Advanced Windows Active Directory Penetration Testing

Explore the fundamentals and purpose of penetration testing, its role in robust cybersecurity, and the limitations, scoping, boundaries, logistics, and attack chains guiding Active Directory engagements.

Perform penetration testing to identify vulnerabilities before attackers by discovering attack surfaces and implementing defense mechanisms, while meeting regulatory and contract requirements and strengthening security culture.

Identify the limitations of penetration testing versus real attackers, including scope, time, access, client expectations, rules of engagement, tool usage, and unknown exploits.

Plan and document penetration testing logistics by outlining proposals, the statement of work scope, deliverables such as reports and executive summaries, service level agreement timing, engagement rules, and communication protocols.

Explore established cyber kill chains—Lockheed Martin, MITRE, and the unified cyber kill chain—and apply initial access, network propagation, privilege escalation, and domain dominance in a Windows Active Directory penetration test.

Define and justify penetration testing as a core element of organizational cyber security programs. Explore regulatory requirements, third-party contracts, leadership exposure, test limitations, and attack chain design in this module.

Explore the fundamentals of Windows Active Directory, including domains, forests, organizational units, and trust relationships, and learn how to create and manage user access with Kerberos authentication.

Explore how Active Directory Domain Services centralize resource management by treating every object—users, groups, devices, and policies—as entries with properties, governed by Kerberos authentication, single sign-on, and security descriptors.

Understand domain trust, linking two domains or forests via auto, manual, external, and ram trusts, using inter realm trust key with transitive and non-transitive, one-way and two-way directions.

Demonstrates how Kerberos authentication uses a key distribution center to issue TGTs and service tickets (TGS) for rapid, mutual authentication and single sign-on within Active Directory.

Explore the high-level structure of Active Directory, including domains, forests, and organizational units, plus domain and forest trusts. Explain security descriptors and how permissions govern access, with Kerberos authentication.

Set up two forested Active Directory environments with a parent domain client.ad and a child domain child.client.ad, with domain controllers, to mimic a full Windows AD for Kali-targeted vulnerability testing.

Examine a simple Active Directory lab topology, starting with Kali Linux in the child domain, and learn how bidirectional and transitive trusts—from child to forest to external forest—enable domain compromise.

Install Chocolatey on Windows 11 host via an admin PowerShell session, then install Git, Vagrant, VirtualBox, VSCode, and Python with Chocolatey, and reboot to complete lab host setup.

Set up Kali Linux for a pentest by creating a client directory, snapshotting VMs, and ensuring adequate memory. Tools reside in /opt, with an immutable resolv.conf and backup Kali config.

Navigate sources for email discovery, noting phone books are now paid while using hunter.io with login requirements and limits; combine cross links to infer the username convention for target domains.

Harvest usernames using osint from phone books and external sources to support both internal and external penetration tests, then extract usernames from email addresses with grep and kali linux workflows.

Explore username enumerations for active directory pentesting by merging default service accounts and OSINT-derived usernames to create a 23,000-entry target list for password spray campaigns.

Discover Active Directory domain services through DNS interrogation with Dig, identify the global catalog, LDAP and Kerberos services, and map associated ports for comprehensive AD DS enumeration.

Learn to map networks by enumerating SMB and NetBIOS services with net exec and nbtscan, discovering domain controllers and workstations to identify initial access opportunities.

Explore network mapping by using nslookup to locate ldap servers and domain controllers, including foreign domains, and compare with dig to verify findings using multiple tools for robust pen testing.

Label active network scan outputs for reporting, then target live hosts with deeper nmap scans, using script scans with version detection to identify low hanging fruit vulnerabilities.

Map networks and quickly capture screenshots of web applications with gowitness, aggregating hundreds of services into a dashboard for rapid identification of targets and potential initial access vectors.

Map targets by collecting SMB service hosts from scans, saving IPs to SMB dot targets for initial access, and review Go Witness screenshots to focus on web applications of interest.

Learn how password spraying gains initial access by testing a single password against many accounts, and why Kerberos is faster and quieter than SMB.

Analyze SMB and Kerberos password spray traffic with Wireshark, comparing pre-auth checks and traffic patterns between Kali Linux and a domain controller.

Explores password spray testing with kerbrute and the curb route tool, testing a user list, revealing valid credentials, caching a Kerberos ticket, and verifying findings on the domain controller.

Test valid credentials against the entire subnet to detect local admin privileges on any system, refine net exec checks, and evaluate access potential across the domain.

