Attacking Active Directory with Advanced Techniques With Lab

Learn to anonymously query or bind to LDAP to enumerate Active Directory. Discover how to retrieve users, domain groups, and comments for security assessment.

Enumerate users anonymously using rpc client to query domain users and groups in an Active Directory environment, comparing rpc with crack map exec and outlining potential follow-up attack steps.

Enumerate active directory information anonymously using LDAP search and enum4linux, identifying domain controllers, users, and groups after adding a hosts file entry.

Enumerate guest access on shares with crack map exec and SMB to reveal anonymous, passwordless access, view read/write shares, and note potential upload for a reverse shell.

Explore advanced techniques to extract credentials from lsass using a socks relay and El Sassy, including dumping domain accounts and the LSA cache with responder and proxychains.

Demonstrates remote credential dumping in an active directory environment using responder, ntlmrelayx, proxychain, and DonPapi with wmiexec.py, highlighting stealthy data exfiltration and credential discovery.

Coerce smb authentication with ntlmrelayx to ldaps, then drop the mic, using courser in a lab to impersonate the Salisbury administrator and dump the sam database with secretsdump.py.

Demonstrate the AS-REP roast attack to obtain an as-req/as-rep response from a domain controller without pre-authentication, then crack the data offline with hashcat.

Learn to perform password spraying with Greyhound to obtain valid credentials and import findings into Bloodhound. Configure domain settings and lockout thresholds, and prepare for LDAP search.

Authenticate to the domain controller and use get-adusers and ldapsearch to obtain a complete user list from north new york local. Compare results across domain controllers to verify access.

Perform kerberoasting on Active Directory by requesting service principal name tickets, extracting kerberos tickets, and cracking them with hashcat using crack map exec.

Learn to set up Power View in a lab, download and import the Power View module via PowerShell, and begin enumerating users, groups, and domain trust.

Explore enumeration techniques for active directory using Get-NetComputer to discover computers and servers across domains, inspect logon data and RDP sessions with Power View.

Use invoke share finder to enumerate domain shares across multiple servers, revealing read/write access, admin shares, and certificate services within the Active Directory lab.

Explore how to enumerate group policy objects with Get-NetGPO using Power View, inspect display names, domain scope, and GPO metadata in a local Active Directory domain.

Explore get-object-acl to inspect object ACLs and permissions in Active Directory, focusing on rights like force change password, add member, and owner across the New York.local domain.

Explore Active Directory domain trust and how bi-directional trust enables cross-domain authentication, using Get-NetDomainTrust and forest enumeration to map domain controllers and forest topology.

This lecture demonstrates how the print nightmare vulnerability in the Windows print spooler can enable system access by loading a DLL from an SMB server to spawn a reverse shell.

Demonstrates exploiting printnightmare on the Baltimore domain controller, bypassing Defender with a crafted DLL, creating a local administrator user, and dumping the NTDS database via crackmapexec.

Explore constrained delegation with protocol transmission in Windows Kerberos, compare it with unconstrained delegation, and learn to verify delegation settings and impersonate an administrator on the Bronx server.

Explore constrained delegation without protocol transition in Active Directory, using Kerberos, creating a test computer, and ticket-based impersonation to access the Yonkers server.

Learn about resource-based constrained delegation (rBCD) and its post-2012 implementation, with a lab demonstration of creating a fake computer and impersonating a NYC administrator to obtain a service ticket.

Enumerate and map trust relationships between Active Directory domains, highlighting bidirectional trusts between the New York Local and Maryland Local domains. Visualize these ldap-based trusts with BloodHound and Neo4j.

Learn how to obtain a reverse shell with an ASPX payload, upload it to the target, and practice privilege escalation using the impersonate privilege to reach admin access.

Exploit the se impersonate privilege with invoke bad potato.ps1 to gain a reverse shell. Elevate to the anti authority system (admin) and prepare msf venom and Metasploit payloads for exploitation.

Learn how to use Metasploit to enumerate Active Directory assets—users, groups, and computers—while managing sessions and executing post modules in a lab environment.

