Active Directory Attack Paths
Active Directory Attack Paths tests whether you can take one valid domain account and chain it into Domain Admin. The exam rewards graph thinking: who can do what to whom, and which edge moves you closer to a Domain Controller.
Core rules
- Enumerate before attacking:
bloodhound-python -u user -p pass -d domain -ns DC_IP -c All, then read the shortest paths. Use PowerView for targeted queries. - Kerberoasting:
GetUserSPNs.py domain/user:pass -dc-ip DC -request, cracked with hashcat mode 13100. - AS-REP roasting: accounts with pre-authentication disabled; hashcat mode 18200.
- Credential capture: Responder for LLMNR/NBT-NS, then relay with
ntlmrelayxonly when SMB signing is off. - ACL abuse:
GenericAll,GenericWrite,WriteDACL,ForceChangePassword,AddMemberover users, groups or computers. - Delegation: unconstrained captures a DC ticket-granting ticket, constrained uses S4U2Self/S4U2Proxy, resource-based writes
msDS-AllowedToActOnBehalfOfOtherIdentity. - ADCS: request a certificate as another user when a template permits it, the ESC1 pattern.
- DCSync needs replication rights; a Golden Ticket needs the
krbtgthash.
Worked example
As svc_help, BloodHound shows GenericAll over the user j.smith, who has an active session on a domain controller. You use Set-DomainUserPassword to set a known password, log in as j.smith, and find local administrator rights on the DC through group membership. Reasoning: GenericAll includes the right to reset that password, and the session data marks the account as worth taking.
Traps that cost marks
Cracking Kerberoast hashes with the wrong hashcat mode; forgetting -dc-ip; ignoring clock skew, which Kerberos tolerates only around five minutes; assuming group membership equals admin rights; and overlooking that a compromised machine account can be abused without any user password.