/hunt-ad

name: hunt-ad
description: Active Directory attack hunting - enumeration to domain dominance. Spray-safe (lockout gate), AS-REP/Kerberoast, ACL + ADCS (ESC1-16), delegation, DCSync, lateral movement. Wiki-first, FIND schema output.

Hunt: Active Directory

**Assumes `hunt-core`** for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "Active Directory kerberoast AS-REP ADCS ESC delegation DCSync lateral movement BloodHound" via wiki-search MCP

Hub: [[active-directory-moc]] (live index). Primary page: [[active-directory]]. Anchors: [[adcs]] (ESC1-16 matrix, the highest-value escalation edge), [[kerberos-attacks]] (AS-REP/Kerberoast plus the delegation paths). Tool anchor: [[netexec]] (the full nxc map: every protocol, flag, and module, with the spray/lockout, Kerberos, exec-method, and dumping gotchas). Read the LDAP + SMB sections before hand-rolling any AD enumeration; most steps below are one nxc flag.

Attack surface signals

Ports: SMB 445, LDAP 389/636, Kerberos 88, ADWS 9389, WinRM 5985/5986, RPC 135, MSSQL 1433, ADCS web enroll 80/443 (`/certsrv`). Footholds: null/guest SMB, anonymous LDAP bind, AS-REP-roastable users (no preauth), SMB signing OFF (relay), `ms-DS-MachineAccountQuota > 0`, pre-Win2000 computers, LAPS readable.

Spray-safe + AD safety gate (READ FIRST)

• **Spray-safe lockout gate - the AD analog of the `hunt-core` enumeration limits.** Read the domain lockout policy BEFORE any spray: `nxc smb <dc> -u <user> -p <pass> --pass-pol`. Spray at most **1 attempt per account per observation window**, and never exceed `(lockoutThreshold - 1)` attempts per account per window. RoE `no_bruteforce` / `passive_only` -> enumerate only, NO spray. Locking real accounts is a client-impacting incident, not a finding.
• **Reuse captured creds first** (from `loot.md`) before researching new ones; default/known creds before any spray (see [[default-credentials]]).
• **Clock skew:** sync to DC (`ntpdate <dc>` or `faketime`) or Kerberos TGT requests fail with `KRB_AP_ERR_SKEW`.
• **Stale `/etc/hosts` realm entry silently breaks Kerberos.** A prior box's `<realm> -> <old-ip>` line makes impacket resolve the KDC to a dead host and hang with `[Errno 110] Connection timed out (REALM:88)`, even though certipy (which forces `-dc-ip`) worked seconds earlier. When you add the DC to `/etc/hosts`, REMOVE any existing line for the same realm, and ALWAYS pass `-dc-ip <dc>` (and `-target-ip <dc>`) on impacket Kerberos ops so KDC/target resolution never depends on DNS/hosts. Same fix if `certipy req` throws `The NETBIOS connection ... timed out`: add `-target-ip <dc>`.
• **Hash recovered but the account blocks NTLM?** ESC1/UnPAC/PKINIT hands you BOTH an NT hash AND a TGT ccache. If PtH returns `STATUS_ACCOUNT_RESTRICTION` (the account is in Protected Users / NTLM-hardened, common for `Administrator`), the hash is a red herring - use the ccache: `export KRB5CCNAME=<user>.ccache; impacket-smbclient/secretsdump -k -no-pass -dc-ip <dc> <dc-fqdn>` reads flags / DCSyncs over Kerberos. See [[adcs]].
• Never pivot through `192.168.1.x` hosts (Ligolo tunnel only for lateral movement).

Ranked path + highest-value edges

Ranked: enum -> AS-REP/Kerberoast -> ACL / ADCS ESC1-16 -> delegation -> DCSync -> lateral -> DA. **The ADCS ESC1-16 matrix (step 5) and the delegation paths (step 6) are the highest-value edges** - one vulnerable template or a writable `msDS-AllowedToActOnBehalfOfOtherIdentity` is often the entire DA chain. **Chain:** every cracked/sprayed cred re-feeds enum + BloodHound; a Kerberoastable SPN account doubles as an RBCD `-delegate-from`; an on-box cred store (step 7) frequently yields the account that holds the winning ACL.

Methodology

**Efficiency: fire the unauth-enum WAVE at once, don't grind it serially.** On a fresh DC the first 6 reads are independent - launch them together (parallel tmux tabs / back-to-back), then read results: null+guest shares & RID-brute, anonymous LDAP users + **all `description`/`info` fields** (planted seed passwords live here), AS-REP roast of the whole user list, person-object SPN enum (Kerberoast), the LDAP lockout policy, AND `certipy find -vulnerable` (ADCS ESC is on MOST modern THM/HTB DCs - run it in the unauth wave with any cred you get, not as an afterthought). This one wave usually already contains the foothold (a description seed to spray) and the escalation (an ESC template).

1. **Unauth enum:**

nxc smb <dc> -u '' -p '' --shares            # null session
nxc smb <dc> -u guest -p '' --rid-brute 5000 # guest RID cycling when null shares are denied
nxc ldap <dc> -u '' -p '' --users            # anonymous bind
# planted-password sweep (classic THM foothold) - read EVERY non-generic description:
ldapsearch -x -H ldap://<dc> -b <base> "(objectClass=user)" sAMAccountName description
enum4linux-ng -A <dc>;  rpcclient -U '' -N <dc>

2. **Build the user list - harvest EXHAUSTIVELY, then validate (lockout-safe):** When anon enum is locked down, the user list comes from the target's own web app + OSINT. **Scrape EVERY page, not just the homepage** - names hide in `about`/`team`/`staff`/`leadership`/`testimonial`/ `contact` sections that the index page does not show. (Missing the `about.html` "Our Team" block once cost two valid users on a box.) Extract every `First Last`, note the format from any leaked email (`j.doe@dom` = `f.last`), generate permutations, and let kerbrute tell you which are real:

# pull all pages, strip tags, extract capitalized name bigrams
for p in $(curl -s http://<t>/ | grep -oiE 'href="[^"]+\.html?"' | cut -d'"' -f2 | sort -u); do
  curl -s http://<t>/$p | sed -e 's/<[^>]*>/ /g'; done | grep -oE '[A-Z][a-z]+ [A-Z][a-z]+' | sort -u
# -> for each "First Last": emit f.last, flast, first.last, first_last, last  (+ leaked-email format)
kerbrute usere