Active Directory RedTeam Engagement & Lab Setup

Name: Active Directory RedTeam Engagement & Lab Setup
Rating: 4.3 (35 reviews)

Learn How to Build And Attack Advanced Active Directory RedTeam Penetration Testing Lab

Created byMuhammad Sada

Last updated 6/2024

English

English [Auto],

What you'll learn

Student will learn how to build active directory lab create forests and trust between forests
Learn how to enumerate information from Active Directory, including users, groups, computers, and trust relationships. Understand the importance of information
Learn how to abuse some active directory intended functionality to established foothold and escalate privilege
Identify common attack vectors in Active Directory, such as misconfigurations, weak passwords, and insecure group memberships. Understand how attackers exploit
Understand the importance of reconnaissance in penetration testing. Learn to use tools for AD reconnaissance, such as BloodHound and PowerView.
Explore common vulnerabilities in Active Directory, such as pass-the-hash attacks, Kerberoasting, and DCSync attacks.
Understand post-exploitation activities, including lateral movement and privilege escalation.
Understand the concept of trusts in Active Directory and how they can be exploited
Learn about common trust-based attacks, such as Golden Ticket attacks.

Course content

11 sections • 53 lectures • 14h 41m total length

Introduction to Active Directory7:16
Learn how Active Directory provides management of users, groups, and resources, and how to enumerate a Windows environment using the Active Directory PowerShell module and RSAT in red team context.
Lab Setup Overview3:26
Set up a live lab featuring a domain controller, parent and child domains, a client and a web server on a flat network, with Windows Server 2008 hosting Metasploitable 3.

Creating VMs and Downloading Evaluation Copies of Windows Servers and Clients20:01
Create a lab environment by building an Active Directory setup with domain controllers, a Windows 10 client, Windows servers, using VirtualBox and Kali Linux, and download Microsoft evaluation copies.
Installing Windows Server 2019 as root Domain11:16
Install Windows Server and set up a root domain controller, configure the administrator password, join the network, and prepare Active Directory domain services for promotion to a domain controller.
Installing AD-DS on ROOT-DC014:48
Install active directory domain services on ROOT-DC01, promote it to a domain controller for a new forest with the domain bare shelled, and set the domain services recovery mode password.
Installing and Configuring Sql Server on ROOT-DC0124:23
Install and configure SQL Server on root-dc01, including SQL Server Developer Edition, disable Windows Defender for lab enumeration, and set up TCP/IP 1433 for remote access.
Installing and Configuring the Child Domain20:52
Install and configure a child domain by promoting a domain controller in the root domain, using VirtualBox, static IP, and DNS forwarders.
Installing TRUSTED-DC03 for Forest Trust17:58
Install trusted-dc03 to establish a forest trust between domains and promote it to a domain controller, ensuring full connectivity and correct domain name configuration.
Installing and Configuring Sql Server on TRUSTED-DC0313:18
Install and configure SQL Server on trusted-dc03, set up SQL Server Management Studio, enable mixed-mode authentication, configure TCP/IP for remote access, and restart services to make the server accessible remotely.
Installing and Configuring WIndows 10 Client Machine21:37
Install a Windows 10 client, configure network and DNS to the domain controller, create a domain user, and join the client to the domain for domain login.
Building Metasploitable3 on Windows Server 20088:44
Build metasploitable3 on Windows Server 2008 by following the GitHub instructions, downloading dependencies (VirtualBox, backgrounds, plugins), and running the Buildid.ps1 script to complete the setup.
Configuring Trust Relationship between Forests13:50
Configure a forest trust between two domains, establishing a two-way transitive trust with forest wide authentication, then verify the trust using the Active Directory PowerShell module.
Creating Domain Users32:23
Create domain users in Active Directory using the users and computers tool, setting passwords that never expire and SPNs for service accounts. Prepare delegation and cross-domain trust for multi-domain access.
Creating Groups and GPO15:48
Create groups and assign members, then configure group policy objects to enable remote desktop access and enforce restricted groups and resource-based delegation on the file server.
Foreign Group Membership Configuration7:42
Configure foreign group membership in Active Directory by adding trusted-domain members to building administrators. Leverage GPOs and restricted groups for cross-domain policy management to enforce these memberships.
Creating Mssql Server logins, Databases and login Impersonation14:13
Set up service principle name for an unsecured server, configure SQL server logins and single and nested impersonation, then create a trustworthy database to illustrate privilege escalation to sysadmin.

