Active Directory Pentest

---
name: active-directory-pentest
description: "Use when testing an on-prem Active Directory environment — enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting, delegation abuse), credential access (NTLM/hashes, LSASS, DCSync), ACL/permission abuse, GPO abuse, trust attacks, and domain-privilege-escalation attack paths. Maps to MITRE ATT&CK, with detection signals and remediation. Assumed-breach, authorized engagements only."
---

# Active Directory Penetration Testing

Attack-path-driven assessment of on-prem AD (typically assumed-breach: you start with a low-priv foothold and work toward Domain Admin / specific objectives). Mapped to **MITRE ATT&CK**. Every technique lists its detection signal so defenders can catch it.

## 0. Authorization gate
- [ ] Written scope: domain(s), foothold provided, objectives (DA / specific data).
- [ ] DCSync / credential-dumping explicitly authorized (high impact).
- [ ] Data-handling + cleanup (remove any created objects/accounts) agreed.

## 1. Enumeration (map the terrain)
- Domain/forest structure, trusts, OUs, users, groups, computers, GPOs, ACLs.
- Build the attack graph: who can reach Domain Admin via group membership, ACLs, sessions, or delegation. (BloodHound-style graph analysis is central — see `vuln-chaining` for path reasoning.)
- Find high-value targets: DAs, service accounts, privileged sessions, unconstrained-delegation hosts.

## 2. Kerberos attacks
- **Kerberoasting:** request service tickets for SPN accounts → offline crack weak service-account passwords. **Detect:** anomalous TGS requests / RC4.
- **AS-REP roasting:** accounts without pre-auth → crackable. **Detect:** AS-REQ without pre-auth.
- **Delegation abuse:** unconstrained (capture TGTs), constrained, and resource-based constrained delegation → impersonation. **Detect:** unusual S4U / TGT use.
- **Fix:** strong/managed service-account passwords (gMSA), require pre-auth, remove/limit delegation, tier-0 isolation.

## 3. Credential access
- NTLM hash capture (pair with `network-pentest` relay/poisoning), LSASS credential extraction (authorized), DPAPI, cached creds.
- **DCSync** (replicate directory secrets) with sufficient rights → domain-wide compromise.
- **Fix:** Credential Guard, LSASS protection, restrict replication rights, tiered admin model, LAPS for local admin passwords.

## 4. ACL, GPO & object abuse
- Dangerous ACLs (GenericAll/WriteDACL/WriteOwner, force-change-password rights) create escalation edges.
- GPO edit rights → code execution across linked OUs.
- **Fix:** audit and tighten ACLs, restrict GPO edit rights, monitor privileged object changes.

## 5. Persistence & domain dominance (document, don't linger)
Golden/Silver ticket concepts, AdminSDHolder, DCShadow — understand for detection guidance; in engagements, prove capability and document rather than establishing lasting persistence.
- **Fix:** krbtgt rotation (twice), tier-0 protection, monitoring of directory-level changes.

## 6. Trusts
- Enumerate domain/forest trusts; assess cross-domain/forest escalation paths.
- **Fix:** SID filtering, selective authentication, minimize trusts.

## 7. Tooling
BloodHound/SharpHound (attack graph), PowerView, impacket (secretsdump, GetUserSPNs, ntlmrelayx), Rubeus, certipy (AD CS — ESC1–ESC8). Follow RoE.

## 8. AD CS (certificate services)
Test for ESC1–ESC8 template/permission misconfigurations enabling privilege escalation via certificate abuse. **Fix:** harden certificate templates, restrict enrollment, monitor issuance.

## 9. Reporting & correlation
Present findings as **attack paths**, not isolated issues (foothold → step → step → DA), with the single highest-leverage fixes that break the most paths. Route path reasoning to `vuln-chaining`, priv-esc to `privilege-escalation`, cloud-identity to `entra-cloud-pentest`. Checklist: `references/ad-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>