Back to field notes
OffSec Sydney • University Talk

Active Directory Authentication, Attacks & OSCP Tips

We look at what Active Directory actually does, how Kerberos and NTLM authentication really work, how attackers abuse them, and what you should practise before OSCP exams.

Prashant Ghatani (Pzod)
Security Consultant / Pentester
AD SYSTEM

From domain join and logon tickets to misconfig, lateral movement and domain dominance in a lab, not prod.

OffSec-inspired design1
"

Beware of geeks bearing gifts.

Kevin Mitnick

Opening hook2
Agenda

Attack path of this talk

01

What AD is

Directory service, domains, identity and why enterprises still run it.

02

Core pieces

Domain Controllers, OUs, GPOs, DNS and the moving parts.

03

Authentication

Kerberos, NTLM and where hashes, tickets and SPNs come in.

04

Enumeration

PowerShell, BloodHound and mapping privilege paths.

05

Attacks

Kerberoasting, AS-REP roasting, relay and misconfig.

06

Demo & tips

Lab walk-through and what to practise for OSCP-style exams.

Overview3
Speaker

whoami

  • Security Consultant / Pentester at NCC Group.
  • OSCP, NASA Hall of Fame 2024, Sydney Ambassador for OffSec.
  • Spend most days breaking Windows networks so others can fix them.
operator profile

$ skills --list

ad_enum, kerb_abuse, lateral_move, report_writing, student_mentoring

$ mission

Make AD attacks understandable enough that people can both pass labs and harden their own domains.

About4
AD basics

What Active Directory actually is

ID

Directory service that stores users, computers, groups and more.

DC

Domain Controllers run AD DS, authenticate logons and apply policy.

IAM

AD is the "who are you" and "what can you touch?" brain of many Windows networks.

What is AD5
Pieces on the board

Core AD components

  • Domain Controllers (DCs) hold the AD database and answer logons.
  • Users & groups security principals that map people and roles to permissions.
  • Organisational Units (OUs) containers for users, machines and delegation.
  • Group Policy Objects (GPOs) settings pushed down to users and computers.
  • DNS how clients find DCs and services in the first place.

DC => ntds.dit + SYSVOL

OU => logical grouping / delegation point

GPO => security, scripts, restrictions, hardening

Most AD attacks are just creative abuse of how these pieces are wired together.

Components6
DNS

Why DNS is glued to AD

Service discovery

  • Clients use DNS to find Domain Controllers, LDAP and Kerberos endpoints.
  • Names like pc01.domain.local hide changing IP addresses.
  • SRV records (e.g. ldap.tcp.dc.msdcs.domain.local) advertise DCs.

Failure modes

  • Broken DNS = broken logons, GPOs and sometimes entire domains.
  • Attackers can abuse DNS for discovery, spoofing or redirecting traffic.
DNS & AD7
Authentication

What AD authentication is trying to do

  • Confirm a user, computer or service is who they say they are.
  • Kerberos default, ticket-based, fast when set up right.
  • NTLM legacy, still shows up for IP-based access and fallbacks.
  • LDAP/LDAPS directory queries plus some bind operations.
  • Goal: only trusted identities reach sensitive resources and actions.

identity -> ticket/hash -> access

Most AD attacks are just stealing or replaying that middle piece (tickets or hashes) or convincing the DC to mint something it should not.

Auth basics8
Kerberos

Kerberos in one slide-ish

AS-REQ / AS-REP

Client proves knowledge of its key and gets a TGT from the KDC.

TGS-REQ / TGS-REP

Client asks the KDC for a service ticket to a specific SPN.

AP-REQ

Client presents the ticket to the service and proves it owns the session key.

Access

Service accepts and authorises based on the ticket contents.

Tickets are encrypted with account keys (user or service hashes). Attackers target those keys, misuse SPNs or request tickets they can crack offline.

Kerberos9
NTLM

Why NTLM still shows up

  • Used when clients talk to servers by IP or to hosts Kerberos cannot identify.
  • Challenge-response protocol: server sends a nonce, client responds with an HMAC using the NT hash.
  • Domain Controllers validate by recomputing the response from their copy of the hash.
  • Hashes can be cracked offline or reused in relay / pass-the-hash attacks.

user:password => LM/NT hashes

Administrator:31d6cfe0d16ae931b73c59d7e0c089c0...

Tools like hashcat and John the Ripper can brute-force weak NTLM hashes. Good policy and modern auth reduce how often NTLM is even in play.

NTLM10
Recon

Tools I actually use to enumerate AD

PowerView

PowerShell toolkit for users, groups, ACLs, sessions, GPOs.

NetExec (impacket)

Remote command, SMB, LDAP and Kerberos helpers.

BloodHound

Graphs relationships to find hidden attack paths.

Rubeus

Kerberos ticket extraction, roasting, manipulation.

Nmap

Find DCs, LDAP, Kerberos, SMB and WinRM exposure.