Enumerate Active Directory users with netexec, Impacket-GetADUsers, and ldapsearch, then assemble a valid user list to drive a password spray test in a controlled environment.

Demonstrate abusing NBNS/LLMR with responder to capture NTLM hashes from simulated users, then parse and crack them with hashcat using rules in a lab.

Configure responder to exclude the lab host and specific IP addresses to reduce noise, then run the tool with IPv4 and IPv6 exclusions to capture two hashes from target machines.

Crack responder password hashes with hashcat to recover a user credential, illustrating a realistic scenario where only one of two hashes is cracked, including a domain admin hash.

Demonstrates an AS-REP roasting attack using Impacket to harvest a domain's user hashes without authentication, then crack them offline with Hashcat using rockyou and rules.

Demonstrates cracking AS-REP roasting hashes with Hashcat to recover a user password in a Windows active directory environment. The demonstration highlights credential exposure and security implications.

Explore initial access in Active Directory by collecting usernames, performing Kerberos spray and password spray, mapping the network, and abusing Nbns, Llmnr, and AS-REP roasting to establish footholds.

Enumerate a windows active directory environment with netsec to query ldap, map domain trusts, identify shares, groups and user sessions, and audit antivirus and domain join configurations.

Netsec enumerates vulnerabilities, testing zerologon and peripartum against a domain controller, assesses patch status, and reviews GitHub guidance for potential exploits.

Start Bloodhound with docker compose, expose it to the network, and monitor Kali’s performance; allocate more RAM if it lags, and reboot Kali if it freezes.

Analyze BloodHound data to map attack paths, enumerate domain users, groups, and computers with built-in searches and Cypher queries, and identify high-value targets, ACLs, and domain trusts.

Perform a kerberoast-based kerberos attack to extract service ticket data, analyze tickets with Wireshark, crack hashes with Hashcat, and verify local admin privileges via net exec.

Explain how unconstrained delegation enables a server to impersonate users using their TGT stored in LSASS, allowing access to any resources and risking a domain admin account.

Explore how unconstrained delegation enables privilege escalation by abusing Kerberos tickets, performing a pass-the-ticket attack, and using tools like net exec and WMI over RDP.

Exploit a constrained delegation misconfiguration to escalate from local admin to domain admin by extracting computer account hashes, forging Kerberos tickets, and dumping NTDS hashes, then cracking them.

Explore resource-based constrained delegation in active directory, where the resource controls who can delegate to it. The msds attribute defines who may act on behalf, enabling computer takeover.

Learn to escalate privileges in Windows Active Directory through resource-based constrained delegation. Build a fake computer, join the domain, and impersonate a privileged user to access the domain controller.

Execute cleanup after a resource-based constrained delegation attack by deleting the test computer and removing delegation artifacts to keep the client's AD environment secure.

Explore lateral movement after privilege escalation, pivoting between systems using tools and built-in utilities like PowerShell, CMD, RDP, and Sysinternals to reach domain admins or segregated networks.

Explore lateral movement via remote desktop using NT hashes in Windows Active Directory environments. Learn to enable restricted admin mode and authenticate without cleartext credentials to reach target machines.

Leverage a NT hash to perform pass the hash via Kerberos, request TGT from KDC, export the credential cache, and use PS exec for remote code execution with admin access.

Explore domain dominance from compromising a child domain to escalating privileges at the domain level, reaching forests and external domains, while addressing escalation and lateral movement in cyclical attacks.

Forge a golden ticket to persist in a compromised Active Directory using the TGT key or NTLM hash, while navigating 2021 set filtering that requires an existing, matching domain user.

Demonstrates how to create and deploy a golden ticket using TGT credentials to persist as an administrator and compromise the forest domain controller in an Active Directory environment.

Learn silver ticket attacks, a Kerberos based persistence method for single-host access that avoids domain controller footprints by forging a tgs with a service or computer account hash.

Persist on a Windows domain using a silver ticket attack crafted from a computer account's NT hash, targeting an SPN, exporting the ticket, and testing with PsExec.

Demonstrates persistence using a diamond ticket attack to impersonate a domain admin, export and use a forged ticket, and maintain access via ps exec on the target domain.

Explore persistence via the diamond ticket attack by impersonating a low-privileged domain user to access a domain controller, demonstrating long-lasting access.

Explore sapphire tickets and how they modify the member, diamond tickets that change group membership, elevating privileges to compromise the domain controller and evade detection unlike golden and silver tickets.

Demonstrates persistence via Sapphire ticket attack to impersonate a user in a new domain, escalate to domain controller access, and verify ticket caching and export.

