I85PREP
⌘ K
OSCE3 study materials
OSCE3 study resources

OSCE3: Active Directory Exploitation

OSCE3 · Work through your exam, one topic at a time.

All guide sections

Active Directory Exploitation

This domain tests multi-step Active Directory attack paths from a low-privileged foothold to high-value access, including cross-domain and cross-forest movement. The emphasis is on enumeration, abuse of misconfigured permissions and delegation, Kerberos ticket attacks, AD CS, and credential extraction, all while maintaining operational plausibility.

Core rules and concepts

  • Enumerate users, groups, computers, sessions, ACLs, SPNs, trusts, and certificate templates. BloodHound-style graph thinking helps, but you must understand each edge.
  • Kerberoasting targets accounts with SPNs; AS-REP roasting targets accounts without pre-authentication. Cracked credentials are a pivot, not the goal.
  • ACL abuse is often the shortest path: GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, and ForceChangePassword each have distinct abuse steps.
  • Delegation types differ: unconstrained, constrained, and resource-based constrained delegation. Coercion plus relay or S4U can turn a machine account into domain compromise.
  • AD CS misconfigurations such as overly permissive enrollment rights or web enrollment endpoints can yield certificates for privileged accounts.
  • Trusts introduce SID history, foreign group membership, and referral ticket paths. Do not assume a domain boundary is a security boundary.

Worked example

A compromised user has GenericAll over a helpdesk group. The group has WriteDACL on the domain object. The reasoning chain is: add the controlled user to the group, use the inherited write permission to grant the controlled user DCSync rights, then replicate account secrets. Each step is validated before moving on: confirm group membership, confirm the DACL change, then confirm replication rights. The final action is not just "run DCSync" but proving the rights came from the intended path.

Traps that cost marks

  • Chasing Kerberoasting without checking whether the cracked account actually unlocks a path.
  • Confusing constrained delegation with RBCD and applying the wrong S4U flow.
  • Ignoring machine account quotas and coercion prerequisites.
  • Breaking the path by changing a password or ACL you still need.