Attacking And Defending Active Directory: AD Pentesting

Active Directory basics cover domains, domain controllers, trees, forests, organizational units, and objects, showing how authentication, access control, and group policies manage users, devices, and resources.

Research the Active Directory structure to deepen understanding for AD pentesting and take notes on key components to strengthen your defense and attack skills.

Explore how authentication works in Active Directory, comparing local logon via the SAM database with domain logon via the domain controller's NTDS.DIT, and note password hashes like LM and NTLM.

Explore hashing algorithms in Windows, including LM (LAN Manager) and NTLM, their weaknesses and deprecation, plus Kerberos as a network authentication protocol and NTLM’s challenge–response flow.

Discover Kerberos basics as the default Windows domain authentication, comparing it to NTLM and exploring the ticket-based security, KDC, and single sign-on concepts.

Explore the seven Kerberos components— TGT, KDC, AS (authentication server), TGS, SPN, Kerberos database, and session keys— through diagrams and the three request–response pairs that drive authentication.

Explain how Kerberos authentication works in Active Directory using a diagram, detailing client authentication, service authorization, and the key distribution center with authentication server and ticket granting server.

Compare NTLM versions and Kerberos to assess security and performance in authentication. Explain why Kerberos avoids sending passwords over the network.

Group policy in Active Directory defines security settings for users and computers via group policy objects linked to containers, enabling strong password policies, health check scripts, and centralized administration.

Research Active Directory group policies to understand how they enable exploitation, enumeration, and persistence. Explore Microsoft and third-party documentation to guide your study.

Set up an Active Directory pentesting lab by allocating 60 gb disk space, 16 gb ram, with Windows Server 2019, two Windows 10 Enterprise clients, and a Kali attacker.

Download Windows Server 2019 and Windows 10 Enterprise ISO files from the free download link, and store the two ISOs for about 11 GB total for the next lecture.

Install Windows Server 2019 in a VirtualBox or VMware VM, configure network settings, and install Active Directory Domain Services to promote the server to a domain controller for cyber.local.

Install a Windows 10 client in a virtual lab with Windows Server 2019 for Active Directory testing, including VM setup, domain join, and creating multiple client machines.

Configure a domain controller on Windows Server 2019 by creating an organizational unit, adding domain users, setting up an smb share, and applying a group policy to disable Windows Defender.

Configure dns and ip settings on Windows clients, rename machines, and join them to the cyber.local domain using user credentials, then restart to apply changes.

Demonstrates configuring client machines for active directory pentesting: create and log in as local users, elevate user one to local administrator, and prepare client two for attacks.

Enable network discovery and file sharing on Windows clients, set up SMB shares with administrator credentials, and install VirtualBox guest additions via the CD image.

Explore PowerShell basics as a cross-platform, object-oriented command line and scripting language, and practice essential commands such as Get-Service, Get-Process, and Get-ChildItem.

Master practical PowerShell commands for active directory pentesting by practicing write-output, variables, Get-Help, Get-Command, Get-Service, Get-Process, and file operations like new-item, copy-item, move-item, and remove-item in the PowerShell terminal.

Explore Windows file transfer methods for attacking and defending Active Directory, including PowerShell, cmd, and netcat, with notes on required downloads and credentials for SMB transfers.

Learn practical file transfer techniques between Windows and Kali using a Python HTTP server or SMB server, including PowerShell's Invoke-WebRequest, certutil, wget, and netcat-based methods.

Learn the attack path for breaching active directory, from internal recon and initial foothold to credential compromise, privilege escalation, and pursuit of domain administrator access, including pass the hash techniques.

Learn how OSINT reveals public data to enable initial access in an Active Directory network, including exposed credentials and data leaks, and how phishing assists compromise.

Explore how attackers gain initial access via web attacks by compromising an internet-facing website. Use sql injection or remote code execution to reach a domain user through privilege escalation.

Explore how llmnr poisoning exploits no authentication in link local multicast name resolution, enabling attackers to capture ntlm v2 hashes; mitigate by disabling llmnr and nbns.

Demonstrates practical LLMNR poisoning using SMB, including setting up responder, capturing hashes via a fake SMB server, cracking credentials with John, and logging in via RDP.

Explore llmnr poisoning using wpad with the responder tool, including configuring a dhcp server poisoner and adjusting responder.conf to capture ntlmv2 credentials on a windows client.

