Active Directory Attacks

原文涵盖的主题

• Active Directory Attacks
• Purpose
• Inputs/Prerequisites
• Outputs/Deliverables
• Essential Tools
• Core Workflow
• Step 1: Kerberos Clock Sync
• Step 2: AD Reconnaissance with BloodHound

Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing. Kali Linux or Windows attack platform Domain user credentials (for most attacks) Network access to Domain Controller Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec Domain enumeration data Extracted credentials and hashes Kerberos tickets for impersonation Domain Administrator access Persistent access mechanisms -- | Tool | Purpose | |------|---------| | BloodHound | AD attack path visualization | | Impacket | Python AD attack tools | | Mimikatz | Credential extraction | | Rubeus | Kerberos attacks | | CrackMapExec | Network exploitation | | PowerView | AD enumeration | | Responder | LLMNR/NBT-NS poisoning | -- Kerberos requires clock synchronization (±5 minutes): -- Extract service account TGS tickets and crack offline: Target accounts with "Do not require Kerberos preauthentication": Extract credentials directly from DC (requires Replicating Directory Changes rights): -- Forge TGT with krbtgt hash for any user:

这里只展示节选，请以完整原文和当前要求为准。