--- name: cyberstrikeus/ad-security source: https://app.decimal.ai/s/cyberstrikeus-ad-security@1/SKILL.md source_sha256: c4cf9afa123f --- # Active Directory Security Testing ## Credential Access Techniques | ID | Technique | Tool | Description | | ----- | ---------------------- | ------------------------ | -------------------------------- | | CA-01 | Kerberoasting | GetUserSPNs.py, Rubeus | Request TGS for service accounts | | CA-02 | AS-REP Roasting | GetNPUsers.py, Rubeus | Attack accounts without preauth | | CA-03 | DCSync | secretsdump.py, Mimikatz | Replicate DC credentials | | CA-04 | LSASS Dump | Mimikatz, ProcDump | Extract credentials from memory | | CA-05 | SAM/SYSTEM Dump | secretsdump.py | Extract local credentials | | CA-06 | NTDS.dit Extraction | secretsdump.py | Offline DC credential dump | | CA-07 | Cached Credentials | Mimikatz | Extract cached domain creds | | CA-08 | DPAPI Secrets | Mimikatz, SharpDPAPI | Decrypt protected data | | CA-09 | Credential Vault | Mimikatz | Windows credential manager | | CA-10 | Browser Credentials | SharpChromium | Chrome/Edge saved passwords | | CA-11 | LLMNR/NBT-NS Poisoning | Responder | Capture NTLMv2 hashes | | CA-12 | NTLM Relay | ntlmrelayx.py | Relay captured authentication | | CA-13 | Password Spraying | Spray, Kerbrute | Test common passwords | | CA-14 | GPP Passwords | Get-GPPPassword | Decrypt Group Policy preferences | ## Privilege Escalation Techniques | ID | Technique | Tool | Description | | ----- | ------------------------------------- | --------------------- | ---------------------------------------- | | PE-01 | ACL Abuse | BloodHound, PowerView | WriteDACL, GenericAll abuse | | PE-02 | GPO Abuse | SharpGPOAbuse | Modify group policy | | PE-03 | AD CS ESC1 | Certipy | Template allows user SAN | | PE-04 | AD CS ESC2 | Certipy | Any purpose EKU | | PE-05 | AD CS ESC3 | Certipy | Enrollment agent abuse | | PE-06 | AD CS ESC4 | Certipy | Template ACL abuse | | PE-07 | AD CS ESC5 | Certipy | PKI object access control | | PE-08 | AD CS ESC6 | Certipy | EDITF_ATTRIBUTESUBJECTALTNAME2 | | PE-09 | AD CS ESC7 | Certipy | CA ACL abuse | | PE-10 | AD CS ESC8 | Certipy | NTLM relay to HTTP enrollment | | PE-11 | Constrained Delegation | Rubeus, getST.py | S4U2Self/S4U2Proxy abuse | | PE-12 | Resource-Based Constrained Delegation | Rubeus | msDS-AllowedToActOnBehalfOfOtherIdentity | ## Lateral Movement Techniques | ID | Technique | Tool | Description | | ----- | ----------------- | ---------------------- | ------------------------------- | | LM-01 | Pass-the-Hash | Mimikatz, pth-winexe | Authenticate with NTLM hash | | LM-02 | Pass-the-Ticket | Rubeus, Mimikatz | Inject Kerberos tickets | | LM-03 | Overpass-the-Hash | Rubeus | Request TGT with NTLM hash | | LM-04 | PSExec | Impacket, Sysinternals | Remote execution via SMB | | LM-05 | WMI Execution | wmiexec.py | Execute commands via WMI | | LM-06 | DCOM Execution | dcomexec.py | Distributed COM abuse | | LM-07 | WinRM | evil-winrm | PowerShell remoting | | LM-08 | RDP Hijacking | tscon.exe | Take over disconnected sessions | | LM-09 | SMB Relay | ntlmrelayx.py | Relay auth to other hosts | | LM-10 | SSH (Linux) | ssh | Lateral to Linux systems | ## Persistence Techniques | ID | Technique | Tool | Description | | ----- | --------------- | --------------------- | ------------------------------ | | PS-01 | Golden