The Ultimate Active Directory Hacking Primer: 20 Exploits You MUST Know to Pass the OSCP, CRTP, and CRTE

By /

Listen to this Post

Featured Image

Introduction:

Active Directory (AD) is the cornerstone of most corporate Windows networks, making it a prime target for cyber attackers. Understanding its vulnerabilities is critical for both offensive security professionals aiming to pass elite certifications and blue team defenders tasked with protecting enterprise infrastructure. This guide demystifies the core attack vectors that form the backbone of modern AD penetration testing.

Learning Objectives:

  • Understand the fundamental structure of Active Directory and the key terminology that underpins common exploits.
  • Learn the prerequisites and step-by-step execution for 20 critical AD attacks.
  • Gain practical, hands-on knowledge through verified commands and code snippets used in real-world assessment scenarios.

You Should Know:

1. Kerberoasting

Kerberoasting is an attack that targets service accounts within Active Directory by requesting Kerberos service tickets (TGS) and then attempting to crack their passwords offline. This is effective because service account passwords can often be weak.

Command/Tutorial:

 Request Kerberos tickets for all service accounts
python GetUserSPNs.py -dc-ip 10.10.10.1 'domain.local/user' -request

Use hashcat to crack the harvested hash
hashcat -m 13100 service_tickets.hash /usr/share/wordlists/rockyou.txt

Step-by-step guide:

  1. As a domain user, query Active Directory for all User Service Principal Names (SPNs). These are typically service accounts.
  2. Request a Kerberos service ticket (TGS) for one or all SPNs. This ticket is encrypted with the service account’s password hash.
  3. Export this ticket to a file. The format is suitable for offline password cracking tools.
  4. Use a tool like `hashcat` or `john` to crack the password hash, potentially revealing a weak service account credential.

2. ASREPRoasting

ASREPRoasting targets user accounts that have the “Do not require Kerberos pre-authentication” setting enabled. This allows an attacker to request an encrypted TGT for the user without having their password, which can then be cracked offline.

Command/Tutorial:

 Enumerate users without pre-auth required
python GetNPUsers.py domain.local/ -dc-ip 10.10.10.1 -usersfile userlist.txt -format hashcat -output hashes.asreproast

Crack the captured hash
hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt

Step-by-step guide:

  1. Enumerate user accounts in the domain that have the “Do not require Kerberos pre-authentication” attribute set.
  2. For each vulnerable user, send an AS-REQ request without pre-authentication. The KDC will return an AS-REP encrypted with the user’s password.
  3. Extract the encrypted part of the AS-REP, which is in a crackable format.
  4. Use a password cracking tool to recover the user’s plaintext password from the hash.

3. Golden Ticket Attack

A Golden Ticket attack provides persistent, nearly undetectable domain-level access by forging a Kerberos Ticket-Granting Ticket (TGT). This requires the `krbtgt` user’s NTLM password hash, which is a long-term secret for the domain.

Command/Tutorial:

 Dump the krbtgt hash from a Domain Controller (requires DA privileges)
mimikatz  lsadump::dcsync /domain:domain.local /user:krbtgt

Forge a Golden Ticket
mimikatz  kerberos::golden /user:fakeadmin /domain:domain.local /sid:S-1-5-21-... /krbtgt:a9b30e... /id:500 /ptt

Step-by-step guide:

  1. Compromise a Domain Controller and gain Domain Admin (or equivalent) privileges.
  2. Dump the `krbtgt` user’s NTLM password hash using tools like Mimikatz (dcsync or lsadump::lsa).
  3. Using this hash, forge a TGT with any desired user membership (e.g., Domain Admin) and an arbitrary expiration date.
  4. Inject this forged Golden Ticket into memory (/ptt in Mimikatz) to gain immediate access to any resource in the domain.

4. Silver Ticket Attack

A Silver Ticket is a forged Kerberos service ticket (TGS) for a specific service on a target machine. It requires the service’s password hash (e.g., the `CIFS` or `HOST` service), which is often easier to obtain than the `krbtgt` hash.

Command/Tutorial:

 Dump machine account hashes (requires local admin on the target machine)
mimikatz  sekurlsa::logonpasswords

Forge a Silver Ticket for the CIFS service
mimikatz  kerberos::golden /user:fakeuser /domain:domain.local /sid:S-1-5-21-... /target:fileserver.domain.local /service:CIFS /rc4:1a2b3c... /ptt

Step-by-step guide:

  1. Gain local administrator privileges on a target machine or server.
  2. Dump the NTLM password hash of the machine account (or service account) using Mimikatz.
  3. Forge a service ticket (TGS) for a specific service (e.g., `CIFS` for file shares, `HOST` for WMI) on that machine.
  4. Inject the Silver Ticket into memory. You will now have access to that specific service on the target machine as the user defined in the ticket.

