Posts on: Active-Directory

---

After gaining access to the network segment where the AD environment resides — often through pivoting from a previously compromised host — the goal is to find the Domain Controller, enumerate the domain without credentials if possible, and convert unauthenticated reconnaissance into a valid credential or session. The techniques below are ordered roughly by noise level and prerequisite: unauthenticated enumeration first, then poisoning and relay, then credential-based spraying, then modern coercion/relay chains that bypass SMB signing entirely.

After finding valid credentials for the Active Directory environment, the objective is to compromise the entire forest. That means moving laterally between users and machines until you hold privileged access to a domain controller — and in 2026, that path is more often a chain of misconfigurations and coercion primitives than a single exploit. This page covers the enumeration that finds those paths, the tooling that maps them, and the lateral-movement techniques that traverse them.

How NTLM Relay Works NTLM authentication is challenge-response: the server sends a challenge, the client answers with a hash of the challenge using its password hash. An attacker who can position themselves between client and server can forward the challenge/response to a different service and authenticate as the victim — without cracking anything. The attack has two halves: Coerce or poison a victim into authenticating to you (LLMNR/NBT-NS/mDNS poisoning, or a coercion RPC call). Relay that authentication to a target service where the victim’s account has rights. Relay succeeds only when the target does not require signing or channel binding. Check this before spending time: SMB signing must be not required, LDAP signing and LDAP channel binding must be off, and for HTTPS enrollment the CA Web Enrollment endpoint must accept NTLM. But — 2025–2026 research changed this assumption. Drop the MIC and CVE-2025-54918 strip the protections that were supposed to block relay even when signing is enforced.

Delegation lets a service act on behalf of a user to reach another service. Misconfigured delegation remains one of the most direct paths to Domain Admin: if you control a service trusted for delegation, you can impersonate any user — including administrators — to the delegated resource. The three classic models still define the attack surface, but 2025–2026 added new primitives around coercion-to-relay-to-RBCD, cross-forest RBCD, and SPN-collision attacks (KerberLoss) that change how you approach a modern environment.

Active Directory Certificate Services (ADCS) issues certificates that can be used for Kerberos PKINIT authentication. A misconfigured template or CA lets a low-privileged user obtain a certificate as another user — often a Domain Admin or a domain controller — and authenticate with it, no password cracking required. Certificate-based auth survives password resets, and it is frequently out of scope for MFA and Conditional Access policies, which is why AD CS paths are disproportionately valuable for persistence as well as escalation.

The three vulnerabilities below — NoPac, PrintNightmare, and PetitPotam — are still worth knowing, but their role has shifted. On a fully patched 2025–2026 domain, all three are usually closed. What remains is the attack primitive each one demonstrated, and that primitive is now delivered through modern tooling: NetExec modules for NoPac, detection-resistant coercion for PetitPotam, and the coercion → NTLM relay → ADCS/RBCD chain that survives patch cycles because it abuses configuration, not a missing update.

A trust establishes forest or intra-forest domain (parent-child / tree-root) authentication, allowing users to access resources in — or perform administrative tasks in — another domain outside the one where their account resides. A trust creates a link between the authentication systems of two domains and may allow one-way or two-way (bidirectional) communication. The single most important idea in 2026 is that the forest, not the domain, is the security boundary . Within a forest, SID filtering is off by default, which means control of one domain frequently means a path to the entire forest. Cross-forest, the boundary is real but not absolute — a weak SpoofSIDHistoryBlocked configuration or the trust key collapses it.

The AD half of the OSCP-like HTB list — one path per box, the step that actually decides it, and the exact command worth memorising. These are edge-case notes, not walkthroughs: every IP, domain, user and path must be adapted to your target, and the linked writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Assumed breach vs unauthenticated. Only five boxes hand you credentials at the start — Administrator (olivia:ichliebedich), Certified (judith.mader:judith09), EscapeTwo (rose:KxEPkKe6R8su), Puppy (levi.james:KingofAkron2025!) and Signed (scott:Sm230#C5NatH). For those, the first ten minutes are --shares, BloodHound, certipy find and per-service auth checks — not brute force. Everything else starts with null SMB/RPC, a web bug, or a share. BloodHound before exploitation. Collect with bloodhound-python -c all --zip (or bloodhound-ce-python) and read the Abuse Info of each edge; rights on the domain node show up as GetChanges/GetChangesAll, not as an edge called “DCSync” (Sauna). Every found secret is a reuse test. Fan out nxc smb/ldap/winrm/mssql/ftp with --continue-on-success; a service that fails is not the service that matters (Return: WinRM but no SMB admin; Administrator: FTP but no WinRM for benjamin). Try the actual account name when a config spells it differently (Sauna). ADCS, delegation and time. None of Active/Forest/Sauna/Flight/Return/Blackfield/Cicada/TheFrizz/Administrator/Monteverde exposes a CA — do not burn exam minutes on Certipy there. The ESC paths live in Escape (ESC1), EscapeTwo (ESC4→ESC1) and Certified (ESC9). Clock skew is the single most common time sink: sudo ntpdate <dc fqdn>, expect the VPN to drop, reconnect — but note that AS-REP roasting tolerates hours of skew (Sauna). At-a-glance Box Start Entry technique Key escalation Difficulty Active Unauthenticated GPP cpassword in DFS-R share Kerberoast Administrator Easy Forest Unauthenticated Null RPC → AS-REP WriteDacl → DCSync Easy Sauna Unauthenticated Kerbrute → AS-REP AutoLogon → GetChanges/GetChangesAll Easy Flight Unauthenticated PHP LFI → UNC → NetNTLMv2 Machine TGT (tgtdeleg) → DCSync Hard Return Unauthenticated Printer panel → LDAP cleartext Server Operators sc config Easy Blackfield Unauthenticated Profiles share → AS-REP ForceChangePassword → LSASS → SeBackup Hard Cicada Unauthenticated Guest SMB → HR share → RID brute LDAP description → Backup Operators Easy TheFrizz Unauthenticated Gibbon LMS CVE-2023-45878 Kerberos SSH → GPO abuse Medium Administrator Assumed breach BloodHound ACL chain GenericAll → FTP psafe3 → targeted Kerberoast Medium Monteverde Unauthenticated RPC querydispinfo → spray ADSync LocalDB + mcrypt Medium Escape Unauthenticated SMB PDF → MSSQL Coerce → ESC1 Medium EscapeTwo Assumed breach xlsx → MSSQL sa WriteOwner → shadow creds → ESC4→ESC1 Medium Certified Assumed breach WriteOwner Management group Shadow creds ×2 → ESC9 Medium Puppy Assumed breach HR group → GenericWrite Developers KeePassXC → GenericAll → DPAPI Medium Timelapse Unauthenticated winrm_backup.zip → pfx Certificate WinRM → LAPS Easy Signed Assumed breach SQL login scott Silver ticket → OPENROWSET Medium Active Path: Anonymous SMB on the DFS-R Replication share → Groups.xml cpassword → gpp-decrypt → svc_tgs → Kerberoast (SPN owned by Administrator) → psexec.