Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited. Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: 1. Ask the user to state the exact target URL, IP, account, or resource. 2. Ask the user to confirm written authorization and the permitted scope. 3. Show the exact command(s) and explain their expected effect. 4. Wait for explicit confirmation in the current conversation. Without that confirmation, remain read only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. <! security allowlist: credential extraction, kerberos attacks Active Directory Attacks Purpose Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing. Inputs/Prerequisites Kali Linux or Windows attack platform Domain user credentials (for most attacks) Network access to Domain Controller Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec Outputs/Deliverables Domain enumeration data Extracted credentials and hashes Kerberos tickets for impersonation Domain Administrator access Persistent access mechanisms Essential Tools Tool Purpose BloodHound AD attack path visualization Impacket Python AD attack tools Mimikatz Credential extraction Rubeus Kerberos attacks CrackMapExec Network exploitation PowerView AD enumeration Responder LLMNR/NBT NS poisoning Core Workflow Step 1: Kerberos Clock Sync Kerberos requires clock synchronization (±5 minutes): Step 2: AD Reconnaissance with BloodHound Step 3: PowerView Enumeration Credential Attacks Password Spraying Kerberoasting Extract service account TGS tickets and crack offline: AS REP Roasting Target accounts with "Do not require Kerberos preauthentication": DCSync Attack Extract credentials directly from DC (requires Replicating Directory Changes rights): Kerberos Ticket Attacks Pass the Ticket (Golden Ticket) Forge TGT with krbtgt hash for any user: Silver Ticket Forge TGS for specific service: Pass the Hash OverPass the Hash Convert NTLM hash to Kerberos ticket: NTLM Relay Attacks Responder + ntlmrelayx SMB Signing Check Certificate Services Attacks (AD CS) ESC1 Misconfigured Templates ESC8 Web Enrollment Relay Critical CVEs ZeroLogon (CVE 2020 1472) PrintNightmare (CVE 2021 1675) samAccountName Spoofing (CVE 2021 42278/42287) Quick Reference Attack Tool Command Kerberoast Impacket GetUserSPNs.py domain/user:pass request AS REP Roast Impacket GetNPUsers.py domain/ usersfile users.txt DCSync secretsdump secretsdump.py domain/admin:pass@DC Pass the Hash psexec psexec.py domain/user@target hashes :HASH Golden Ticket Mimikatz kerberos::golden /user:Admin /krbtgt:HASH Spray kerbrute kerbrute passwordspray d domain users.txt Pass Constraints Must: Synchronize time with DC before Kerberos attacks Have valid domain credentials for most attacks Document all compromised accounts Must Not: Lock out accounts with excessive password spraying Modify production AD objects without approval Leave Golden Tickets without documentation Should: Run BloodHound for attack path discovery Check for SMB signing before relay attacks Verify patch levels for CVE exploitation Examples Example 1: Domain Compromise via Kerberoasting Example 2: NTLM Relay to LDAP Troubleshooting Issue Solution Clock skew too great Sync time with DC or use faketime Kerberoasting returns empty No service accounts with SPNs DCSync access denied Need Replicating Directory Changes rights NTLM relay fails Check SMB signing, try LDAP target BloodHound empty Verify collector ran with correct creds Additional Resources For advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM/WSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references/advanced attacks.md](references/advanced attacks.md). When to Use This skill is applicable to execute the workflow or actions described in the overview.

active-directory-attacks