Active Directory Exploitation: A/V and Egress Bypassing, Lateral and Vertical Movement, Domain Controller Compromise
Active Directory exploitation
This domain tests the full AD kill chain after an initial foothold: evading antivirus and egress controls, moving laterally and vertically, and compromising the Domain Controller. The exam cares less about a single tool and more about a defensible path from a low-privileged user to domain dominance.
Core rules and concepts
- Enumerate before you exploit: BloodHound, PowerView, and native tools to map users, groups, ACLs, sessions, and delegation.
- Evade A/V with in-memory execution, AMSI bypass, LOLBins, signed binaries, and obfuscated loaders; avoid writing payloads to disk when possible.
- Bypass egress by using allowed ports 80/443, DNS tunneling, domain fronting, or a redirector; confirm what the proxy permits before building a C2 profile.
- Lateral movement: SMB admin shares, WMI, WinRM, PsExec, and RDP, often with pass-the-hash or overpass-the-hash.
- Vertical movement: Kerberoasting, AS-REP roasting, ACL abuse, unconstrained delegation, ADCS misconfigurations, and DCSync.
- DC compromise: dump NTDS.dit or use DCSync, then prove impact without destructive changes.
Worked example
You land as a helpdesk user on a workstation. BloodHound shows GenericAll on the 'Helpdesk Admins' group. You add your user, then Kerberoast a service account with an SPN. The crack yields a password reused by a server admin. That account has local admin on a file server, where you find a Domain Admin session. You use WinRM with the harvested token, then DCSync to extract krbtgt. Reasoning: each step uses existing permissions rather than blind exploitation, and every hop is documented.
Traps that cost marks
- Running noisy scans without checking logging or scope.
- Assuming Domain Admin means 'done' and skipping evidence collection.
- Breaking the client environment with unapproved persistence or destructive changes.
- Failing to explain the attack path in the report.