Active Directory Attack Lessons
Learn Windows Active Directory attacks through structured lessons. Each attack is explained from first principles.
View the full Attack MapAll Attack Paths
Kerberos
AS-REP Roasting
Request AS-REP for accounts without Kerberos pre-authentication and crack offline
Kerberoasting
Request TGS for SPNs and crack service account passwords offline
Targeted Kerberoasting
Set SPN on user you control then Kerberoast their account
Pass-the-Ticket
Import Kerberos ticket into session for authentication
Overpass-the-Hash
Use NTLM hash to request Kerberos TGT
Silver Ticket
Forge service ticket using service account NTLM hash
Golden Ticket
Forge TGT using krbtgt NTLM hash for unlimited domain access
Trust Abuse
Exploit forest/domain trusts for cross-boundary access
Credential Theft
Zerologon
CVE-2020-1472: Exploit Netlogon AES-CFB8 cryptographic flaw to reset DC password
GPP cPassword
Extract AES-encrypted passwords from Group Policy Preferences XML
DCSync
Replicate credentials from DC using MS-DRSR GetNCChanges
DPAPI Backup Key
Extract domain DPAPI backup key to decrypt any user's secrets
NTLM Relay
NTLM Relay to SMB
Relay captured NTLM auth to SMB service for remote code execution
NTLM Relay to LDAP
Relay NTLM to LDAP for AD object modification (RBCD, Shadow Creds)
NTLM Relay to AD CS
Relay NTLM to AD CS HTTP enrollment to obtain user/machine certificate
ACL Abuse
Shadow Credentials
Add Key Credentials to msDS-KeyCredentialLink for PKINIT auth
SPN-Jacking
Hijack service by setting SPN to machine you control
DNSAdmins Abuse
Load arbitrary DLL into dns.exe via ServerLevelPluginDll
Delegation
Resource-Based Constrained Delegation
Configure RBCD on target to impersonate any user to that service
Unconstrained Delegation
Extract TGT from memory of machine trusted for delegation
Constrained Delegation
S4U2Self + S4U2Proxy to impersonate users to allowed services
AD CS
ESC1
Enroll in misconfigured template allowing arbitrary SAN
ESC4
Modify vulnerable certificate template to enable ESC1
ESC8
Relay NTLM to ADCS HTTP enrollment endpoint
Persistence
DCShadow
Register rogue DC to push malicious changes via replication
Skeleton Key
Patch LSASS to accept master password for any account
AdminSDHolder
Modify AdminSDHolder ACL to persist admin access
SID History Injection
Inject privileged SID into user's SID history attribute
Coercion
PetitPotam
Coerce DC authentication via EfsRpcOpenFileRaw
PrinterBug
Coerce machine authentication via MS-RPRN SpoolService
DFSCoerce
Coerce machine authentication via MS-DFSNM