Listen to this Post
Introduction:
Active Directory (AD) is the cornerstone of authentication and authorization in most corporate Windows environments, making it a prime target for attackers. Mastering AD attack methodologies is crucial for both offensive security professionals aiming to assess organizational resilience and blue teams tasked with building robust defenses. This article deconstructs a comprehensive, step-by-step approach to AD penetration testing, covering the entire attack chain from initial foothold to domain dominance.
Learning Objectives:
- Understand the key attack vectors and techniques used to compromise Active Directory environments.
- Learn practical, verified commands and procedures for executing common AD attacks.
- Develop the knowledge to detect and mitigate these attacks, strengthening overall security posture.
You Should Know:
1. Initial Reconnaissance with PowerView
Before launching attacks, understanding the domain structure is paramount. PowerView, a part of the PowerSploit toolkit, is an essential PowerShell script for AD reconnaissance.
`Get-NetDomain`
`Get-NetUser | Select-Object samaccountname, description, lastlogon`
`Get-NetComputer | Select-Object name, operatingsystem`
Step-by-step guide:
First, import the PowerView module into your PowerShell session: Import-Module .\PowerView.ps1. The `Get-NetDomain` command provides basic information about the current domain, such as the domain name and forest. To enumerate all users, use Get-NetUser, which lists details like usernames and last logon times, helping identify potential targets. `Get-NetComputer` lists all joined computers, allowing you to map the network and identify key servers like Domain Controllers.
2. LLMNR/NBT-NS Poisoning with Responder
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are fallback protocols that can be poisoned to capture user credentials.
`sudo responder -I eth0 -wv`
Step-by-step guide:
On your attacking machine (Kali Linux), launch Responder. The `-I` flag specifies the network interface (e.g., eth0). The `-w` and `-v` flags enable the WPAD rogue server and verbose mode. When a user on the network mistypes a share name (e.g., \\filserver), their system will broadcast a name resolution request. Responder will answer falsely, tricking the victim into attempting to authenticate to your machine. This allows you to capture NTLMv2 hashes, which can be taken offline for cracking with tools like Hashcat.
3. AS-REP Roasting with Rubeus
If a user account has the “Do not require Kerberos pre-authentication” setting enabled, their encrypted AS-REP data can be captured and cracked offline.
`.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt`
Step-by-step guide:
From a Windows machine with Rubeus.exe, run the command. This will query the Domain Controller for accounts without pre-authentication and output their AS-REP hashes in a format suitable for Hashcat. The resulting hashes are saved to hashes.txt. You can then use Hashcat to crack these hashes: hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt. This attack does not require any prior authentication to the domain.
4. Kerberoasting with Rubeus
Kerberoasting targets service accounts in AD, which use Service Principal Names (SPNs). Attackers request service tickets for these accounts and attempt to crack the encrypted portion offline.
`.\Rubeus.exe kerberoast /outfile:kerberoast_hashes.txt`
Step-by-step guide:
After gaining initial user credentials (even a low-privilege account), use Rubeus to perform Kerberoasting. The command requests service tickets for all accounts with SPNs. The tool extracts the encrypted Ticket Granting Service (TGS) tickets and outputs them to a file. These hashes are vulnerable to offline cracking because service account passwords are often not changed frequently. Use Hashcat mode `13100` to crack them.
5. SMB Share Enumeration and SMBClient
Locating accessible file shares is a common method for finding sensitive data or scripts containing credentials.
`smbclient -L //10.10.10.10 -N`
`smbclient -L //10.10.10.10 -U ‘guest’%”`
`smbclient //10.10.10.10/share -U ‘domain\user’`
Step-by-step guide:
Use `smbclient` to list shares on a target machine. The `-L` flag requests a list, and `-N` attempts an anonymous login if allowed. If a guest account is enabled, try the second command. Once a share is identified, use the third command to connect to it. Explore the share for files like web.config, unattended.xml, or batch scripts that may contain cleartext passwords or hashes.
- Dumping Credentials from the Local Security Authority Subsystem Service (LSASS)
The LSASS process memory on a Domain Controller or any Windows machine often contains cached credentials and Kerberos tickets.
