Active Directory Attacks
Active Directory attacks exploit protocol weaknesses, misconfigurations, and trust relationships within domain environments to escalate from standard user access to a higher privilege level. These techniques target the identity infrastructure that governs authentication and authorization across the domain.
Strategic context
Active Directory environments are often compromised through deliberate design choices. Kerberos authentication, NTLM fallback , certificate services, delegation configurations, and trust relationships all create opportunities when they are misconfigured or not understood by defenders.
The enumeration conducted during reconnaissance should have already identified which of these attack paths are available. This section focuses on executing against those identified opportunities.
For security leaders, Active Directory attacks show why identity infrastructure requires the same rigor as any other critical system. Default configurations, legacy protocol support, and permission sprawl create attack paths that are invisible in vulnerability scans but available to an attacker with basic domain credentials.
Execution examples
Kerberoasting
Kerberoasting extracts Kerberos TGS tickets for accounts with service principal names (SPNs) for cracking offline. It works because service tickets are encrypted with the service account's password hash, and weak passwords can be recovered through offline brute force.
Enumeration should have already identified Kerberoastable accounts. Execution is straightforward:
# Impacket
GetUserSPNs.py domain/user:password -dc-ip DC_IP -request
# NetExec
nxc ldap DC_IP -u user -p pass --kerberoasting output.txtCrack the extracted hashes offline:
hashcat -m 13100 hashes.txt wordlist.txtThe value of Kerberoasting depends on what the service account has access to. A service account with Domain Admin membership is a direct escalation. A service account with access to a single database is useful but may require additional steps.
AS-REP roasting
AS-REP roasting targets accounts with Kerberos pre-authentication disabled. These accounts return encrypted data that can be cracked offline without any special privileges.
This attack is opportunistic. It only works against accounts with a specific (mis)configuration, but when it succeeds, it provides cleartext credentials.
LLMNR and NBT-NS poisoning
When DNS resolution fails, Windows systems fall back to multicast name resolution protocols. An attacker on the local network can respond to these queries and capture NTLMv2 hashes from systems attempting to authenticate.
The captured hashes can be cracked offline or relayed directly to other systems (see below). This technique is passive and captures authentication events as they occur.
SMB relay
Instead of cracking captured NTLMv2 hashes, SMB relay forwards them to another system where the captured account has access.
Prerequisites for SMB relay are that SMB signing must be disabled on the target and the relayed credentials must have administrative access on the target.
AD CS exploitation
Active Directory Certificate Services misconfigurations allow privilege escalation through certificate abuse. Vulnerable certificate templates may permit users to request certificates with alternate identities, effectively impersonating privileged accounts.
The specific escalation depends on the misconfiguration identified during enumeration:
Certificate-based escalation is especially powerful because certificates operate independently of password changes. A certificate obtained today remains valid until it expires, regardless of subsequent password rotations.
IPv6 DNS takeover
Many networks have IPv6 enabled but not configured. An attacker can advertise themselves as an IPv6 DNS server and intercept authentication attempts.
This technique combines well with SMB relay and can result in the creation of new domain objects or delegation of privileges.
Credential extraction
Once sufficient access is obtained, typically local administrator on a domain-joined system, cached and stored credentials can be extracted for further escalation.
DCSync extracts credentials directly from the domain controller by simulating replication, and requires specific privileges (typically domain admin or equivalent):
Golden ticket
A golden ticket forges Kerberos TGTs using the KRBTGT account hash, providing persistent domain access that survives password changes for all accounts except KRBTGT itself.
Golden tickets represent the highest level of domain persistence and are typically a post-compromise action rather than an escalation technique.
Common mistakes
Attempting Kerberoasting or AS-REP roasting without first verifying that target accounts have meaningful access
Running tools without understanding the network environment and monitoring in place
Treating credential extraction as the end goal rather than a means to further access
Not considering that most AD attacks generate logs that can be detected by security monitoring
Operator notes
AD attacks should follow AD enumeration. Execute against identified opportunities, not checklists
Kerberoasting and AS-REP roasting are relatively low-risk starting points
LLMNR poisoning and SMB relay require network positioning and patience but can produce results without any prior credentials
Certificate misconfigurations are common and valuable, always enumerate AD CS
Last updated