Listen to this Post
Introduction:
In the modern enterprise ecosystem, Active Directory (AD) functions as the central authentication and authorization hub, making it a prime target in over 90% of all cyber breaches. To move beyond theoretical knowledge and master the adversarial mindset required for red teaming, professionals must develop a robust understanding of AD attack vectors, from initial exploitation to stealthy lateral movement. This course is designed to equip you with the hands-on skills to perform real-world attack chains, effectively preparing for advanced certifications like OSCP, CRTP, and CRTE.
Learning Objectives:
- Objective 1: Gain proficiency in executing Kerberos-based attacks (e.g., Kerberoasting, AS-REP Roasting, and Golden/Sapphire/Diamond Tickets) using both native Windows tools and cross-platform frameworks.
- Objective 2: Learn advanced credential dumping and lateral movement techniques, including Pass-the-Hash (PtH), DCSync attacks, and abusing Windows Remote Management (WinRM) for silent network traversal.
- Objective 3: Identify and exploit complex privilege escalation paths by manipulating Discretionary Access Control Lists (DACLs) and attacking Active Directory Certificate Services (ADCS) with specialized tooling like Certipy and NTLMRelayx.
You Should Know:
1. Pre‑Engagement Preparation & Tooling Setup
Before diving into attacks, a methodical approach to tool installation and target identification is crucial. For a Linux-based attacker machine, tools like `ldapsearch` and `impacket` are foundational. For example, to locate Domain Controllers and Certificate Authorities, you can perform LDAP queries, or use the `nslookup` command to identify Key Distribution Centers (KDCs). A modern, unified tool for network reconnaissance is NetExec, the active successor to CrackMapExec, which supports SMB, WinRM, LDAP, SSH, and MSSQL protocols. It can be installed via `pipx install netexec` and is used for validating credentials, enumerating shares, and executing commands.
– Linux LDAP Query: `ldapsearch -x -H ldap://
– Windows Enumeration: `net group “Domain Admins” /domain` followed by `nltest /dclist:domain.local`
– NetExec SMB Share Enumeration: `nxc smb 192.168.1.0/24 -u ‘user’ -p ‘pass’ –shares`
– NetExec WinRM Command Execution: `nxc winrm
2. Foundational AD Enumeration with BloodHound
Understanding the attack surface requires mapping the relationships between users, groups, computers, and ACLs. BloodHound, paired with its data collector SharpHound, visualizes complex attack paths through graph theory. This process allows you to identify high-value targets and misconfigurations. For Linux, the `bloodhound-python` ingestor can be used directly. After ingestion, the Neo4j-powered BloodHound interface can reveal, for instance, a user with `GenericAll` rights over a high-privileged group, highlighting an immediate privilege escalation vector.
– Linux Data Collection (Python): `bloodhound-python -d
– Windows Data Collection (PowerShell): `Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Temp\`
– Windows Data Collection (C): `SharpHound.exe -c All –domain
3. Abusing Kerberos (The Golden & Diamond Ticket Operations)
Kerberos abuse forms the core of advanced AD persistence and impersonation. Kerberoasting targets service accounts, extracting crackable ticket hashes. AS-REP Roasting targets users without pre-authentication. More sophisticated attacks involve forging Golden Tickets (using the KRBTGT hash for total domain access) and Diamond Tickets (modifying legitimate TGTs to evade detection). Tools like `Rubeus` on Windows and `impacket` on Linux are essential. For example, after dumping the KRBTGT hash, an attacker can forge a Golden Ticket, granting unfettered access to any resource in the domain.
– Linux – Kerberoasting: `impacket-GetUserSPNs
– Linux – AS-REP Roasting: `impacket-GetNPUsers
– Windows – Rubeus Kerberoast: `Rubeus.exe kerberoast /outfile:hashes.txt`
– Windows – Golden Ticket (Mimikatz): `mimikatz kerberos::golden /user:Administrator /domain:
– Linux – Pass the Ticket: `export KRB5CCNAME=/path/to/ticket.ccache && python3 psexec.py -k -1o-pass
4. Advanced Credential Dumping & Lateral Movement
Once a foothold is established, escalating privileges and moving laterally are key. Dumping credentials from LSASS using Mimikatz (via the `sekurlsa::logonpasswords` command) is a classic technique. For pass-the-hash attacks, frameworks like NetExec and Impacket’s `psexec` or `wmiexec` allow an attacker to leverage stolen NTLM hashes for remote command execution without requiring the plaintext password. Lateral movement can be automated to spread across the network efficiently.
