Capstone CTF: Full AD Attack Chain
Chain Kerberoasting, DCSync, and Golden Ticket into one escalation path, and learn exactly where in that chain defenders get the cheapest, highest-leverage stop.
Learning Objectives
- → Chain three real AD attack techniques into a single escalation path
- → Explain what each technique requires as a prerequisite, and why the order matters
- → Explain why a Golden Ticket represents near-total and long-lived domain compromise
- → Identify the specific detection opportunity at each stage of the chain
- → Explain why defenders must break the chain early, before later stages become exponentially harder to remediate
Why Chain Techniques Instead of Using Them in Isolation
"Active Directory Attacks" introduced Kerberoasting, DCSync, and Golden Ticket attacks individually. In a real assessment (or a real breach), these rarely happen alone — they chain together, each one unlocking the prerequisite for the next, escalating from "a foothold with one low-privilege service account" to "persistent, undetectable domain compromise."
The Three-Stage Chain
| Stage | Technique | What it requires | What it produces |
|---|---|---|---|
| 1 | Kerberoasting | Any authenticated domain account (even low-privilege) | Crackable Kerberos service-ticket hashes for accounts with an SPN |
| 2 | DCSync | Replication rights on a compromised account (often obtained via Stage 1's cracked service account, if over-privileged) | The KRBTGT account's password hash, plus any other account's hash |
| 3 | Golden Ticket | The KRBTGT hash from Stage 2 | A forged Kerberos TGT valid for (by default) 10 years, granting domain admin on demand |
Stage 1: Kerberoasting
Any authenticated domain user can request a Kerberos service ticket (TGS) for any account with a Service Principal Name (SPN) set — and that ticket is encrypted with the service account's own password hash. Request tickets for every SPN-bearing account, then crack them offline against a wordlist. Service accounts are frequently configured with old, weak, never-rotated passwords, making this the classic entry point.
Stage 2: DCSync
If a cracked service account (or any compromised account) has been granted Replicating Directory Changes and Replicating Directory Changes All rights — often accidentally, via an overly broad group membership — an attacker can impersonate a domain controller and request replication of any account's password hash directly. The prize target: the KRBTGT account, whose hash is the key to Stage 3.
Stage 3: Golden Ticket
With the KRBTGT hash in hand, an attacker forges a Kerberos TGT for any user (including one that doesn't exist) with any group memberships (including Domain Admins) — entirely offline, no further contact with a DC required to create it. By default, a forged TGT is valid for 10 years and survives a targeted user's password reset, since KRBTGT — not the impersonated user's password — is what validates it. This is why Golden Ticket attacks are considered near-total, long-lived domain compromise.
Detection Opportunities at Each Stage
| Stage | Detection opportunity |
|---|---|
| Kerberoasting | A burst of TGS requests for many different SPNs from one account in a short window (unusual for normal user behavior) |
| DCSync | Replication requests from a machine that isn't a real domain controller — most SIEMs can flag Directory Service Access events (Event ID 4662) from non-DC sources |
| Golden Ticket | Kerberos tickets with anomalously long lifetimes, or TGTs for accounts that have since been disabled/deleted |
Each stage is progressively harder to detect and remediate than the last — which is exactly why breaking the chain at Stage 1 (rotating service account passwords, removing unnecessary SPNs, restricting replication rights) is vastly cheaper than responding after Stage 3.
Why Defenders Must Break the Chain Early
Once an attacker reaches Stage 3, remediation isn't a password reset — the entire KRBTGT account's password (and its history, twice, due to how the key derivation works) must be reset, invalidating every Kerberos ticket domain-wide, a disruptive, all-hands operation. Compare that to Stage 1's fix: rotate a handful of service account passwords. This asymmetry is the core argument for detection engineering (see the earlier lesson) focused on early-stage indicators, not just the final compromise.
Common Pitfalls
- Treating each AD attack technique as an isolated skill rather than understanding how they chain
- Assuming a least-privilege service account fully mitigates Kerberoasting — a crackable weak password is still crackable, no matter how few permissions the account has, if replication rights were separately misconfigured elsewhere
- Underestimating how "permanent" a Golden Ticket is until the actual, disruptive KRBTGT reset is required to fully evict it
DCSync typically requires a compromised account with replication rights, which in this chain came from cracking a Kerberoasted service account first.
Which stage must succeed before DCSync becomes possible, in the classic three-stage chain?
One specific account's hash is what unlocks Golden Ticket forgery — it's the whole reason DCSync is the middle stage of this chain.
Which specific account's password hash is the actual target of a DCSync attack in this chain?
Remediation cost rises sharply at each stage of this chain — the earliest stage is by far the cheapest to fix.
Why is Stage 1 (Kerberoasting) the cheapest point in the chain for defenders to break?
💪 Exercises & Challenges
Capstone CTF: Full AD Attack Chain MCQ
Test your understanding of Capstone CTF: Full AD Attack Chain.
Write the Attack Chain Timeline for a Pentest Report
You successfully chained Kerberoasting -> DCSync -> Golden Ticket during an authorized assessment. Write the executive-summary-style timeline entry (3-5 sentences) explaining the chain in business ter
Break the Chain at Two Independent Points
During an authorized internal assessment you obtain a foothold as a low-privilege domain user. Over the course of the engagement: 1. You Kerberoast the domain and crack the service account 'svc-sql'