Advanced Windows Active Directory Penetration Testing

Explore the fundamentals and purpose of penetration testing, its role in robust cybersecurity, and the limitations, scoping, boundaries, logistics, and attack chains guiding Active Directory engagements.

Identify the limitations of penetration testing versus real attackers, including scope, time, access, client expectations, rules of engagement, tool usage, and unknown exploits.

Plan and document penetration testing logistics by outlining proposals, the statement of work scope, deliverables such as reports and executive summaries, service level agreement timing, engagement rules, and communication protocols.

Explore established cyber kill chains—Lockheed Martin, MITRE, and the unified cyber kill chain—and apply initial access, network propagation, privilege escalation, and domain dominance in a Windows Active Directory penetration test.

Define and justify penetration testing as a core element of organizational cyber security programs. Explore regulatory requirements, third-party contracts, leadership exposure, test limitations, and attack chain design in this module.

Explore how Active Directory Domain Services centralize resource management by treating every object—users, groups, devices, and policies—as entries with properties, governed by Kerberos authentication, single sign-on, and security descriptors.

Understand domain trust, linking two domains or forests via auto, manual, external, and ram trusts, using inter realm trust key with transitive and non-transitive, one-way and two-way directions.

Explore the high-level structure of Active Directory, including domains, forests, and organizational units, plus domain and forest trusts. Explain security descriptors and how permissions govern access, with Kerberos authentication.

Set up two forested Active Directory environments with a parent domain client.ad and a child domain child.client.ad, with domain controllers, to mimic a full Windows AD for Kali-targeted vulnerability testing.

Harvest usernames using osint from phone books and external sources to support both internal and external penetration tests, then extract usernames from email addresses with grep and kali linux workflows.

Explore username enumerations for active directory pentesting by merging default service accounts and OSINT-derived usernames to create a 23,000-entry target list for password spray campaigns.

Discover Active Directory domain services through DNS interrogation with Dig, identify the global catalog, LDAP and Kerberos services, and map associated ports for comprehensive AD DS enumeration.

Explore network mapping by using nslookup to locate ldap servers and domain controllers, including foreign domains, and compare with dig to verify findings using multiple tools for robust pen testing.

Label active network scan outputs for reporting, then target live hosts with deeper nmap scans, using script scans with version detection to identify low hanging fruit vulnerabilities.

Map networks and quickly capture screenshots of web applications with gowitness, aggregating hundreds of services into a dashboard for rapid identification of targets and potential initial access vectors.

Learn how password spraying gains initial access by testing a single password against many accounts, and why Kerberos is faster and quieter than SMB.

Analyze SMB and Kerberos password spray traffic with Wireshark, comparing pre-auth checks and traffic patterns between Kali Linux and a domain controller.

Explores password spray testing with kerbrute and the curb route tool, testing a user list, revealing valid credentials, caching a Kerberos ticket, and verifying findings on the domain controller.

Enumerate Active Directory users with netexec, Impacket-GetADUsers, and ldapsearch, then assemble a valid user list to drive a password spray test in a controlled environment.

Demonstrate abusing NBNS/LLMR with responder to capture NTLM hashes from simulated users, then parse and crack them with hashcat using rules in a lab.

Configure responder to exclude the lab host and specific IP addresses to reduce noise, then run the tool with IPv4 and IPv6 exclusions to capture two hashes from target machines.

Crack responder password hashes with hashcat to recover a user credential, illustrating a realistic scenario where only one of two hashes is cracked, including a domain admin hash.

Demonstrates an AS-REP roasting attack using Impacket to harvest a domain's user hashes without authentication, then crack them offline with Hashcat using rockyou and rules.

Demonstrates cracking AS-REP roasting hashes with Hashcat to recover a user password in a Windows active directory environment. The demonstration highlights credential exposure and security implications.

Explore initial access in Active Directory by collecting usernames, performing Kerberos spray and password spray, mapping the network, and abusing Nbns, Llmnr, and AS-REP roasting to establish footholds.

Enumerate a windows active directory environment with netsec to query ldap, map domain trusts, identify shares, groups and user sessions, and audit antivirus and domain join configurations.

Netsec enumerates vulnerabilities, testing zerologon and peripartum against a domain controller, assesses patch status, and reviews GitHub guidance for potential exploits.

Start Bloodhound with docker compose, expose it to the network, and monitor Kali’s performance; allocate more RAM if it lags, and reboot Kali if it freezes.

Perform a kerberoast-based kerberos attack to extract service ticket data, analyze tickets with Wireshark, crack hashes with Hashcat, and verify local admin privileges via net exec.

Explain how unconstrained delegation enables a server to impersonate users using their TGT stored in LSASS, allowing access to any resources and risking a domain admin account.

Explore how unconstrained delegation enables privilege escalation by abusing Kerberos tickets, performing a pass-the-ticket attack, and using tools like net exec and WMI over RDP.

