pentest-active-directory

name

pentest-active-directory

description

Active Directory and hybrid Entra ID penetration testing. Use when the user mentions BloodHound, SharpHound, SOAPHound, AzureHound, RustHound, Kerberoast, AS-REP roast, Golden/Silver/Diamond/Sapphire ticket, DCSync, DCShadow, NTLM relay, ntlmrelayx, ADCS ESC1-ESC15+, EKUwu, Certipy, ACL abuse (GenericAll/WriteDACL/WriteOwner/shadow credentials), GPO abuse, NoPac, ZeroLogon, PetitPotam, DFSCoerce, PrinterBug, krbrelayup, AAD Connect, MSOL_, Pass-Through Auth, Seamless SSO, AdminSDHolder, SID History, krbtgt, or any "domain compromise" task.

Pentest — Active Directory

Apply 05-active-directory/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 05-active-directory/00-overview.md first.

Phase order

1. 05-active-directory/01-enumeration-unauth.md — domain ID, DC location, anonymous LDAP, Kerberos username enum, SMB/LDAP signing posture.
2. 05-active-directory/02-enumeration-authd.md — full BloodHound collection, share content, ACL audit, ADCS template inventory, delegation inventory, LAPS posture.
3. 05-active-directory/03-bloodhound-analysis.md — pre-built queries, custom Cypher, Tier-0 mapping, cross-domain paths.
4. 05-active-directory/04-kerberos-attacks.md — Kerberoast, AS-REP, delegation chains, ticket forgery.
5. 05-active-directory/05-credential-attacks.md — spraying, NTLM relay, LSASS, NTDS, DPAPI, GPP, LAPS, SCCM, shadow credentials.
6. 05-active-directory/06-acl-abuse.md — GenericAll/Write/WriteDACL, ForceChangePassword, AddKeyCredentialLink.
7. 05-active-directory/07-gpo-abuse.md — GPO write, scheduled task injection, MSI deployment.
8. 05-active-directory/08-adcs-attacks.md — ESC1-ESC15 catalog (incl EKUwu).
9. 05-active-directory/09-trusts.md — cross-domain SID History, forest trust, SID filtering audit.
10. 05-active-directory/10-lateral-movement.md — PtH/PtT/OPtH, native protocols.
11. 05-active-directory/11-privesc-domain.md — DCSync, ZeroLogon, NoPac, coercion → relay → DA.
12. 05-active-directory/12-azure-ad-hybrid.md — AAD Connect, PTA, Seamless SSO, AD FS attacks.
13. 05-active-directory/13-persistence.md — Golden/Silver/Diamond/Sapphire, AdminSDHolder, SID History, ACL backdoor, ADCS persistence.

How to operate

1. Always run BloodHound first when authenticated; many later decisions depend on graph paths.
2. For OPSEC engagements use SOAPHound (LDAP-only collector) over SharpHound; for offline analysis use RustHound or BloodHound.py.
3. ADCS: enumerate templates with Certipy find before attempting ESCx; map ESC1-15 catalog to template ACLs in 08-adcs-attacks.md.
4. Coercion → relay chains: choose coercer (PetitPotam / DFSCoerce / PrinterBug / WSPCoerce) by target OS + signing posture.
5. Hybrid: walk the on-prem ↔ cloud bridges in 12-azure-ad-hybrid.md — AAD Connect host is Tier-0.
6. Document IOCs for every persistence primitive (Golden Ticket = krbtgt double-rotation required to invalidate).

When NOT to use

• Cloud-only Entra ID (no on-prem AD) → pentest-cloud plus 05-active-directory/12-azure-ad-hybrid.md for hybrid bridges.
• Generic Windows server compromise without AD → pentest-infra-internal.

Pre-conditions

• Network reachability to a domain-joined segment.
• Optionally low-priv domain credentials.
• BloodHound CE 8.x installed; Certipy, Rubeus, Mimikatz/NanoDump, ntlmrelayx, mitm6, impacket, NetExec ready.

OPSEC

• BloodHound default rate alerts NDR. Use --throttle 250 --jitter 30 minimum; SOAPHound for stealth.
• Coercion attacks trigger Defender for Identity / ATA — coordinate with SOC.
• Krbtgt rotation must be DOUBLE to invalidate Golden Tickets.
• ZeroLogon resets DC machine password — many ROEs forbid; restoration required if used.
• Kerberos username enum produces 4768/4771 — visible.

References inside the library

• Cheatsheet: cheatsheets/active-directory.md.
• Tooling: tool-mappings/05-active-directory-tools.md.
• Frameworks: frameworks/mitre-attack-enterprise.md.
• The Hacker Recipes: https://www.thehacker.recipes/ad/movement.
• Lab walkthrough: playbooks/03-goad-walkthrough.md.