Identity and Directory Service Attack Paths
The mechanics you must know
Active Directory attacks are built on Kerberos and NTLM fundamentals. Kerberos pre-authentication protects AS-REQ; accounts with it disabled can be AS-REP roasted. Kerberoasting requests a service ticket for an account with a registered SPN and cracks it offline - RC4-encrypted tickets crack far more readily than AES. Delegation misconfigurations (unconstrained, constrained with protocol transition, and resource-based constrained delegation) each yield different paths to impersonation. ADCS misconfigurations, notably templates that allow the requester to supply a subject name combined with client-authentication EKU and enrol rights, allow certificate-based impersonation. DCSync depends on replication rights (DS-Replication-Get-Changes and related) granted to a principal. NTLM relay succeeds where signing and channel binding are absent.
Path thinking
Enumerate group memberships, ACLs, sessions, and delegation with tooling such as BloodHound, then reason about the shortest path to Tier-0: Domain Admin, krbtgt, or a domain controller. Every hop needs its own evidence.
Traps in exam questions
- Kerberoasting assumed to work on any account - an SPN is required, and crackability depends on the encryption type and password strength.
- Confusing golden ticket (krbtgt hash plus domain SID) with silver ticket (service account hash).
- Assuming unconstrained delegation alone grants access without a privileged user authenticating to that host.
- Treating password spraying as safe without checking the lockout threshold and observation window.
- Ignoring that DCSync rights can be delegated to a non-admin principal.
Rule of thumb
Enumerate the graph before attacking a node. Identify the target Tier-0 asset, find the shortest edge sequence, and validate each edge with its own captured evidence.