5. DCSync Attack

The DCSync attack impersonates a Domain Controller to request password data from other DCs using the Directory Replication Service (DRS) protocol. This allows an attacker to extract password hashes for any user, including the krbtgt.

Command/Tutorial:

 Perform a DCSync for a specific user
mimikatz  lsadump::dcsync /domain:domain.local /user:Administrator

Perform a DCSync for the krbtgt account
mimikatz  lsadump::dcsync /domain:domain.local /user:krbtgt

Step-by-step guide:

  1. The attacker must have the necessary replication rights over the domain (e.g., be a member of the Domain Admins or Enterprise Admins group, or have these rights delegated).
  2. Using a tool like Mimikatz, issue a `dcsync` command targeting a specific domain user.
  3. The tool will use the MS-DRSR protocol to request the user’s password data from a Domain Controller.
  4. The DC will respond with the user’s NTLM password hash, enabling further attacks like Pass-the-Hash or Golden Ticket creation.

6. Pass-the-Hash (PtH)

Pass-the-Hash is a technique that allows an attacker to authenticate to a remote system using a user’s NTLM hash instead of the plaintext password. This bypasses the need to crack the hash.

Command/Tutorial:

 Use Pass-the-Hash with CrackMapExec to execute a command
crackmapexec smb 10.10.10.0/24 -u 'Administrator' -H 'aad3b435b51404eeaad3b435b51404ee:579da618cfbfa85247acf1f800a280a4' -x 'whoami'

Use Evil-WinRM with a hash
evil-winrm -i 10.10.10.10 -u 'Administrator' -H '579da618cfbfa85247acf1f800a280a4'

Step-by-step guide:

  1. Obtain a user’s NTLM password hash through techniques like DCSync, LSASS dumping, or credential harvesting.
  2. Instead of cracking the hash, use it directly with a tool that supports PtH authentication.
  3. Provide the username, domain (if applicable), and the NTLM hash to the tool.
  4. The tool will use this hash to perform NTLM authentication, granting you access to the target system as that user.

7. ACL Abuse (ForceChangePassword)

Active Directory ACLs can be misconfigured, granting standard users dangerous permissions over other objects. A common example is the `ForceChangePassword` right, which allows a user to change another user’s password without knowing the current one.

Command/Tutorial:

 Use PowerView to abuse the ForceChangePassword right
Set-DomainUserPassword -Identity 'TargetUser' -Verbose -AccountPassword (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force) -Credential $Cred

Using the changed password to get access
runas /netonly /user:domain.local\TargetUser "powershell.exe"

Step-by-step guide:

  1. Enumerate the Access Control List (ACL) of a target user or group using tools like PowerView (Get-DomainUser | Get-DomainObjectAcl).
  2. Identify if your current user has any interesting rights over the target object, such as ForceChangePassword.
  3. If you have this right, you can use a tool to set a new password for the target user without knowing their current password.
  4. Once the password is changed, you can authenticate as that user, potentially gaining higher privileges.

What Undercode Say:

  • Foundational knowledge of AD architecture is non-negotiable. Without understanding the core components like domains, forests, trusts, and Kerberos, the exploits are just magic spells that work until the environment changes.
  • The line between offensive and defensive security is blurred in AD. Every attack technique documented here must be mirrored by a specific defensive control, such as implementing Protected Users groups, restricting delegation, and rigorously auditing ACLs.

The analysis reveals that AD security is a battle over identity. The exploits—from Kerberoasting to ACL abuse—are not software vulnerabilities but abuses of intended functionality. This shifts the security paradigm from patching CVEs to relentless hardening of configuration and monitoring for anomalous authentication events. The attacks are low-noise, high-impact, and often trivial to execute once a minor foothold is gained, making post-exploitation a critical phase for defenders to monitor.

Prediction:

The future of AD security will be defined by the widespread adoption of cloud-integrated identity solutions like Azure AD and the implementation of new authentication protocols like Kerberos Armoring. While this will mitigate some classic on-premises attacks, it will create a new hybrid attack surface. Threat actors will increasingly focus on “trust poisoning,” exploiting legacy trusts between on-prem AD and cloud tenants to move laterally between environments, making comprehensive identity threat detection and response (ITDR) a cornerstone of enterprise security.

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Karim Mohamed – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: