Active Directory Attacks and Post-Exploitation
What to know
AD compromise is mostly misconfiguration. Enumerate with netexec (SMB, LDAP, WinRM), ldapsearch, PowerView, and BloodHound with SharpHound collection that includes sessions and ACLs. Then work the credential paths: Kerberoasting (request service tickets for accounts with SPNs and crack offline), AS-REP roasting (accounts without pre-authentication), password spraying within lockout policy, Group Policy Preferences cpassword in SYSVOL, local administrator password reuse, and LSASS dumping.
Network-level attacks feed the same pipeline: LLMNR/NBT-NS poisoning with Responder, NTLM relay to hosts without SMB signing, and forced authentication to obtain tickets. Once you hold an account, ACL abuse becomes the main escalator: GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, AddMember, and targeted Kerberoasting. Delegation matters: unconstrained delegation plus coerced authentication yields a machine or user TGT; resource-based constrained delegation is a write to a computer object. DCSync requires replication rights, not necessarily Domain Admin. Tickets: golden (krbtgt hash), silver (service account hash), pass-the-ticket, overpass-the-hash.
Traps
- Running BloodHound without session or ACL collection and concluding there is no path.
- Spraying before checking the domain lockout policy.
- Assuming DCSync needs Domain Admin rather than the specific replication rights.
- Confusing golden and silver tickets, or forging a ticket without valid domain SID and krbtgt data.
Rule of thumb
Map ACLs and delegation before brute force; the shortest path to Domain Admin is almost always a permission someone granted by accident.