Active Directory

Active Directory Basics

Active Directory (AD) is a directory service for Windows network environments.
AD provides authentication and authorization functions within a Windows domain environment.
It’s a hierarchical structure that allows for centralized management of an organization’s resources

Resources in AD can be users, computers, groups, network devices, file shares, group policies, devices, and trusts. Any user in AD, regardless of their privileges, can be used to enumerate most objects within the AD environment.

Many features in AD are not secure by default and can be easily misconfigured.
This weakness can be leveraged to move laterally and vertically within a network and gain unauthorized access.

Attack Paths

NTLM Relay — poisoning/coercion, signing checks, relay to SMB/LDAP/ADCS.
Kerberos Delegation — unconstrained, constrained, RBCD.
ADCS Attacks — ESC1–ESC8 with Certipy.
Domain Trusts — direction, transitivity, SID filtering, ExtraSids.

Useful Resources

Learning Resources

Other Useful Resources & Cheatsheets

Active Directory Helper Tools

Tool	Description
Ghostpack Compiled Binaries	Repository containing some of the following tools’ pre-compiled binaries
PowerView	PowerView is one of the main powershell tools to perform network and Windows domain enumeration and exploitation. It is useful for checking access, permissions, but also to enumerate potential users for Kerberoasting/ASREPRoasting attacks
Mimikatz	Performs many functions. Noteably, pass-the-hash attacks, extracting plaintext passwords, and kerberos ticket extraction from memory on host.
Active Directory Built-In PowerShell Module	Built-In Cmdlets to manage Active Directory domains, useful tool for enumeration
SharpView	Sharpview is the C# version of PowerView
BloodHound	Visually map out AD relationships and help plan attack paths that may otherwise go unnoticed.
SharpHound	Data collector to gather information from Active Directory about varying AD objects such as users, groups, computers, ACLs, GPOs, user and computer attributes, user sessions, and more. The tool produces JSON files which can then be ingested into the BloodHound GUI tool for analysis.
BloodHound.py	A Python-based BloodHound ingestor based on the Impacket toolkit. It supports most BloodHound collection methods and can be run from a non-domain joined attacker host. The output can be ingested into the BloodHound GUI for analysis.
Kerbrute	A tool written in Go that uses Kerberos Pre-Authentication to enumerate Active Directory accounts and perform password spraying and brute forcing.
Impacket toolkit	A collection of tools written in Python for interacting with network protocols. The suite of tools contains various scripts for enumerating and attacking Active Directory.
Responder	Tool to poison LLMNR, NBT-NS and MDNS, with many different functions.
Inveigh.ps1	Similar to Responder, a PowerShell tool for performing various network spoofing and poisoning attacks.
C# Inveigh (InveighZero)	C# version of Inveigh with a semi-interactive console for interacting with captured data such as username and password hashes.
rpcclient	Tool that can be used to perform a variety of Active Directory enumeration tasks via the remote RPC service.
CrackMapExec (CME)	CME is an enumeration, attack, and post-exploitation toolkit. CME attempts to “live off the land” and abuse built-in AD features and protocols such as SMB, WMI, WinRM, and MSSQL.
Rubeus	C# tool built for Kerberos Abuse.
GetUserSPNs.py	Impacket module geared towards finding Service Principal names tied to normal users. Useful for Kerberoasting attacks.
enum4linux-ng	Tool for enumerating information from Windows and Samba systems.
ldapsearch	Built in interface for interacting with the LDAP protocol.
windapsearch	A Python script used to enumerate AD users, groups, and computers using LDAP queries. Useful for automating custom LDAP queries.
DomainPasswordSpray.ps1	DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain.
LAPSToolkit	Tool to leverage PowerView to audit and attack Active Directory environments that have deployed Microsoft’s Local Administrator Password Solution (LAPS).
Snaffler	Tool for finding useful information and credentials in Active Directory on computers with accessible file shares.
setspn.exe	Reads, modifies, and deletes the Service Principal Names (SPN) directory property for an Active Directory service account. Useful for a targeted kerberoasting attack
secretsdump.py	Remotely dump SAM and LSA secrets from a host.
evil-winrm	Provides us with an interactive shell on host over the WinRM protocol.
mssqlclient.py	Part of Impacket toolset, it provides the ability to interact with MSSQL databases.
noPac.py	Exploit combo using CVE-2021-42278 and CVE-2021-42287 to impersonate Domain Admin from standard domain user.
ntlmrelayx.py	Part of the Impacket toolset, it performs SMB relay attacks.
gettgtpkinit.py	Tool for manipulating certificates and TGTs.
adidnsdump	A tool for enumeration and dumping of DNS records from a domain. Similar to performing a DNS Zone transfer.
gpp-decrypt	Extracts usernames and passwords from Group Policy preferences.
GetNPUsers.py	Attempt to list and get TGTs for those users that have the property ‘Do not require Kerberos preauthentication’ set.
lookupsid.py	SID bruteforcing tool.
ticketer.py	A tool for creation and customization of TGT/TGS tickets.
raiseChild.py	Part of the Impacket toolset, It is a tool for child to parent domain privilege escalation.
Active Directory Explorer	AD viewer and editor that can be used to navigate an AD database and view object properties and attributes. It can also be used to save a snapshot of an AD database for offline analysis.
PingCastle	Used for auditing the security level of an AD environment
Group3r	Group3r is useful for auditing and finding security misconfigurations in AD Group Policy Objects (GPO).
ADRecon	A tool used to extract various data from a target AD environment.
NetExec (nxc)	Maintained successor to CrackMapExec; SMB/LDAP/WinRM/MSSQL enumeration, spraying, `--ntds`, `--gen-relay-list`.
Certipy	ADCS enumeration and abuse (ESC1–ESC16), PKINIT authentication, shadow credentials.
Certify	Windows C# ADCS enumeration (`Certify.exe find /vulnerable`).
bloodyAD	ACL abuse from Linux: `add dacl`, `set owner`, `add rbcd`, `add shadowcred`.
Coercer	Automatically try every MS-RPC coercion method (PetitPotam, PrinterBug, DFSCoerce, …).
PKINITtools	`gettgtpkinit.py` / `getnthash.py` for certificate-based Kerberos authentication.