Active Directory Attacks

Topics in the source

• Active Directory Attacks
• Purpose
• Inputs/Prerequisites
• Outputs/Deliverables
• Essential Tools
• Core Workflow
• Step 1: Kerberos Clock Sync
• Step 2: AD Reconnaissance with BloodHound

Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing. Kali Linux or Windows attack platform Domain user credentials (for most attacks) Network access to Domain Controller Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec Domain enumeration data Extracted credentials and hashes Kerberos tickets for impersonation Domain Administrator access Persistent access mechanisms -- | Tool | Purpose | |------|---------| | BloodHound | AD attack path visualization | | Impacket | Python AD attack tools | | Mimikatz | Credential extraction | | Rubeus | Kerberos attacks | | CrackMapExec | Network exploitation | | PowerView | AD enumeration | | Responder | LLMNR/NBT-NS poisoning | -- Kerberos requires clock synchronization (±5 minutes): -- Extract service account TGS tickets and crack offline: Target accounts with "Do not require Kerberos preauthentication": Extract credentials directly from DC (requires Replicating Directory Changes rights): -- Forge TGT with krbtgt hash for any user:

This is an excerpt. Refer to the complete source and its current requirements.