Active Directory — Concepts Hub
External: Internal All The Things — Enumeration
Domain environments on OSCP: enumerate → Kerberos/NTLM → BloodHound paths → DA.
Decision trees: Attack Path Graph > Active Directory — Attack Tree · Credential Graph (“I have a hash/TGT/GenericWrite — now what?”)
Sync time before Kerberos from Linux: Time Sync · Kerberos Setup - krb5.conf
📌 Standard AD Workflow
1. [[Kerberos Setup - krb5.conf]] — hosts + `/etc/krb5.conf` (`nxc --generate-krb5-file`)
2. [[Time Sync]] — ntpdate -s DC_IP
3. User enum — [[Kerbrute]] · [[ldapsearch]] · port 5222 [[Pidgin]]
4. No creds — AS-REP roast ([[Kerberos Scripts]] GetNPUsers)
5. Low creds — Kerberoast · [[Bloodhound + Sharphound]] collect
6. Password must change? — [[Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE]] · [[krb5-user]] · port **464**
7. Map paths — BloodHound → shortest path to DA
8. Abuse ACLs — **[[AD Permissions]]** · **[[WriteDacl]]** · **[[GenericAll]]** · **[[AD CS Permissions]]** · [[bloodyAD]] · [[Certipy & Certify]] (AD CS)
9. Shells / dump — [[Impacket]] · [[secretsdump]] · [[evil-winrm]]
Tool docs: Active Directory (tools folder)
📌 LDAP Enumeration Tree
LDAP Access (389)
│
├── Enumerate Users → [[ldapsearch]] · nxc ldap --users
├── Enumerate Groups → ldap filters · [[PowerView]]
├── Enumerate Computers
├── Enumerate SPNs → Kerberoast targets
└── Enumerate Trusts → [[Bloodhound + Sharphound]]📌 Kerberos Branch
Valid Domain User
│
├── Kerberoasting → [[Kerberoast]]
├── AS-REP Roasting → [[Kerberos Scripts]] · [[Kerbrute]]
├── Password Spraying → [[Kerbrute]] · [[CrackMapExec - nxc]]
├── Password must change → [[Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE]] · [[krb5-user]] · port **464**
├── Silver / Golden Ticket → [[Rubeus]]
└── Delegation (RBCD) → [[bloodyAD]] · [[Impacket]] getSTDeep dive: Kerberos · Credential Graph > KERBEROS TGT
📌 NTLM Branch
NTLM Hash / Captured Hash
│
├── Pass-the-Hash → [[Impacket]] · [[evil-winrm]] · [[CrackMapExec - nxc]]
├── NTLM Relay → [[ntlmrelayx]] · [[Responder]]
└── Crack → [[Hashcat]] · [[John]]→ Credential Graph > NTLM HASH · LatMovement
📌 Domain Admin Paths
Low Priv User → Kerberoast / AS-REP / Spray / Local Admin / DCSync / ADCS → Domain AdminFull tree: Attack Path Graph > Domain Admin paths · BloodHound ACLs: Credential Graph > BloodHound ACL edges
📌 Key Tools
| Need | Note |
|---|---|
| Concepts + tickets | Kerberos |
| Password must change | Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE · krb5-user |
| User enum / spray | Kerbrute |
| Roast | Kerberoast |
| LDAP queries | ldapsearch |
| Graph / paths | Bloodhound + Sharphound · SharpHound · RustHound |
| LDAP writes / ACL abuse | bloodyAD |
| Shells / dump | Impacket · secretsdump |
| Capture hashes | Responder |
| AD CS | Certipy & Certify |
| Windows Kerberos | Rubeus |
| SMB enum | CrackMapExec - nxc · enum4linux |
Related Tools
- Kerberos Setup - krb5.conf
- Kerbrute
- ldapsearch
- Bloodhound + Sharphound
- SharpHound
- RustHound
- bloodyAD
- CrackMapExec - nxc
- Impacket