Active Directory Penetration Testing

Attack-path-driven assessment of on-prem AD (typically assumed-breach: you start with a low-priv foothold and work toward Domain Admin / specific objectives). Mapped to MITRE ATT&CK. Every technique lists its detection signal so defenders can catch it.

0. Authorization gate

• Written scope: domain(s), foothold provided, objectives (DA / specific data).
• DCSync / credential-dumping explicitly authorized (high impact).
• Data-handling + cleanup (remove any created objects/accounts) agreed.

1. Enumeration (map the terrain)

• Domain/forest structure, trusts, OUs, users, groups, computers, GPOs, ACLs.
• Build the attack graph: who can reach Domain Admin via group membership, ACLs, sessions, or delegation. (BloodHound-style graph analysis is central — see vuln-chaining for path reasoning.)
• Find high-value targets: DAs, service accounts, privileged sessions, unconstrained-delegation hosts.

2. Kerberos attacks

• Kerberoasting: request service tickets for SPN accounts → offline crack weak service-account passwords. Detect: anomalous TGS requests / RC4.
• AS-REP roasting: accounts without pre-auth → crackable. Detect: AS-REQ without pre-auth.
• Delegation abuse: unconstrained (capture TGTs), constrained, and resource-based constrained delegation → impersonation. Detect: unusual S4U / TGT use.
• Fix: strong/managed service-account passwords (gMSA), require pre-auth, remove/limit delegation, tier-0 isolation.

3. Credential access

• NTLM hash capture (pair with network-pentest relay/poisoning), LSASS credential extraction (authorized), DPAPI, cached creds.
• DCSync (replicate directory secrets) with sufficient rights → domain-wide compromise.
• Fix: Credential Guard, LSASS protection, restrict replication rights, tiered admin model, LAPS for local admin passwords.

4. ACL, GPO & object abuse

• Dangerous ACLs (GenericAll/WriteDACL/WriteOwner, force-change-password rights) create escalation edges.
• GPO edit rights → code execution across linked OUs.
• Fix: audit and tighten ACLs, restrict GPO edit rights, monitor privileged object changes.

5. Persistence & domain dominance (document, don't linger)

Golden/Silver ticket concepts, AdminSDHolder, DCShadow — understand for detection guidance; in engagements, prove capability and document rather than establishing lasting persistence.

• Fix: krbtgt rotation (twice), tier-0 protection, monitoring of directory-level changes.

6. Trusts

• Enumerate domain/forest trusts; assess cross-domain/forest escalation paths.
• Fix: SID filtering, selective authentication, minimize trusts.

7. Tooling

BloodHound/SharpHound (attack graph), PowerView, impacket (secretsdump, GetUserSPNs, ntlmrelayx), Rubeus, certipy (AD CS — ESC1–ESC8). Follow RoE.

8. AD CS (certificate services)

Test for ESC1–ESC8 template/permission misconfigurations enabling privilege escalation via certificate abuse. Fix: harden certificate templates, restrict enrollment, monitor issuance.

9. Reporting & correlation

Present findings as attack paths, not isolated issues (foothold → step → step → DA), with the single highest-leverage fixes that break the most paths. Route path reasoning to vuln-chaining, priv-esc to privilege-escalation, cloud-identity to entra-cloud-pentest. Checklist: references/ad-checklist.md.

<sub>© 2026 noahfranklin · Part of the Gideon security suite · MIT License · Original work.</sub>