– Windows – LSASS Dump (Mimikatz): `privilege::debug` followed by `sekurlsa::logonpasswords` (requires local admin).
– Linux – Dumping NTDS.dit Remotely (Impacket): `impacket-secretsdump -just-dc-1tlm
– Lateral Movement – Pass-the-Hash (NetExec): `nxc smb
– Lateral Movement – Over-Pass-the-Hash (Mimikatz): `mimikatz sekurlsa::pth /user:
5. Privilege Escalation via DACL & ADCS Attacks
Modern AD environments often have complex permission sets that can be exploited. DACL Abuse involves modifying an object’s Access Control Entries (ACEs) to grant an attacker elevated permissions. For example, if a user has `WriteDacl` on a high-value group, they can grant themselves `GenericAll` rights, effectively taking control. ADCS Attacks (certificate-based) are highly potent; a vulnerable certificate template (ESC1) can allow a user to request a certificate for a domain admin.
– DACL Enumeration (BloodHound): Use BloodHound’s built-in queries (e.g., “Find principals with DCSync rights”) to identify ACL misconfigurations.
– DACL Abuse (PowerShell – ActiveDirectory Module): Add a user to a protected group via `Add-ADGroupMember -Identity “Domain Admins” -Members “attacker_user”` (requires `WriteProperty` right on the group).
– ADCS Enumeration & Exploitation (Certipy): `certipy find -u
– ADCS Exploit (ESC8 – NTLM Relay): `python3 ntlmrelayx.py -t http://
6. Newer & Evasive Techniques: Sapphire & Diamond Tickets
To evade modern EDR solutions, attackers are moving away from the “noisy” Golden Ticket towards Sapphire and Diamond Tickets. The Diamond Ticket attack modifies a legitimate TGT request by re-encrypting it, making it less anomalous as it uses valid domain metadata. The Sapphire Ticket is a newer variant that further refines this concept. Both require the KRBTGT hash but produce tickets that blend in with normal Kerberos traffic.
– Windows – Diamond Ticket (Rubeus): `Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512 /krbkey:
– Windows – Sapphire Ticket (Rubeus – if supported): `Rubeus.exe sapphire /service:krbtgt /enctype:aes256 /dc:
7. Cloud & Hybrid Attack Vectors
As environments evolve into hybrid models, AD attacks can extend to Azure AD and Office 365. Attackers leverage compromised AD accounts to access cloud resources, abuse federation trust, or perform token theft. While not traditional AD, understanding these hybrid attack paths is crucial for modern red teaming. For example, a compromised user with “Application Administrator” rights can register a malicious application in Azure AD, granting persistent, stealthy access to cloud data.
– Enumerate Azure AD Users: `Get-AzureADUser -All $true`
– Dump Azure AD Tokens: `Get-AzureADAccessToken` (using `AzureAD` and `MSOnline` modules)
– Steal & Replay Tokens: Export logged-in browser profiles from Chrome/Edge and replay tokens using tools like `TokenTactics` or ROADtools.
What Undercode Say:
- Key Takeaway 1: The training material goes beyond theory, directly mapping to the exact skills demanded by hiring managers. The emphasis on newer techniques like Sapphire Tickets and ADCS attacks shows a deep understanding of current threat landscapes.
- Key Takeaway 2: The structured curriculum, from initial exploitation to persistence, provides a clear and logical progression, making it an ideal roadmap for professionals aiming for OSCP, CRTP, or CRTE certifications. The inclusion of “bonus sessions” and new topics ensures the training is up-to-date and comprehensive.
Prediction:
- +1 Active Directory will remain the core of identity management for the next decade, ensuring that expertise in AD penetration testing will be a consistently high-demand and high-value skill in the cybersecurity job market.
- -1 The complexity of AD environments will continue to grow, leading to more misconfigurations and hybrid integrations that expand the attack surface. Professionals without this deep training will increasingly struggle to defend against or simulate advanced persistent threat (APT) tactics.
- +1 The shift towards automated tools like `NetExec` and `AyDee` will significantly increase the efficiency of penetration testers, allowing them to focus more on strategic exploitation and less on manual enumeration.
- -1 As detection for “noisy” attacks like Golden Tickets improves, reliance on them will become a liability. Courses that teach stealthier techniques like Diamond and Sapphire tickets are essential for staying ahead of blue teams.
▶️ Related Video (88% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Ad Pentest – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
