Lernzettel: Active Directory Exploitation Techniques

📋 Course Outline

1. Active Directory fundamentals
2. AS-REP roasting
3. Kerberoasting
4. GPO abuse and detection
5. DCSync attack
6. Golden Ticket attacks
7. Kerberos delegation abuse
8. RPC coercion attacks

📖 1. Active Directory fundamentals

🔑 Key Concepts & Definitions

• Active Directory : A directory service for Windows enterprise environments that centralizes management and provides authentication, authorization, and related directory functions.
• LDAP : A network protocol used for systems to communicate with Active Directory so clients can query and receive directory information from domain controllers.
• Domain Controller : A server role that administers an Active Directory domain and provides authentication and authorization with the highest authority within its directory environment.
• NTDS.DIT : An Active Directory data-store database file stored by domain controllers in %SystemRoot%\NTDS that holds directory information for users and services.
• Organizational Unit : A logical container in Active Directory used to organize users, groups, computers, and other OUs for permissioning and policy targeting.

📝 Essential Points

• A domain is a set of objects sharing the same Active Directory database, while a tree groups one or more domains and a forest groups multiple trees.
• A forest’s topmost domain contains Enterprise Admins, giving permissions across all domains in the forest.
• Active Directory compromise can break CIA by granting attackers unrestricted access to all systems and data that rely on AD authentication and authorization.
• Domain controllers run LDAP and listen for directory requests from the network, and queries can request object details or group memberships.
• Active Directory stores Group Policy Objects settings in SYSVOL, where clients access them over SMB and refresh by default about every 90 minutes.

💡 Memory Hook

AD is the “identity hub”: if it’s compromised, every app and system trusting AD can be fully controlled.

📖 2. AS-REP roasting

🔑 Key Concepts & Definitions

• AS-REP roasting : AS-REP roasting is a post-exploitation Kerberos attack that extracts crackable material for user accounts with Kerberos preauthentication disabled.
• Kerberos preauthentication disabled : Kerberos preauthentication disabled is a Kerberos setting that allows a client to receive an AS-REP even without proving knowledge of the user’s credentials first.
• Rubeus asreproast action : Rubeus asreproast action is a Kerberos enumeration and extraction feature that requests AS-REQ without preauthentication and writes the resulting hashes to a file.
• AS-REP roastable hash : AS-REP roastable hash is the extracted Kerberos AS-REP-derived data that can be cracked offline to recover the user password.

📝 Essential Points

• AS-REP roasting targets user accounts where Kerberos preauthentication is not required, then cracks the account password offline if the recovered candidate opens the hash.
• Rubeus requests an AS-REQ without preauth and writes roasted hashes to a file on the source machine.
• For hashcat recognition, edit the exported hash by adding 23$immediately after the$krb5asrep$ tag before cracking.
• AS-REPRoastable hashes are cracked with hashcat using mode 18200 and a dictionary file.
• During execution, AD logs Kerberos authentication activity with event ID 4768, which is frequent and usually needs correlation by source device/VLAN.

💡 Memory Hook

AS-REP roasting works when Kerberos asks for no preauth—so the “AS” reply becomes a crackable secret.

📖 3. Kerberoasting

🔑 Key Concepts & Definitions

• Service Principal Name SPN : A service principal name is a unique identifier for a Kerberos service instance used to bind a service instance to a service logon account.
• Kerberoastable service ticket : A kerberoastable ticket is a Kerberos TGS service ticket encrypted using the service account’s NTLM password hash, enabling offline cracking attempts.
• TGS offline password cracking : Offline password cracking is testing candidate passwords against the encrypted ticket data to recover the service account password when verification succeeds.
• Kerberos encryption type downgrades : A Kerberos encryption type downgrade is an attacker-forced fallback to weaker ticket encryption such as RC4 instead of the strongest option supported by the KDC.
• Rubeus kerberoast extraction : Rubeus kerberoast extraction is collecting TGS tickets for every user with an SPN registered and writing the resulting crackable material to an output file.

📝 Essential Points

• A Kerberos TGS request yields a ticket encrypted with the service account’s NTLM password hash, which allows offline cracking of that service password.
• Kerberoasting success depends on the service account password strength and on the ticket encryption algorithm used.
• AES tickets crack more slowly than RC4 and DES, so environments still generating legacy encryption are more vulnerable.
• When running Rubeus with kerberoast without a user, it searches LDAP for users with SPNs (excluding krbtgt) and can extract tickets for many accounts.
• Rubeus can force RC4_HMAC by using /ticket or /tgtdeleg for selected accounts, even when only stronger etypes are otherwise produced.

💡 Memory Hook

SPN → TGS encrypted with service NTLM hash → crack ticket offline: weaker etype (RC4) cracks faster than AES.

📖 4. GPO abuse and detection

🔑 Key Concepts & Definitions

• Group Policy Object : A Group Policy Object is a named container of policy settings that can be linked to an AD Organizational Unit to apply to objects in that OU and its child OUs.
• GPO permission delegation : GPO permission delegation is an arrangement where non-admin accounts are allowed to edit GPOs or their permissions, enabling attackers to modify deployed startup scripts or scheduled tasks.
• Directory Service Changes auditing : Directory Service Changes auditing is an AD logging capability that records directory changes such as GPO modifications with a specific security event ID.
• Event ID 5136 : Event ID 5136 is the security audit record generated when a directory service change occurs, including modifications to a GPO.
• Honeypot GPO : A honeypot GPO is an intentionally monitored, misconfigured or bait GPO whose modification attempts are used to trigger defensive actions like disabling the modifying user.

📝 Essential Points

• GPOs are applied to computer and user objects by OU linkage, including objects in child OUs.
• If Directory Service Changes auditing is enabled, modifying a GPO generates Security event ID 5136.
• GPO edit delegation to groups like Authenticated Users or Domain Users lets a compromised user add startup scripts or scheduled tasks that execute on all linked computers.
• Lock down both who can modify GPOs and the NTFS permissions on any network-shared files they deploy, since a file replacement can lead to execution of attacker code.
• A honeypot trap can backfire if real-time mitigation is not possible once a future escalation path via the bait GPO is discovered.

💡 Memory Hook

GPO tampering leaves a paper trail: watch for Security event 5136.

📖 5. DCSync attack

🔑 Key Concepts & Definitions

• DCSync : An AD attack where an adversary impersonates a Domain Controller to trigger replication from a target Domain Controller and extract password hashes.
• Replicating Directory Changes : A replication-related permission that allows an account or computer to request directory changes from a Domain Controller.
• Replicating Directory Changes All : An expanded replication permission that allows broader directory change replication rights used to support DCSync.
• lsadump::dcsync : A Mimikatz command that performs DCSync to retrieve password hashes for a specified user or for all users with /all.
• RPC Firewall : A third-party control that can block or allow specific RPC calls with granular rules, including restricting replication to Domain Controllers.

📝 Essential Points

• DCSync can be executed from a user account or a computer as long as the caller has Replicating Directory Changes and Replicating Directory Changes All permissions.
• In Mimikatz, lsadump::dcsync can take a specific /user to extract that account’s hash, or use /all to dump hashes for the entire AD environment.
• Preventing DCSync out of the box is not possible because replication is normal between Domain Controllers, so controls must restrict dangerous RPC activity.
• DCSync detection can be based on event ID 4662 produced by Domain Controller replication, with the initiator account checked to see whether it is a Domain Controller.

💡 Memory Hook

Replication is normal, so DCSync is “fake DC replication”: block the RPCs, and watch 4662 with a non-DC initiator.

📖 6. Golden Ticket attacks

🔑 Key Concepts & Definitions

• Golden ticket : A forged Kerberos ticket that attackers craft to impersonate a privileged user by abusing Kerberos trust relationships within a domain.
• Domain SID : A unique identifier for an Active Directory domain that is used as input when generating tickets tied to that domain.
• Mimikatz kerberos::golden : A Mimikatz module that forges Kerberos tickets using domain, SID, user identity, krbtgt material, and lifetime parameters.
• Pass The Ticket : A technique where a generated ticket is injected into the current logon session so subsequent commands use it immediately.
• krbtgt password reset : A defensive change that rotates the krbtgt secret so previously forged tickets no longer validate against the KDC.

📝 Essential Points

• Golden Ticket creation uses the Domain SID (via PowerView Get-DomainSID) plus Mimikatz kerberos::golden parameters like /domain, /sid, /user, /id, /renewmax, /endin, and /ptt to inject the result.
• After injecting with /ptt, klist shows a ticket where the Server is krbtgt/<domain> and with flags including forwardable and renewable for the impersonated account.
• In the demonstrated case, the forged Administrator ticket lifetime values used were /renewmax:7 and /endin:8, and the ticket was then verified by listing \dc1\c$ with the current session.
• Because the KDC uses the same ticket-generation procedure, prevention of forged tickets is difficult, so practical mitigation relies on rotating krbtgt (and, for full forest compromise, resetting it twice per domain).
• When resetting krbtgt twice, the old password history is cleared (history value 2), and the two resets should be at least 10 hours apart to avoid breaking services due to ticket lifetime.

💡 Memory Hook

Golden Ticket = forged krbtgt TGT → inject with /ptt → prove it by using klist then touching \DC\C$.

📖 7. Kerberos delegation abuse

🔑 Key Concepts & Definitions

• Unconstrained delegation : A Kerberos delegation setting that allows a server to cache a victim’s TGT in memory when it is used to access that server.
• TGT caching : The process where a delegated server stores a Kerberos ticket (TGT) in memory so it can later be extracted and reused for authentication.
• Resource-Based Kerberos Delegation : A delegation configuration where the target resource is set up to permit Kerberos delegation for a specific relayed machine.
• Unconstrained Delegation coercion : A coercion follow-up where an attacker forces authentication to an Unconstrained Delegation server to obtain usable Kerberos tickets.
• TICKET import (ptt) : An action that loads a Kerberos ticket into the current session so subsequent authentication can use it.

📝 Essential Points

• Coercer’s Unconstrained Delegation follow-up requires administrative rights on a host already configured for Unconstrained Delegation.
• Unconstrained delegation hosts can be identified using Get-NetComputer with the -Unconstrained switch, with Domain Controllers trusted by default.
• After forcing coercion, Rubeus can monitor for newly issued TGTs and the operator can import one using Rubeus ptt /ticket.
• Once the TGT is imported, the attacker can authenticate within the domain and use DCSync with that delegated identity.
• Resource-Based Kerberos Delegation can be configured via relaying, enabling abuse to authenticate as any Administrator to the delegated machine.

💡 Memory Hook

UD = cache the TGT; RBCD = set the resource to trust your relayed machine for admin-grade Kerberos access.

📖 8. RPC coercion attacks

🔑 Key Concepts & Definitions

• Port 445 outbound attempt : Network behavior where an RPC coercion relies on a coerced host initiating outbound traffic to TCP 445 so the attacker can receive results.
• Port 139 fallback : Failover behavior where, if TCP 445 is blocked, the coerced host may attempt the connection using TCP 139 instead.
• Unexpected dropped traffic detection : Detection approach where unexpected firewall drops to TCP 139 or TCP 445 are treated as suspicious indicators of coercion attempts.
• Forced reverse connection : Coercion outcome where a target is made to connect back to an attacker-controlled system, enabling follow-on relaying.

📝 Essential Points

• If the inbound connection succeeds but outbound traffic to TCP 445 is dropped by the firewall, the attacker receives no coerced TGTs.
• When TCP 445 is blocked, the machine may switch to TCP 139, so blocking both ports 139 and 445 is recommended.
• Any unexpected dropped traffic to TCP 139 or TCP 445 is suspicious and can be used for detection.
• Using PrinterBug, the attacker forces a DC to connect to the attacker host, enabling relaying to ADCS for certificate issuance.

💡 Memory Hook

445 blocked? Coerced host tries 139 next—defend with “block 139 and 445” to stop the coercion path.

📅 Key Dates

📊 Synthesis Tables

AS-REP roasting vs Kerberoasting

⚠️ Common Pitfalls & Confusions

1. Confusing Kerberos components: KDC is split into AS and TGS, so you must match AS-REP roasting to AS-REQ/AS-REP (not TGS).
2. For AS-REP roasting, forgetting to add 23$after the$krb5asrep$ tag before hashcat recognition.
3. Assuming the KDC always returns the strongest enctype: both Kerberoasting and other flows may involve RC4/legacy options depending on how tickets are generated.
4. Mixing detection events: 4768 is Kerberos authentication activity and can be very abundant, so you must correlate by origin (device/VLAN/IP).
5. Thinking GPO modification detection always tells you what changed: 5136 signals a GPO was modified, but other related events (e.g., 4738) may omit property-level details.
6. Blocking only one coercion port: when TCP 445 is blocked, the flow can fall back to TCP 139, so defenses must cover both.
7. For Golden Tickets, thinking resetting krbtgt once is enough: for full mitigation in the forest scenario described, krbtgt must be reset twice per domain and spaced at least 10 hours apart.

✅ Exam Checklist

1. Define Active Directory, LDAP, Domain Controllers, and what NTDS.DIT stores, and distinguish domain vs tree vs forest.
2. Explain why an Active Directory compromise breaks CIA, and state how GPO settings reach clients from SYSVOL (including the ~90-minute refresh).
3. For AS-REP roasting: state the required account condition (preauthentication not required), the Rubeus asreproast purpose, and the hashcat preparation (add 23$after$krb5asrep$) plus mode 18200.
4. For Kerberoasting: state what an SPN is, how the TGS becomes crackable offline (encrypted with service account NTLM hash), and how enctype choice affects cracking speed (AES vs RC4).
5. For GPO abuse/detection: describe OU linkage for application, how Security event 5136 is generated when Directory Service Changes auditing is enabled, and why NTFS permissions on deployed files matter.
6. For DCSync: list required replication permissions (Replicating Directory Changes and Replicating Directory Changes All), the lsadump::dcsync /user vs /all behavior, and the detection idea using event 4662 with non-DC initiator.
7. For Golden Tickets: state what inputs are needed (domain SID, krbtgt material, user identity/lifetime, /ptt injection), how you verify with klist, and the mitigation approach (rotate krbtgt; twice per domain) and the 10-hour spacing detail.
8. For Kerberos delegation abuse: contrast Unconstrained delegation (TGT caching) and Resource-Based Kerberos Delegation at a high level, and explain how coercion leads to TGT import (Rubeus ptt).
9. For RPC coercion defenses/detection: describe what happens when TCP 445 outbound is dropped, the TCP 139 fallback, and the detection idea of unexpected dropped traffic.
10. For Kerberos constrained delegation abuse: describe the S4U-based ticket request on behalf of a user to services and the prevention steps (Account is sensitive/cannot be delegated; Protected Users).