Learn how an SMB relay attack uses NTLM version 2 hashes to gain an SMB shell across an Active Directory network, and how enabling SMB signing mitigates it.

Demonstrate a practical smb relay attack against active directory by configuring responder, creating targets.txt with IPs, using crackmapexec and ntlm relay x to gain an interactive smb shell on endpoints.

Explore AS-REP roasting in active directory pentesting, showing how attackers exploit users without Kerberos pre-authentication via AS-REQ and AS-REP to obtain data for offline password cracking.

Perform AS-REP roasting in Active Directory by disabling Kerberos pre-auth for a user, extracting the hash with Impact Toolkit, and cracking it with John the Ripper to demonstrate initial access.

Explore password spray attacks in Active Directory, using several valid usernames with a single common password to obtain initial access, noting minimum password length seven and account lockout.

Explore a password spray attack against Active Directory using the cube root tool to brute force domain accounts via Kerberos pre-authentication, enumerate valid users, and prepare for further access.

Identify additional methods of initial access on Active Directory, including leaked configuration files, anonymous LDAP/SMB access, misconfigured or old servers, missing patches, and EternalBlue.

learn practical mitigations to prevent breaches of active directory, including access control, strong passwords with multi-factor authentication, monitoring, patching, intrusion detection, security training, and regular red/blue team assessments.

Master enumeration of Active Directory using PowerShell, command line tools, and BloodHound to reveal sensitive information and network relationships. Learn how these tools reveal artifacts that aid pentesting and defense.

Enumerate Active Directory using only native PowerShell commands to avoid external scripts, gaining insights into domain users, domain controllers, and system information through built-in commands like whoami and net user.

Demonstrate PowerView for active directory enumeration using a PowerShell based tool that replaces Windows net commands, taps AD hooks, and uses Win32 API to reveal domain and domain controllers.

PowerView basics in a Kali environment: load the PowerShell script, import the module, and run domain enumeration commands to reveal domain controllers, domain SID, and domain users.

Configure active directory by creating an organizational unit named tech and adding a new administrator Http.server. Store the password in the description, noting that least privileged accounts can read it.

PowerView demonstrates enumerating domain computers, groups, and shares, filtering by DNS host name, and enumerating Gpos for active directory pentesting insights and potential persistence.

Execute PowerView commands to enumerate views, Kerberos policies, password age, complexity, and length, and identify machines and users with local admin rights on the domain.

Learn how BloodHound maps unintended Active Directory relationships using graph theory, reveals complex attack paths across Active Directory and Azure AD, and supports blue and red team analysis.

Learn to enumerate an Active Directory domain using BloodHound, Neo4j, and SharpHound, configure data collection, upload results, and identify domain admins and shortest paths to them.

learn how to troubleshoot windows active directory labs when ip addresses change, using crackmapexec, and adjust dns settings and ipv4 to reconnect to the domain.

Explore active directory enumeration methods using the ad module, built-in active directory tools, ad lance tool, ldap domain dump, and ad recon, and create notes on privilege account discovery.

See how lateral movement in Active Directory lets attackers extend access from a compromised host to other machines and maintain persistence, using pass-the-hash attacks and RDP hijacking.

Master the pass-the-hash attack, where stolen hashed credentials grant access without passwords in Active Directory. Apply mitigations like limiting network access, restricting local admin privileges, and regular penetration testing.

Execute a pass-the-hash attack in active directory, dump sam hashes with crackmapexec, and use ps exec to gain a shell on a user machine while moving toward the domain controller.

Explore the pass-the-ticket attack by extracting Kerberos tickets from memory with Mimikatz, using hashes to request tickets, and authenticating across networks with exported tickets.

Demonstrates a pass the ticket attack in an Active Directory lab, using mimikatz to export Kerberos tickets and perform a pass the ticket with winrs for lateral movement.

Master the overpass-the-hash attack, using NTLM or AES keys to request Kerberos tickets when NTLM is disabled, with mimikatz and AES options.

master the overpass-the-hash attack in active directory environments by using mimikatz to extract ntlm and 128/256 hashes, and authenticate as a target user for lateral movement.

Explore how attackers hijack legitimate remote desktop sessions to move laterally across a Windows network via RDP hijacking, with a TryHackMe online lab.

Explore a practical RDP hijacking technique within an Active Directory pentest, using PsExec to obtain an admin shell, enumerate sessions, and hijack a remote RDP session to gain access.

Explore how to leverage PowerShell remoting for lateral movement and study the URL file attack, researching these techniques and other methods for Active Directory pentesting.

Pivoting in Active Directory shows how an attacker moves from a compromised host to machines via a pivot, using port forwarding, routing tables, VPN pivoting, proxy pivoting, and SSH pivoting.

Configure the pivoting lab by setting host-only adapters on the DC and clients and removing the bridge on client1; the diagram shows internal and target networks and a user2 pivot.

Learn to pivot with chisel in a cross-platform setup, configuring a server and client to forward ports and access remote services such as RDP through a local, forwarded port.

Create a pivoting lab with Kali Linux, Windows client one and two, Windows Server 2019, and VirtualBox host-only adapters, configuring port forwarding to access target machines through a pivot.

Explore exploitation in Active Directory, using misconfigurations to enable lateral movement and privilege escalation toward the domain admin, with phishing, breaching, NTLM and SMB relay, and RDP hijacking.

Explore kerberoasting, stealing the krbtgt TGS ticket encrypted with RC4 or NTLM hashes to offline brute-force the service account password, enabling lateral movement and exploitation in Active Directory.

Demonstrate a kerberoasting attack on Windows Server 2019 by setting an SPN for an HTTP service, extracting the TGS ticket, and brute-forcing the NTLM hash to retrieve the password.

Explore how generic all permissions on a user enable password resets, login as that user, add to groups, and leverage rights like right owner, write dsl, and change password.

Exploiting permission delegation in active directory, this practical guide shows creating an OU and groups, assigning IT admin rights, and using bloodhound and PowerView to reveal domain admin access.

Explores exploiting generic all rights on an active directory group to add users, access resources, and potentially dump hashes, with practical acl abuse lab guidance.

Demonstrates how generic write access and delegation flaws in the domain admins group can let a compromised user gain domain admin privileges.

Explore how abusing group memberships enables privilege escalation in Active Directory, exposing domain admin access. Discover why Backup Operators can bypass protections and compromise the DC.

Learn how backup operators' group membership abuse in Active Directory enables privilege escalation and security bypass, using powerview, bloodhound, and impacket to access sensitive hashes.

Explore how account operators add members to DNS admins and Hyper-V admins to enable privilege escalation and potentially load a malicious DLL to gain system privileges in Active Directory.

The lecture demonstrates privilege escalation from account operators to domain admin via dns admins, illustrating the risks of group membership abuse and potential system access.

Explore group membership abuse in Active Directory, including schema admins, server operators, and key admins, and how ACL changes, backup and restore privileges, and shadow credential attacks affect domain controllers.

Explore group policy abuse, or gpu abuse, and how adding user rights with the sharp gpu abuse tool from GitHub can reach domain admin.

Learn practical techniques to abuse a misconfigured group policy object, escalate privileges by adding a test user to local admins via a vulnerable GPO, and verify with gpupdate.

Explore techniques to identify logged-on administrators, extract NTLM hashes and Kerberos tickets, and perform pass-the-hash attacks using tools like PowerView, Mimikatz, and PsExec in a controlled AD pentesting lab.

Explore the printnightmare attack overview, including two Microsoft CVEs, and how the Windows print spooler vulnerability enables remote code execution with system privileges on affected Windows machines.

Demonstrate a practical printnightmare exploit in a Tryhackme lab, including VPN setup, identifying a vulnerable host, and gaining a remote admin shell using DLL and SMB steps.

Explore the zerologon attack, CVE-2021-472, a critical Windows Server vulnerability in the Netlogon process that can compromise a domain controller without credentials, demonstrated in a TryHackMe online lab.

Explore zerologon vulnerability in Active Directory to gain domain admin access without credentials, using a TryHackMe lab, Python scripts, NetBIOS discovery, secrets dump, and PsExec.

Understand Kerberos delegation, which lets a server access resources on behalf of the user, including unconstructive, constraint, and resource-based delegation, and how attackers may exploit it.

Explore active directory certificate services exploitation through research labs, practice cross-forest attacks, assess vectors such as SharePoint, IPv6 mitm, ACL abuse, printer bugs, AD integrated DNS, and shadow copies.