Learn how domain trusts link child and parent domains via the KDC and interim keys, and how attackers abuse set history and foreign domain membership to move across forests.

Explore how to perform a manual golden ticket attack to move laterally across forest and child domains, forge a TGT, and dump NTDS hashes to test domain security.

Demonstrates automating the Golden Ticket attack to compromise a forest domain by hopping from a child domain to the parent domain, retrieving enterprise admin credentials, and accessing the domain controller.

Explore how ad objects with foreign domain memberships create cross-domain links, using BloodHound to map compromised domains to forest domains and identify access paths.

Explore group membership and outbound object control within the forest domain, revealing how a group can influence the domain controller in advanced windows active directory penetration testing.

Explore domain trust abuse via foreign group membership to foothold a forest domain. Gain local admin on a workstation and attempt credential dumping using NT hashes and cleartext credentials.

Demonstrate domain trust abuse via unconstrained delegation, enumerating LDAP and misconfigurations to escalate from a child domain to enterprise admin across the forest domain using Kerberos tickets.

Become an effective pen tester by credential hunting to uncover credentials, like a 'your eyes only' file, then leverage valid credentials to hop into the foreign domain.

Credential hunting II trains pentesters to search AD object descriptions for passwords, using net exec to query the domain controller and uncover credentials amid large user bases.

We verify that credentials are valid by spraying the chemo social user's credentials across the subnet to test access. Although the credential is valid, it lacks privileges on any domain.

Demonstrate ACL enumerations with Bloodhound, uncovering misconfigurations and long attack chains from users to domain compromise, with OS-specific commands, change-password guidance, and OpSec considerations.

Explore abusing access control lists to perform a force change password attack, demonstrated by altering a user's password on a domain controller and validating the new credentials.

Demonstrates using valid credentials to execute a generic right for Kerberos attack, with SPN targeting, TGS, and shadow credential techniques. Illustrates offline hash cracking to obtain empty hashes and certificates.

Explore how attackers abuse ACLs through WriteDACL to escalate privileges in Windows Active Directory, gaining full control over a target user and enabling shadow credential attacks to extract NT hashes.

Demonstrates an attack adding a user to a group using LDAP authentication with Julius Nyerere's NT hash, leveraging the names of the user and Berbers group to join Berbers group.

Map forest trusts to identify bidirectional, transitive relationships with external forest domains and uncover potential abuse paths for moving from a forest to external forests, given enterprise level privileges.

Explore how misconfigured Active Directory Certificate Services enable domain escalation, persistence, and certificate theft, and follow the certificate lifecycle from client requests to Enterprise CA issuance, templates, and OID policies.

Analyze esc1 certificate template vulnerabilities in CA, including enrollment rights for low privileged users, lack of manager approval, and overly permissive security descriptors enabling impersonation via subject name in requests.

Identify isc2 certificate template vulnerabilities by analyzing enrollment rights for low privileged users, permissive permissions, missing manager approvals and signatures, and purpose set to true for sc2/sc3, false for sc1.

Expose how attackers abuse forest trusts and active directory certificate services esc2 attacks to obtain certificates for low-privileged users, escalating to domain admin in a foreign domain.

Certificate template vulnerability arises when an AD object holds dangerous permissions and full control over the certificate template, enabling exploitation.

Explore set hopping and golden ticket attacks across forest trust, detailing patches, set filtering, and the requirements: custom high-privilege groups with a rate over 1000 for cross-forest impersonation.

Explore cross-forest trust abuse using the golden ticket attack to simulate attacker access across domains, including compromised client and foreign domains, and privilege escalation within an active directory environment.

Develop lateral movement and privilege escalation techniques within a Windows Active Directory environment, enabling persistent access and domain compromise through network situational awareness, trust abuse, and forest-to-forest transitions.

Wrap up the engagement by compiling evidence, presenting findings to the client, and prioritizing vulnerabilities for remediation to guide an actionable report and readout meeting.

Construct a penetration test report that aggregates findings with evidence, documents cleanup actions, and includes executive summary, methodology, attack narrative, technical details, severity, recommendations, and action plans.

Walk through a sample internal penetration test report for an advanced Windows Active Directory engagement, detailing executive summary, attack kill chain, operations narrative, and technical findings.

Conduct a debrief with the pen testing team and stakeholders to review findings, discuss remediation plans, and define SLA timelines for critical, high, medium, and low findings.

Document the closure phase of a penetration test by detailing the work performed and attack vectors, share with stakeholders for review and debrief, and plan remediation or retest.