Skip to content

AD Attack Paths

Lateral Movement

  • Offensive Lateral Movement The difficulty with lateral movement is doing it with good operational security (OpSec) which means generating the least amount of logs as possible, or generating logs that look normal. The purpose of this blog post is to not only show the techniques, but to show what is happening under the hood and any high-level indicators associated with them.

  • Kerberosity Killed the Domain: An Offensive Kerberos Overview This article is intended to give an overview of how Kerberos works and some of the more common attacks associated with it.

    • Roasting
    • Silver Ticket
    • Golden Ticket
    • Delegation attacks (out of scope)

  • The L in Linux Stands for Lateral Movement Only one protocol comes to mind — SSH. In this blog post, we’ll look at other protocols in Linux that can be used to achieve (or to help achieve) lateral movement.

  • Administrative tools and logon types A nightmare of variant and details. Practically important for understanding which network operations leave credentials in memory of the remote node.

Discovery

The Discovery Tactic is almost always used in conjunction with Lateral Movement.

Discovery is often called enumeration.

Tools for Windows machines

Bloodhound

"The" Discovery tool for Windows Active Directory: a game changer.

BloodHound-related tools;

  • Dealing with large BloodHound datasets. Discusses other tools similar to BloodHound, including BlueHound.

  • BloodHound tools.

    • ShotHound: Validate practical paths discovered by BloodHound.
    • Ransomulator: Simulate ransomware-like infection in your dataset.
    • DBCreator: Simulate BloodHound dataset, along with "Open" network access edges and unpatched vulnerabilities information.
    • CustomQueries: A list of common queries that reflect the network dimension, if it is integrated into the dataset.
    • VulnerabilitiesDataImport: Parse Vulnerability Scanners reports and enrich host nodes with information about unpatched vulnerabilities

  • FoxTerrier : On the trail of vulnerable Active Directory objects and a report. You use Sharphound/Bloodhound to collect data/audit your AD and you would like to generate report of vulnerable objects in your AD? You should give a look to FoxTerrier!

BloodHound-like tools:

Other tools for Active Directory environments

AD Attack paths

This is a huge topic.

  • The Phantom Menace: Exposing hidden risks through ACLs in Active Directory (Part 1) An excellent and concise description of ACLs in Active Directory (starting from what a Securable Object is) from an offensive point of view.

  • BloodHound Edges Perhaps the best way for understanding the breadth and depth of AD Attack paths is looking at how many edge types exist in BloodHound. This page is very interesting because it describes how the edge could be abused, the associated technical difficulty and some operational security (OpSec) consideration.

  • Internal All The Things Active Directory and Internal Pentest Cheatsheets. Lots of useful step-by-step examples.

  • Attacking Active Directory: 0 to 0. Nice description of many Windows topics, including Active Directory, Access Rights and so on.

Certified Pre-Owned

This is just one of the many families of AD Attack Paths.

Demo video

Demo of four different AD attack paths, with considerations about their OPSEC (i.e., ability to remain undetected). Slides and one hour video.

  1. Kerberoasting, Pass the ticket, Dump ticket from Logon session and other
  2. Certificate Template Abuse, PKINIT authentication, Unconstrained delegation (this step out of scope), DCSync that is domain controller replication
  3. Password spray, Overprivilege + Shadow credential, UnPAC the hash + Silver Ticket, Golden Ticket
  4. Coerced authentication, NTLM Relay + Shadow credentials, DCSync + Diamond Ticket, SID-history infection (last steps out of scope)

Relaying

APPENDIX - AD Defense guidance

In my modest opinion, a lost battle.

Look for example at the blog post presenting the Microsoft Digital Defense Report 2022: "This chart shows the percentage of impacted customers missing basic security controls which are critical to increasing organizational cyber resilience. Findings are based on Microsoft engagements over the past year.". You will see that 90% of customers have an insecure AD configuration, 98% of customers do not use a tiered model, and the like. To me, this means that defending AD is a losing battle from the start.

Tools for checking common AD misconfigurations and obtain synthetic reports.

APPENDIX - Kerberos Delegation Abuses

Out of scope (but very, very interesting...)