Offensive methodology
Active Directory attacks
The typical path of an internal penetration test: from a plain domain account to full control of the forest. Each attack is shown with its principle and its trace on the defensive side. Authorised lab only.
The typical path
- FootholdA domain account, even unprivileged.
- MapBloodHound: users, groups, rights, paths to the admins.
- Harvest credentialsRoasting, relaying, rights abuse, secrets in memory.
- MoveLateral movement host to host up to a privileged account.
- Dominate the domainDomain controller, NTDS database, persistence.
Enumeration
- BloodHound: collects the graph of relationships and highlights the shortest attack paths.
- LDAP / PowerView: users, groups, computers, SPNs, delegated rights, policies.
- SMB shares: configuration files, scripts, forgotten passwords.
- Spot accounts with an SPN, those without pre-authentication, administrators' sessions.
Authentication attacks
| Attack | Principle | Trace (defence) |
|---|---|---|
| Kerberoasting | Request the service ticket of an SPN account, crack its password offline. | many 4769 in RC4 (0x17) |
| AS-REP Roasting | Target accounts without Kerberos pre-authentication. | 4768 without pre-auth |
| Password spraying | A common password tried on many accounts. | 4625/4771 across many accounts |
| Pass-the-Hash | Authenticate in NTLM with the hash, without the password. | 4624 type 3, NTLM, unusual source |
| NTLM relay | Relay a captured authentication to another service. | authentication from an unexpected host |
Rights and service abuse
- DACL: an excessive right (GenericAll, WriteDACL, ForceChangePassword) over an object lets you control it.
- ADCS: a misconfigured certificate template lets you obtain an authentication certificate for another account.
- Kerberos delegation: an over-permissive delegation lets you impersonate a user.
- Services: misconfigured MSSQL, Exchange or SCCM often offer an escalation path.
Lateral movement and dominance
- Lateral movement: WMI, WinRM, PsExec, scheduled tasks, with a recovered account or hash.
- DCSync: request replication of the domain's secrets from an account with enough rights.
- Domain control: extraction of NTDS.dit, then persistence (operational detail stays in the lab).
- Defensive trace: 4662 with replication rights from a non-DC — see Threat hunting.
ReferencesThe Active Directory and Windows Event IDs sheets. The same attacks, seen by the defender, are in the CDSA revision deck.