down perfectly: a 200-user domain has the same Kerberos, the same ACLs, and often more dangerous one-person-IT overprivilege.
"We use Azure AD, no on-prem AD to attack"
Hybrid environments sync password hashes via AAD Connect. The on-prem AD Connect server has a privileged account that can compromise the cloud. PTA/gMSA abuse on hybrid identity bridges on-prem to cloud.
fi
# Option B: If SharpHound.exe available (upload to compromised host)
if
then
echo
"[*] SharpHound.exe found — you can upload and run:"
echo
" SharpHound.exe -c All --ZipFileName bloodhound.zip"