DC Enumeration with RSAT10:05
Enumerate the domain with RSAT using the PowerShell Active Directory module. Query domain controllers, identify the domain, forest, and operating system details to plan privilege escalation strategy.
Domain Users Enumeration with RSAT9:58
Explore domain user enumeration with RSAT using Get-ADUser, filters, and properties to reveal user details. Filter by description and properties such as password never expires to surface relevant details.
Domain Groups Enumeration with RSAT8:57
Learn to enumerate domain groups in Active Directory using RSAT and PowerShell, exploring Get-ADGroup, SamAccountName, group members, and nested groups for red-team engagements.
Domain Computers Enumeration with RSAT7:47
Enumerate domain computers using the Active Directory PowerShell module (RSAT) to list name, operating system, version, service pack, hotfixes, and IP addresses with filters and clean output.
Trusts Enumeration with RSAT4:09
Learn to enumerate forest and domain trusts with rsat, identifying bidirectional and transitive relationships between child and root domains and cross-forest trusts, and examining trusted domains.

Getting PowerView3:30
Download PowerView from GitHub as part of PowerSploit to enable red and blue teams to gain situational awareness in Windows Active Directory, using PowerShell to enumerate and exploit AD.
DC Enumeration with PowerView5:35
Learn to import the PowerView PowerShell module, query the current domain and domain controllers, and enumerate domain users for red-team lab reconnaissance using PowerView.
Domain Users Enumeration with PowerView28:24
Enumerate domain users with PowerView to identify admin rights, group memberships, and Kerberos SPN and pre-auth findings, and assess domain policy and password settings.
Domain Groups Enumeration with PowerView12:30
Explore domain group enumeration with PowerView, filtering results by account names, identifying protected and nested groups, and inspecting members and object classes to reveal nested admin group structures.
Domain Computers Enumeration with PowerView11:04
Enumerate domain computers with powerview using get domain computer, filter by operating system, identify live systems, and explore constrained and unconstrained delegation for delegation trust.
Trusts Enumeration with PowerView14:57
Enumerate forest trusts and cross-forest relationships with PowerView to map forest transitive trusts and trust directions, then identify cross-forest attack paths via foreign users and groups to plan privilege escalation.

Hunting for User's local admin right16:03
Identify local admin access on Windows Server 2008 R2 hosts, remote into them, and use Mimikatz and crackmapexec to dump credentials and escalate to local and domain admin privileges.
Exploiting mssql server impersonation to Escalate local Privilege34:07
Demonstrates exploiting mssql server impersonation to escalate from a local user to a sysadmin, via enumeration, impersonate login, execute as, xp_cmdshell, and persistence.

Kerberoasting with Rubeus7:36
Explore kerberoasting with Rubeus by requesting service tickets offline, cracking service account hashes with hashcat, and extracting cleartext passwords, then prepare for credential-based lateral movement.
DCSYNC17:35
Discover how to leverage domain admin credentials to perform DCSync from a domain controller, using PowerShell sessions and Mimikatz to dump hashes in a lab.
Kerberos Unconstrained Delegation - Rubeus26:14
Explore Kerberos unconstrained delegation and learn how to use Rubeus in monitor mode to dump and pass tickets for privilege escalation in a lab domain.
Kerberos Unconstrained Delegation - PrinterBug10:46
Explore kerberos unconstrained delegation via a printer bug, using exploit sample to capture domain controller tickets and pass them into the current session for red team lab scenarios.
Kerberos Constrained Delegation20:16
Learn how Kerberos constrained delegation restricts impersonation and how attackers exploit it to escalate privileges using domain credentials and Mimikatz.
Resource-Based Constrained Delegation Part 127:10
Explore resource-based delegation in Active Directory, learning to grant access on behalf of other identities using security descriptors, Kerberos tickets, and RB CD, with lab steps to simulate attack.
Resource-Based Constrained Delegation Part 228:50
Explore resource-based constrained delegation in active directory by creating scripts, applying them to a computer, impersonating a domain admin, and using hashes and tickets to move laterally.
Domain Privilege Escalation with Inveigh15:37
Demonstrate domain privilege escalation using link-local multicast name resolution and the embed tool to capture nbns and mdns traffic, then offline crack the hashes and simulate the attack.
Domain Privilege Escalation – Bruteforcing Mssql Server17:31
Exploit MS SQL Server to achieve domain privilege escalation by enumerating instances and dumping credentials for offline cracking, using PowerShell to impersonate and escalate to domain admin.
Domain Privilege Escalation - Trustworthy Databases Part 15:50
Explore how trustworthy databases on MS SQL enable privilege escalation from db_owner to sysadmin via execute as when a system-owned database is trusted.
Domain Privilege Escalation - Trustworthy Databases Part 214:09
Demonstrate escalating privileges from a trusted database owner to the SQL server sysadmin, using tools like sql recon and xp_cmdshell to achieve a system-level reverse shell.

