Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.
Instrucciones de origen · Vista previa de solo lectura
name
performing-active-directory-penetration-test
description
Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.
Active Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.
When to Use
When conducting security assessments that involve performing active directory penetration test
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Most Often Missed & How to Confirm
AS-REP roasting and delegation beyond Kerberoasting — accounts with pre-auth disabled (AS-REP), and unconstrained/constrained/RBCD delegation. Unconstrained delegation + coercion (PrinterBug/PetitPotam) yields a DC TGT directly; RBCD via a created computer object is a common, missed path.
AD CS (ESC1-ESC8) — frequently the fastest route to DA and the most overlooked. Always certipy find -vulnerable; ESC8 pairs with NTLM relay to the CA web-enrollment endpoint.
ACL/attack-path analysis in BloodHound — GenericAll/GenericWrite/WriteDACL/WriteOwner/ForceChangePassword on users, groups, GPOs, computers. Mark owned principals and follow shortest-path-to-DA instead of guessing.
Credential leftovers — GPP cpassword in SYSVOL, readable LAPS attributes, DPAPI secrets, and cached creds/sessions on stale machines.
Lockout-safe spraying and collection noise — read --pass-pol before any spray, and prefer stealthy SharpHound options; a locked-out domain or tripped alert ends testing.
How to confirm: prove each step with artifacts — cracked TGS/AS-REP hashes, a BloodHound shortest-path screenshot, a certipy cert/TGT minted for a higher-priv user, a successful S4U/RBCD or relay session, or a DCSync dump of krbtgt. Don't conclude the domain is secure on "no Kerberoastable SPNs" alone until AS-REP, delegation, AD CS, GPP, LAPS, and ACL paths are all checked; validate domain compromise with a controlled DCSync rather than assuming the chain holds.
Prerequisites
Standard domain user credentials (minimum starting point)
Network access to domain controllers (LDAP/389, Kerberos/88, SMB/445, DNS/53)
# Create Silver Ticket for specific service
impacket-ticketer -nthash <service_nthash> -domain-sid S-1-5-21-... \
-domain corp.local -spn MSSQL/sqlserver.corp.local administrator
export KRB5CCNAME=administrator.ccache
impacket-mssqlclient 'corp.local/administrator@sqlserver.corp.local' -k -no-pass
Phase 5 — Persistence Demonstration
# Skeleton Key (inject into LSASS — authorized testing only)
mimikatz# privilege::debug
mimikatz# misc::skeleton
# Now any user can authenticate with "mimikatz" as password# AdminSDHolder persistence# Add controlled user to AdminSDHolder ACL# SDProp process propagates ACL to all protected groups every 60 minutes# SID History injection# Inject Domain Admin SID into low-privilege user's SID history# Document all persistence mechanisms and clean up after testing
Findings and Remediation
Finding
CVSS
Remediation
Kerberoastable accounts with weak passwords
7.5
Use gMSA, enforce 25+ char passwords for service accounts
Unconstrained delegation on servers
8.1
Remove unconstrained delegation, use constrained or RBCD
