HTB CAPE: Active Directory Fundamentals and Enumeration

What this domain tests

Active Directory Fundamentals and Enumeration tests whether you can map an AD environment before touching it: forest, domain, OU structure, DNS, trusts, sites, and the identity graph of users, groups, computers, and ACLs. The exam expects methodical, low-noise collection rather than blind scanning.

Core rules and concepts

• AD depends on DNS. Resolve the domain controller first; a wrong DNS server hides LDAP, Kerberos, and SMB services.
• Unauthenticated enumeration is limited but valuable: check LDAP anonymous bind, SMB null sessions, and zone transfers. Tools such as enum4linux-ng and netexec smb <dc> -u '' -p '' reveal shares, users, and password policy.
• Authenticated collection is where BloodHound matters. Run SharpHound or BloodHound CE collectors with -c All, or DCOnly if stealth matters, then inspect shortest paths to Domain Admins.
• PowerView remains useful for targeted queries: Get-DomainUser -SPN, Get-DomainObjectAcl, and Find-LocalAdminAccess.

Worked example

You obtain a low-privileged domain user from a share. Before spraying, run netexec smb DC01 -u user -p pass --pass-pol to read the lockout threshold. Then collect BloodHound data with that user. The graph shows HELPDESK has GenericAll on SERVER01. Reasoning: this is an ACL edge, not group membership, so confirm it with Get-DomainObjectAcl and plan to abuse it later. Enumeration is complete only when you can explain how each edge leads to a target.

Traps that cost marks

• Treating BloodHound as an answer machine: unconfirmed edges and stale sessions mislead.
• Ignoring DNS and trust boundaries; a logon failure may be a name-resolution problem.
• Forgetting to record password policy and lockout threshold before any spray.
• Collecting with Domain Admin rights when the exam only gives you a user; over-collection creates noise.