Performing Active Directory Vulnerability Assessment

---
name: performing-active-directory-vulnerability-assessment
description: Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.
tags:
- pingcastle
- purple-knight
- ldap
- bloodhound
- kerberos
- ad-security
- fetih
- privilege-escalation
- cybersecurity
- vulnerability-management
- active-directory
- siber-güvenlik
triggers:
- active
- api
- assessment
- authentication
- directory
- dns
- encryption
- http
- incident
- log
- password
- performing
category: vulnerability-management
source_subdomain: vulnerability-management
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
adapted_for: fetih
---

# Performing Active Directory Vulnerability Assessment


## Genel Bakış

Active Directory (AD) is the primary identity and access management system in most enterprise environments, making it a critical attack target. bu skill covers comprehensive AD security assessment using PingCastle for health checks, BloodHound for attack path analysis, and Purple Knight for security posture scoring. These tools identify misconfigurations, excessive privileges, Kerberos weaknesses, and lateral movement opportunities.


## Ne Zaman Kullanılır

- conducting yaparken security assessments that involve performing active directory vulnerability assessment
- following yaparken: incident response procedures for related security events
- performing yaparken scheduled security testing or auditing activities
- validating yaparken security controls through hands-on testing

## Ön Gereksinimler

- Domain-joined workstation or domain admin access for scanning
- PingCastle (https://github.com/netwrix/pingcastle)
- BloodHound Community Edition with SharpHound collector
- Purple Knight from Semperis (free community tool)
- Python 3.9+ for analysis scripts
- .NET Framework 4.7+ for PingCastle on Windows

## Tool 1: PingCastle Health Check

### Kurulum and Execution
```powershell
Invoke-WebRequest -Uri "https://github.com/netwrix/pingcastle/releases/latest/download/PingCastle.zip" `
  -OutFile "PingCastle.zip"
Expand-Archive PingCastle.zip -DestinationPath C:\Tools\PingCastle

cd C:\Tools\PingCastle
.\PingCastle.exe --healthcheck

.\PingCastle.exe --healthcheck --server dc01.corp.local --user CORP\scanner_account --password P@ssw0rd

.\PingCastle.exe --scanner --scannerlp

.\PingCastle.exe --healthcheck --level Full
```

### PingCastle Scoring Categories

| Category | Description | Risk Areas |
|----------|------------|------------|
| **Stale Objects** | Inactive accounts, old passwords, obsolete OS | Ghost accounts, expired credentials |
| **Privileged Accounts** | Excessive admin rights, nested groups | Domain Admin sprawl, SID history |
| **Trusts** | Forest and domain trust configurations | Transitive trust abuse, SID filtering |
| **Anomalies** | Security setting deviations | GPO misconfigurations, schema issues |

### Key PingCastle Checks
```
- Accounts with "Password Never Expires" flag
- Accounts with Kerberos pre-authentication disabled (AS-REP roastable)
- Accounts with Kerberos delegation (unconstrained/constrained)
- Domain Controllers running unsupported OS versions
- AdminSDHolder permission modifications
- Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins)
- Trust relationships with SID filtering disabled
- GPO vulnerabilities allowing privilege escalation
```

## Tool 2: BloodHound Attack Path Analysis

### SharpHound Data Collection
```powershell

.\SharpHound.exe --collectionmethods All --domain corp.local --zipfilename bloodhound_data.zip

.\SharpHound.exe --collectionmethods Session,LoggedOn --domain corp.local --stealth

.\SharpHound.exe --collectionmethods All --domain corp.local --domaincontroller dc01.corp.local

Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain corp.local -OutputDirectory C:\BH_Data
```

### BloodHound CE Setup
```bash
curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose up -d


curl -X POST "http://localhost:8080/api/v2/file-upload/start" \
  -H "Authorization: Bearer $BH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"fileName": "bloodhound_data.zip"}'
```

### Critical BloodHound Queries
```cypher
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"}))
WHERE u.name <> "ADMINISTRATOR@CORP.LOCAL"
RETURN p

MATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group)
WHERE g.name CONTAINS "ADMIN"
RETURN u.name, u.serviceprincipalnames

MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})
RETURN c.name, u.name

MATCH (u:User {dontreqpreauth:true})
RETURN u.name, u.description

MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name CONTAINS "DC"
RETURN c.name

MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)
RETURN p
```

## Tool 3: Purple Knight Assessment

```powershell

.\PurpleKnight.exe

```

### Purple Knight Score Categories
| Score Range | Rating | Action Required |
|------------|--------|----------------|
| 90-100 | Excellent | Maintain current posture |
| 75-89 | Good | Address high-risk Bul:ings |
| 60-74 | Fair | Prioritize remediation plan |
| 40-59 | Poor | Immediate remediation required |
| 0-39 | Critical | Emergency response needed |

## Common AD Vulnerabilities

### 1. Kerberoasting Exposure
```powershell
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName |
  Select-Object Name, ServicePrincipalName, PasswordLastSet, Enabled
```

### 2. AS-REP Roasting Exposure
```powershell
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |
  Select-Object Name, DoesNotRequirePreAuth, Enabled
```

### 3. LLMNR/NBT-NS Poisoning Risk
```powershell
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name EnableMulticast -ErrorAction SilentlyContinue
```

### 4. Excessive Privileged Group Membership
```powershell
$groups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Account Operators", "Backup Operators")
foreach ($group in $groups) {
    $count = (Get-ADGroupMember -Identity $group -Recursive).Count
    Write-Output "$group : $count members"
}
```

## İyileştirme Priorities

| Bul:ing | Risk | Remediation |
|---------|------|-------------|
| Kerberoastable admin accounts | Critical | Remove SPNs or use MSA/gMSA |
| Unconstrained delegation on non-DCs | Critical | Switch to constrained/RBCD |
| Password Never Expires on admins | High | Enable password rotation policy |
| AS-REP roastable accounts | High | Enable Kerberos pre-authentication |
| AdminSDHolder modification | High | Audit and restore default ACLs |
| Stale computer accounts (90+ days) | Medium | Disable and move to quarantine OU |
| LDAP signing not enforced | Medium | Enable via GPO on all DCs |

## References

- [PingCastle GitHub](https://github.com/netwrix/pingcastle)
- [BloodHound CE](https://github.com/SpecterOps/BloodHound)
- [Purple Knight](https://www.purple-knight.com/)
- [MITRE ATT&CK - Active Directory](https://attack.mitre.org/techniques/T1484/)
- [Microsoft AD Security Best Practices](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory)

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 92f80f4fbcf25ace
-->