`tasklist /svc | findstr lsass.exe`
`.\procdump.exe -accepteula -ma 664 lsass.dmp`
`.\mimikatz.exe “sekurlsa::minidump lsass.dmp” “sekurlsa::logonPasswords full” exit`
Step-by-step guide:
First, identify the PID of the `lsass.exe` process using tasklist. Using a tool like Procdump from Sysinternals, create a memory dump of the LSASS process. The `-ma` flag creates a full dump. This can often bypass antivirus because Procdump is a legitimate Microsoft-signed tool. Later, on your analysis machine, load this dump file into Mimikatz using the `sekurlsa::minidump` command. Then, run `sekurlsa::logonPasswords` to extract plaintext passwords, hashes, and tickets from the dump.
7. Pass-the-Hash with PsExec
Once an NTLM hash is obtained, it can often be used directly for authentication instead of a plaintext password, a technique known as Pass-the-Hash.
`.\psexec.exe -accepteula -s -h \\TARGET-PC -u DOMAIN\Administrator -H aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4 cmd.exe`
Step-by-step guide:
This command uses the PsExec utility from the Windows Sysinternals suite. The `-s` flag runs the process as SYSTEM, and `-h` loads the account’s profile. The critical part is the `-H` flag, which is followed by the LM:NT hash pair (the LM hash part is often the dummy value aad3b...). If successful, this will open a command prompt (cmd.exe) on the target machine with high privileges, allowing for further lateral movement or privilege escalation.
8. Golden Ticket Attack with Mimikatz
A Golden Ticket attack forges a Kerberos Ticket Granting Ticket (TGT), providing persistent, nearly undetectable domain admin access if the KRBTGT account’s password hash is known.
`mimikatz kerberos::purge`
`mimikatz kerberos::golden /user:fakeadmin /domain:domain.local /sid:S-1-5-21-… /krbtgt:a9b30e5b0dc865eadcea9411e4ade2d /id:500 /ptt`
Step-by-step guide:
This is an advanced, post-exploitation technique. First, use Mimikatz to purge any existing Kerberos tickets from memory. The `kerberos::golden` command creates the fake TGT. The `/user` can be any username, `/domain` and `/sid` must be correct for the target domain, and `/krbtgt` requires the NTLM hash of the KRBTGT account, which can be obtained from a Domain Controller dump. The `/id:500` specifies an admin-level ID, and `/ptt` injects the ticket directly into the current session. You can then access any resource as a domain admin.
What Undercode Say:
- The Attack Chain is Everything. Individual techniques are powerful, but their real strength lies in how they are chained together. A successful AD compromise is rarely a single step; it’s a logical progression from reconnaissance to credential access to lateral movement and finally, domain persistence.
- Detection is Paramount for Defense. For every offensive technique, there is a defensive countermeasure. Monitoring for abnormal LDAP queries, detecting LLMNR poisoning attempts, alerting on unusual Kerberos ticket requests (like AS-REP Roasting), and closely guarding LSASS are critical for a robust security posture.
The shared post underscores that AD security is a continuous battle of attrition. The “treasure” is not just a list of commands but the conceptual understanding of how these attacks interlink. For blue teams, this compendium serves as a vital checklist for hardening environments. It highlights that while foundational AD protocols provide functionality, they also introduce inherent weaknesses that attackers are adept at exploiting. The key is to assume breach and focus on minimizing the attacker’s ability to move from an initial foothold to a full-scale domain compromise.
Prediction:
The future of AD attacks will increasingly leverage AI and machine learning to automate the attack chain, identifying the path of least resistance in real-time. Furthermore, as cloud identities (Azure AD) become more integrated with traditional on-premises AD, attack methodologies will evolve to target this hybrid identity plane, making attacks like “Golden Ticket” potentially translatable to the cloud. Defenses will correspondingly shift towards identity-centric security models, Zero Trust architectures, and more advanced behavioral analytics to detect anomalous activity that traditional signature-based tools miss. The core principles of AD security, however, will remain rooted in understanding and defending against these fundamental attack vectors.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Omar Aljabr – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
