PJPT: Active Directory Penetration Testing

What the exam tests

Active Directory penetration testing is the core of PJPT. The exam tests enumeration of domain objects, credential attacks, lateral movement, and privilege escalation to Domain Admin, with an emphasis on attack paths you can explain and reproduce.

Core rules and concepts

• Map the domain with BloodHound: collect with SharpHound or bloodhound-python, then inspect shortest paths to Domain Admins, Kerberoastable users, AS-REP roastable accounts, and ACL edges.
• Kerberoasting: request service tickets with GetUserSPNs.py corp.local/asmith:password -dc-ip 10.10.10.5 -request, then crack with hashcat -m 13100.
• AS-REP roasting: identify accounts with 'Do not require Kerberos preauthentication' and request with GetNPUsers.py -no-pass -usersfile users.txt.
• SMB relay and LLMNR/NBT-NS poisoning require signing disabled and a relayable protocol; validate with Responder in analyze mode first.
• Post-exploitation: check local admin rights, cached credentials, and ACL abuse; DCSync requires Replicating Directory Changes permissions.

Worked example

BloodHound shows svc_sql has a service principal name and is a member of Domain Users. You run GetUserSPNs.py corp.local/jdoe:Summer2024 -dc-ip 10.10.10.5 -request and receive a Kerberos TGS hash. hashcat -m 13100 hash.txt rockyou.txt recovers Sql!2023. Reasoning: the SPN makes the account roastable; RC4 ticket encryption yields a crackable hash; the recovered password is then validated with NetExec before use.

Traps

Cracking a Kerberos hash with the wrong hashcat mode, assuming every domain user is Kerberoastable, ignoring AS-REP accounts, and treating BloodHound output as proof without manual validation. Avoid locking out accounts with repeated failed logons.