Enumerating Cross-Forest Users and Groups12:31
Enumerate cross-forest trusts and identify domain users, admin rights, and service principal names to plan targeted access, using PowerShell to query trusts and enumerate accounts.
Cross-Forest ASRepRoasting10:54
Explore cross-forest AS-REP roasting, a Kerberos attack that uses a standard user's credentials to obtain a service ticket from the KDC, crack offline passwords with hashcat, and access domain data.
Cross-Forest Kerberoasting27:05
Cross-forest kerberoasting enables privilege escalation by cracking offline tickets across forest trusts, enumerating service principal names, and targeting enterprise admin access.
ACL Attack Chain51:50
Explore an acl attack chain in Active Directory, tracing attack paths from delegated control over organizational units to password resets, credential dumping with Mimikatz, and domain privilege escalation.
Foreign Group Membership Attack26:22
Explore foreign group membership to escalate privileges in a domain, leveraging foreign forest admins, Mimikatz, and golden tickets to obtain system access.

Password Spray Admin Password reuse case16:25
Explains a domain trust abuse scenario in a parent-child Active Directory setup and demonstrates password spray to escalate from a standard user to domain admin and enterprise admin.
DA to EA ExtraSIDs Attack45:55
Explores an active directory red-team engagement using the extrasids attack, covering credential dumping with Mimikatz, seeding a child domain, enterprise admins, and pass-the-ticket techniques to reach the domain controller.

Requirements

Basic knowledge of Ethical Hacking
Willingness to Learn
Computer with minimum of 16 of RAM and 300 GB of HDD space corei5

Description

Understanding Windows Active Directory is an invaluable skill for security professionals for several compelling reasons

1 Critical Infrastructure: Active Directory is a critical component in most Windows-based networks, serving as the backbone for authentication, authorization, and resource management. Penetrating Active Directory can lead to unauthorized access to sensitive information, making it a prime target for attackers. Understanding how to test and secure it is essential for protecting overall network security.

2 Common Attack Vector: Active Directory is a common target for attackers attempting to compromise an organization's network. Knowing how to conduct penetration testing allows security professionals to identify and address vulnerabilities before malicious actors can exploit them.

3 Risk Mitigation: By proactively testing Active Directory, security professionals can identify and mitigate potential risks and vulnerabilities. This proactive approach is essential for preventing security incidents and data breaches.

4 Career Advancement: For individuals pursuing a career in cybersecurity, having expertise in Active Directory penetration testing is a valuable skill. Employers often seek professionals who can assess and enhance the security of critical infrastructure components like Active Directory.

Red Team Operations: Active Directory penetration testing is a fundamental skill for red team operations. Red teams simulate real-world attacks to test an organization's defenses, and a strong understanding of Active Directory is essential for effective red teaming.

In summary, learning Active Directory penetration testing is important for enhancing cybersecurity, preventing unauthorized access, meeting compliance requirements, and staying ahead of evolving cyber threats. It equips security professionals with the skills needed to protect critical IT infrastructure and respond effectively to security challenges.

Who this course is for:

Students who want tp become an Active Directory Pentesting Expert
Student Intending to sit for OSCP Exam
Students who want to know how build and Exploit Active Directory Lab

Active Directory RedTeam Engagement & Lab Setup

What you'll learn

Explore related topics

Course content

Introduction2 lectures • 11min

Lab Setup14 lectures • 3hr 47min

Tools Installation1 lecture • 10min

Enumeration Using RSAT5 lectures • 41min

Enumeration Using PowerView6 lectures • 1hr 16min

BloodHound1 lecture • 18min

Local Privilege Escalation2 lectures • 50min

Domain Privilege Escalation11 lectures • 3hr 12min

Cross-Forest Trust Attack5 lectures • 2hr 9min

Domain Trusts - Child -> Parent Trusts2 lectures • 1hr 2min

Requirements

Description

Who this course is for: