logo

Active Directory Attacks

Category:

Active Directory

Summary:

How attackers enumerate, escalate, and move laterally through an Active Directory domain — from Kerberoasting to DCSync and full domain compromise.

Active Directory (AD) runs identity for most Windows networks, which makes it the top target on internal pentests. One low-privilege account is enough to start: from there an attacker maps the domain, abuses Kerberos and over-permissive rights, and reuses stolen credentials to climb toward Domain Admin. Most AD compromises use features working as designed, not a CVE. That first account usually comes from phishing or a foothold like SQL injection, and a domain-joined MSSQL server is another common way in.

Common Techniques

  • Kerberoasting — request service tickets for accounts with an SPN and crack their (often weak) passwords offline.
  • AS-REP Roasting — accounts without Kerberos pre-auth hand out a crackable blob to anyone.
  • Password spraying — one common password against every account, avoiding lockouts.
  • NTLM relay & coercion — a man-in-the-middle step that forces a machine to authenticate, then relays it to LDAP, SMB, or AD CS.
  • ACL / delegation abuse — rights like GenericAll let you take over a privileged object, while unconstrained delegation lets a compromised host capture and replay the Kerberos tickets of any account — even a DC — that authenticates to it.
  • DCSync — with replication rights, pull every account’s password hash (including krbtgt) for full, persistent control.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Testing

Terminal window
# Map escalation paths as any domain user
bloodhound-python -u user -p 'Password123' -d corp.local -c All -ns <dc-ip>


# Kerberoast all service accounts
GetUserSPNs.py corp.local/user:'Password123' -dc-ip <dc-ip> -request


# Crack the tickets offline
hashcat -m 13100 kerberoast.hashes rockyou.txt

Log every roastable account, cracked password, and hash you pull as you go, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

Remediation

Give service accounts long random passwords (or gMSA), enforce a strong password policy with lockout, and audit dangerous ACLs and delegation with BloodHound. Enable SMB signing and LDAP channel binding to blunt relay, tier admin accounts, and rotate krbtgt on any suspected compromise.