Ticket | Mimikatz, ticketer.py | Forge TGT with KRBTGT hash | | PS-02 | Silver Ticket | Mimikatz, ticketer.py | Forge TGS for specific service | | PS-03 | Diamond Ticket | Rubeus | Modify legitimate TGT | | PS-04 | Skeleton Key | Mimikatz | Master password on DC | | PS-05 | AdminSDHolder | PowerView | Persistent admin rights | | PS-06 | DCShadow | Mimikatz | Rogue domain controller | | PS-07 | SID History | Mimikatz | Add privileged SID to history | | PS-08 | Machine Account | Powermad | Add computer to domain | ## Enumeration Commands ### BloodHound Collection ```bash # SharpHound (Windows) SharpHound.exe -c All --zipfilename bloodhound.zip # BloodHound.py (Linux) bloodhound-python -d domain.local -u user -p pass -ns 10.0.0.1 -c all # NetExec BloodHound nxc ldap 10.0.0.1 -u user -p pass --bloodhound --collection All ``` ### LDAP Enumeration ```bash # Get domain info ldapsearch -x -H ldap://10.0.0.1 -D "user@domain.local" -w 'pass' -b "DC=domain,DC=local" # Find users with SPN (Kerberoastable) ldapsearch -x -H ldap://10.0.0.1 -D "user@domain.local" -w 'pass' \ -b "DC=domain,DC=local" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName # Find users without preauth (AS-REP Roastable) ldapsearch -x -H ldap://10.0.0.1 -D "user@domain.local" -w 'pass' \ -b "DC=domain,DC=local" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" ``` ### NetExec Commands ```bash # Enumerate users nxc smb 10.0.0.1 -u user -p pass --users # Enumerate groups nxc smb 10.0.0.1 -u user -p pass --groups # Find shares nxc smb 10.0.0.1 -u user -p pass --shares # Check for admin access nxc smb 10.0.0.0/24 -u user -p pass # Password spray nxc smb 10.0.0.1 -u users.txt -p 'Spring2024!' --no-bruteforce ``` ## Attack Paths ### Path 1: Domain User to Domain Admin ``` User Credential │ ├─► Kerberoast SPN accounts │ └─► Crack service account password │ └─► Service account is Domain Admin │ ├─► BloodHound Path Finding │ └─► ACL chain to DA group │ └─► WriteDACL → GenericAll → Add to DA │ └─► AD CS Misconfiguration └─► ESC1: Request cert as DA └─► Authenticate as DA ``` ### Path 2: Compromised Workstation to DC ``` Local Admin on Workstation │ ├─► LSASS dump → cached domain creds │ └─► Domain user credential │ └─► Continue as Path 1 │ ├─► Find admin sessions │ └─► Lateral move to server │ └─► Dump DA credentials │ └─► Unconstrained Delegation └─► Coerce DC authentication └─► Capture TGT → DCSync ``` ## Important Impacket Tools | Tool | Purpose | | -------------- | ------------------------------- | | GetUserSPNs.py | Kerberoasting | | GetNPUsers.py | AS-REP Roasting | | secretsdump.py | Dump secrets (DCSync, SAM, LSA) | | smbexec.py | SMB-based execution | | wmiexec.py | WMI-based execution | | psexec.py | PSExec-style execution | | ntlmrelayx.py | NTLM relay attacks | | getST.py | Request service tickets | | ticketer.py | Create Golden/Silver tickets | | lookupsid.py | SID enumeration | | samrdump.py | SAM Remote interface dump | ## Detection Evasion Considerations | Action | Detection | Evasion | | ------------- | --------------------- | ---------------------------- | | Kerberoasting | 4769 events (RC4) | Use AES encryption | | DCSync | 4662 events | Time-based, limit frequency | | Pass-the-Hash | 4624 Type 3 with NTLM | Overpass-the-Hash (Kerberos) | | BloodHound | LDAP queries | Reduce collection scope | | Mimikatz | AV signatures | BOF, custom tools |