Explore ARP scanning for IP to MAC mapping, tokens and patch history, and bloodhound data collection in Metasploit to assess Active Directory environments.

Enumerate Active Directory servers, shares and SMB permissions, and enumerate services, SNMP, and Chrome data using post Windows gatherer modules for hands-on lab exploration.

Learn to add a backdoor by creating a new user with the post Windows manage add user module, test domain and local admin access, and delete the user afterward.

Learn to perform a hash dump with metasploit on a Windows host, using post windows gather and kiwi to extract administrator credentials and tickets in a lab.

Learn lateral movement with metasploit, using the smb parsec exploit to gain remote access, dump credentials, and enumerate domain admins across multiple servers in a simulated active directory lab.

demonstrates a dc sink attack with Metasploit, impersonating the administrator from nt authority/system to obtain credentials via dc sync, and prep for a golden ticket.

demonstrates creating a golden ticket with metasploit using mimikatz kiwi extension to persistently authenticate to active directory as a high privilege domain administrator for ten years.

learn to establish persistence by creating a backdoor service using a Windows Meterpreter payload, startup registry settings, and a reverse TCP handler.

Install Neo4j and Cypher Shell, set up BloodHound with AD CS and PKI support, and run the BloodHound collector to map Active Directory attack paths in Azure and on premises.

Install the bloodhound collector, collect data from New York local and Maryland domains, authenticate, zip, and import into Bloodhound to analyze domain admins and privilege paths.

This lecture demonstrates ADCS reconnaissance and enumeration using certipy and BloodHound to map certificate templates, enrollment configurations, and exploitation paths within Active Directory.

Demonstrates coercing domain admin by exploiting Active Directory certificate services with a petitpotam relay attack, leveraging the domain controller template to compromise the Active Directory infrastructure in a lab setting.

Explore advanced active directory attacks using certipy and ntl relay x, install tools, extract hashes from a domain controller, and practice with lab environments.

Demonstrate exploiting an AD CS misconfiguration (SC1) with certipy to obtain a domain administrator credential. Use Bloodhound enumeration to identify targets and dump domain secrets.

Explore exploiting the sc2 template on an adcs server with certipy, requesting a certificate via rpc from Maryland CA, and using smbexec to obtain a privileged session.

Exploit ADCS certificate templates by modifying the SC four template with write access to enable SC one technique variants, obtain a TGT, pull the hash, and compromise the domain controller.

Demonstrate targeted kerberoasting to abuse generic write access, using a python script from a GitHub repo and hashcat in a lab to pivot from Hugo Chavez to Ramon Maldonado.

Learn to abuse ACLs by writing a DACL on a user to grant full control, enabling password changes and shadow credentials dumps within a lab active directory environment.

Explore active directory attack paths with Neo4j and BloodHound, identify group memberships such as Radio City and Empire State, and simulate adding self to groups to assess rights.

Demonstrates adding Nicolas Maduro to the Empire State group in a Radio City context, updating Bloodhound data, and verifying inbound and outbound access within an Active Directory lab.

Demonstrates how to leverage write owner rights and delegation in Active Directory to take ownership of the Central Park Group, add a user via LDAP, and gain full control.

Enumerate mssql servers with GetUserSPNs, Nmap, and crack map exec to reveal sql services on port 1433 and identify sql server 2019 instances in Yonkers and Salisbury.

Enumerate MSSQL servers with CrackMapExec and Impacket to authenticate, list databases and logins, and identify the sysadmin account (SA) for potential access.

Coerce and relay attacks using MySQL, demonstrating authentication capture with responder on a Parrot OS lab machine, logging injected credentials and reviewing captured hashes for analysis.

Explores exploiting trusted links between MSSQL servers to pivot from Yonkers to Salisbury by authenticating with Elena Lopez's credentials, enabling remote login and command execution.

Demonstrates exploiting MSSQL to execute commands and spawn a shell on the Salisbury server, using a Python script, netcat listener, cross-domain trust, and xp_cmdshell.