Exploit a constrained delegation misconfiguration to escalate from local admin to domain admin by extracting computer account hashes, forging Kerberos tickets, and dumping NTDS hashes, then cracking them.

Explore resource-based constrained delegation in active directory, where the resource controls who can delegate to it. The msds attribute defines who may act on behalf, enabling computer takeover.

Learn to escalate privileges in Windows Active Directory through resource-based constrained delegation. Build a fake computer, join the domain, and impersonate a privileged user to access the domain controller.

Explore lateral movement after privilege escalation, pivoting between systems using tools and built-in utilities like PowerShell, CMD, RDP, and Sysinternals to reach domain admins or segregated networks.

Leverage a NT hash to perform pass the hash via Kerberos, request TGT from KDC, export the credential cache, and use PS exec for remote code execution with admin access.

Explore domain dominance from compromising a child domain to escalating privileges at the domain level, reaching forests and external domains, while addressing escalation and lateral movement in cyclical attacks.

Forge a golden ticket to persist in a compromised Active Directory using the TGT key or NTLM hash, while navigating 2021 set filtering that requires an existing, matching domain user.

Learn silver ticket attacks, a Kerberos based persistence method for single-host access that avoids domain controller footprints by forging a tgs with a service or computer account hash.

Persist on a Windows domain using a silver ticket attack crafted from a computer account's NT hash, targeting an SPN, exporting the ticket, and testing with PsExec.

Demonstrates persistence using a diamond ticket attack to impersonate a domain admin, export and use a forged ticket, and maintain access via ps exec on the target domain.

Explore persistence via the diamond ticket attack by impersonating a low-privileged domain user to access a domain controller, demonstrating long-lasting access.

Explore sapphire tickets and how they modify the member, diamond tickets that change group membership, elevating privileges to compromise the domain controller and evade detection unlike golden and silver tickets.

Explore how ad objects with foreign domain memberships create cross-domain links, using BloodHound to map compromised domains to forest domains and identify access paths.

Explore group membership and outbound object control within the forest domain, revealing how a group can influence the domain controller in advanced windows active directory penetration testing.

Explore domain trust abuse via foreign group membership to foothold a forest domain. Gain local admin on a workstation and attempt credential dumping using NT hashes and cleartext credentials.

Demonstrate domain trust abuse via unconstrained delegation, enumerating LDAP and misconfigurations to escalate from a child domain to enterprise admin across the forest domain using Kerberos tickets.

Become an effective pen tester by credential hunting to uncover credentials, like a 'your eyes only' file, then leverage valid credentials to hop into the foreign domain.

Credential hunting II trains pentesters to search AD object descriptions for passwords, using net exec to query the domain controller and uncover credentials amid large user bases.

We verify that credentials are valid by spraying the chemo social user's credentials across the subnet to test access. Although the credential is valid, it lacks privileges on any domain.

Demonstrate ACL enumerations with Bloodhound, uncovering misconfigurations and long attack chains from users to domain compromise, with OS-specific commands, change-password guidance, and OpSec considerations.

Explore abusing access control lists to perform a force change password attack, demonstrated by altering a user's password on a domain controller and validating the new credentials.

Demonstrates using valid credentials to execute a generic right for Kerberos attack, with SPN targeting, TGS, and shadow credential techniques. Illustrates offline hash cracking to obtain empty hashes and certificates.

Explore how attackers abuse ACLs through WriteDACL to escalate privileges in Windows Active Directory, gaining full control over a target user and enabling shadow credential attacks to extract NT hashes.

Demonstrates an attack adding a user to a group using LDAP authentication with Julius Nyerere's NT hash, leveraging the names of the user and Berbers group to join Berbers group.

Explore how misconfigured Active Directory Certificate Services enable domain escalation, persistence, and certificate theft, and follow the certificate lifecycle from client requests to Enterprise CA issuance, templates, and OID policies.

Identify isc2 certificate template vulnerabilities by analyzing enrollment rights for low privileged users, permissive permissions, missing manager approvals and signatures, and purpose set to true for sc2/sc3, false for sc1.

Certificate template vulnerability arises when an AD object holds dangerous permissions and full control over the certificate template, enabling exploitation.

Explore set hopping and golden ticket attacks across forest trust, detailing patches, set filtering, and the requirements: custom high-privilege groups with a rate over 1000 for cross-forest impersonation.

Explore cross-forest trust abuse using the golden ticket attack to simulate attacker access across domains, including compromised client and foreign domains, and privilege escalation within an active directory environment.

Walk through a sample internal penetration test report for an advanced Windows Active Directory engagement, detailing executive summary, attack kill chain, operations narrative, and technical findings.

Conduct a debrief with the pen testing team and stakeholders to review findings, discuss remediation plans, and define SLA timelines for critical, high, medium, and low findings.

Document the closure phase of a penetration test by detailing the work performed and attack vectors, share with stakeholders for review and debrief, and plan remediation or retest.