Native PowerShell

Often enough on its own on a domain-joined host.

Enumeration11
PowerShell

Why PowerShell is your best friend

  • Already present and trusted on most domain-joined Windows hosts.
  • Lets you query computers, users, groups and ACLs without dropping extra binaries.
  • Powers most modern AD recon frameworks under the hood.

Get-NetComputer | select operatingsystem,dnshostname

Get-NetSession -ComputerName client74

Get-Acl HKLM:

Once you trust your output, feed it to SharpHound/BloodHound to see where small misconfigs become domain admin.

PowerShell12
AD attacks

Kerberoasting in plain language

Idea

  • Service accounts with SPNs get Kerberos service tickets.
  • Those tickets are encrypted with the service account password hash.
  • Any domain user can request some of those tickets.

Why it matters

  • If the password is weak, you can crack the ticket offline.
  • Cracked service accounts often have high privileges.

Rubeus.exe kerberoast /outfile:hashes.kerberoast

impacket-GetUserSPNs -request -dc-ip 192.168.50.70 domain.com/username

Kerberoasting13
AD attacks

AS-REP roasting

  • Normally, Kerberos pre-auth forces clients to prove they know their password before the DC replies.
  • If an account has "Do not require Kerberos preauthentication" set, attackers can request AS-REPs without proof.
  • The AS-REP contains material that can be attacked offline to recover the password.

GetNPUsers.py domain.com/user -dc-ip -request

Get-ADUser -Filter * -Properties DoesNotRequirePreAuth |

Where-Object { $_.DoesNotRequirePreAuth -eq $true }

In a healthy domain, almost nobody should have pre-auth disabled.

AS-REP roasting14
Network attacks

LLMNR/NBNS poisoning and Responder

Concept

  • Victim tries to resolve a hostname that DNS cannot answer.
  • LLMNR/NBNS broadcasts go out to the local network.
  • Responder replies pretending to be the right host and collects NetNTLM hashes.

Why it still works

  • Legacy name resolution protocols left enabled.
  • SMB signing disabled or not enforced on servers.
  • Users running as domain users who auto-authenticate.
MITM15
Lateral movement

Moving around once you have a foothold

  • After the first shell, the real work is moving quietly between hosts.
  • Abuse existing trust: SMB shares, WinRM, RDP and scheduled tasks.
  • Use tunnels and proxies instead of exposing lab networks directly.

ligolo-ng

Lightweight pivoting proxy: build an agent mesh inside the network and route your tools (RDP, BloodHound collectors, SharpHound, etc.) through it.

classic moves

Pass-the-hash / pass-the-ticket, remote service creation, WMI/WinRM exec and authenticated SMB access.

Lateral movement16
Demo

Live AD attack path (lab only)

  • Identify the lab domain and key services (DC, file server, web app).
  • Enumerate users and SPNs, then launch one roasting or relay attack.
  • Show how a single weak config becomes domain privileges.
  • Close with the exact policy or hardening step that would kill this path.

demo flow

recon -> enumerate -> abuse -> escalate -> explain

Every click in the demo should answer three things: what did we do, why did it work, and how do defenders shut it down.

Demo17
OffSec mindset

Try -> fail -> learn -> apply -> grow

Reality

Enumeration is noisy, attacks often fail, and lab boxes do not fall over on the first try.

Skill

Getting unstuck and iterating on your approach is the core OffSec skill, not memorising one exploit chain.

Learning loops18
OSCP

What the OSCP exam is actually testing

The format

  • Hands-on, multi-host lab exam over VPN. 24 hours of exam time.
  • You gain points by fully compromising machines and submitting proof files.
  • Report-writing is part of the score: you must explain what you did.

What they care about

  • Methodical enumeration, not guessing.
  • Linking vulnerabilities into full attack chains.
  • Staying calm when shells drop, break, or vanish.

AD is just one part of the OSCP story, but knowing a few reliable Windows chains makes the exam feel far less random.

OSCP exam19
OSCP focus

AD things worth grinding before the exam

Enumeration muscle memory

  • Be fast at basic host and service discovery (Nmap, smbclient, rpcclient).
  • Practise 2-3 PowerView + native PowerShell commands until you do not need notes.
  • Get comfortable reading BloodHound edges instead of just clicking queries.

Attack chains

  • Run full lab reps of kerberoast -> crack -> pivot and AS-REP roast -> crack -> pivot.
  • Do at least one full LLMNR/Responder -> relay -> shell chain in a safe lab.
  • Document each chain as if it were a short pentest report.

You do not need to know every Windows trick. You do need a few AD chains you can run calmly under time pressure.

OSCP tips20
Closing

Understand the domain. Break it in labs. Fix it in production.

Active Directory is messy but predictable. If you can trace how auth and policy work, you can both exploit and defend them more intelligently.

Thanks for listening — Q&A
End21
1 / 21