# Active Directory Authentication Attacks

> Password spraying, Kerberoasting, AS-REP Roasting, NTLM relay, ADCS abuse, delegation exploitation, and ACL-based privilege escalation.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 5
- **Published:** 2026-09-25
- **Updated:** 2026-09-27

Active Directory authentication relies on Kerberos, NTLM, and certificates. Each mechanism has exploitable weaknesses. PEN-200 covers password spraying, Kerberoasting, AS-REP Roasting, NTLM relay, ADCS abuse, delegation exploitation, and ACL-based privilege escalation. These attacks turn a single domain account into Domain Admin credentials.

## Password and Credential Attacks

Password spraying uses the password policy (from Module 17 enumeration) to try common passwords across all domain accounts without triggering lockouts. Responder and Inveigh capture NTLMv2 hashes from the network for offline cracking. Once you have credentials, ForceChangePassword on vulnerable accounts, gMSA password extraction, and LAPS reads expand access further. DCSync with replication rights dumps every hash in the domain.

## Kerberos and Certificate Exploitation

Kerberoasting requests service tickets for SPN-bearing accounts and cracks them offline. AS-REP Roasting targets accounts without pre-authentication. Delegation misconfigurations (unconstrained, constrained, RBCD) allow ticket forging for privileged services. ADCS misconfigurations (ESC1 through ESC10+) let you request certificates that authenticate as any domain user. Coercion attacks (PetitPotam, PrinterBug) force machine authentication for relay or delegation capture.

## NTLM Relay and Privilege Escalation

NTLM relay forwards captured authentication to targets where signing is not enforced: SMB for command execution, LDAP for RBCD setup, or ADCS for certificate requests. ACL abuse (GenericAll, WriteDACL, WriteOwner) grants yourself privileges on domain objects. Shadow credentials, GPO abuse, privileged group membership, and sAMAccountName spoofing (noPac) provide additional escalation paths to Domain Admin.

## Study material

- [Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying.md) (read, core)
- [Credential Capture with Responder](https://hackindex.io/platforms/active-directory/exploitation/ad-credential-capture-with-responder.md) (read, core)
- [AD Password Cracking Strategies](https://hackindex.io/platforms/active-directory/privilege-escalation/ad-password-cracking-strategies.md) (read, core)
- [Password Attacks and Credential Abuse](https://hackindex.io/platforms/active-directory/privilege-escalation/ad-password-attacks-and-credential-abuse.md) (read, core)
- [Kerberoasting](https://hackindex.io/platforms/active-directory/exploitation/kerberoasting.md) (read, core)
- [AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting.md) (read, core)
- [Kerberos Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/kerberos-abuse-privilege-escalation.md) (read, core)
- [Delegation Misconfiguration Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ad-delegation-misconfiguration-discovery.md) (read, core)
- [Unconstrained Delegation Abuse – TGT Capture](https://hackindex.io/platforms/active-directory/exploitation/unconstrained-delegation-abuse.md) (read, core)
- [Constrained Delegation Abuse – S4U Impersonation](https://hackindex.io/platforms/active-directory/exploitation/constrained-delegation-abuse.md) (read, core)
- [RBCD – Resource-Based Constrained Delegation Abuse](https://hackindex.io/platforms/active-directory/exploitation/rbcd-resource-based-constrained-delegation.md) (read, core)
- [ADCS Misconfiguration Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery/adcs-misconfiguration-discovery.md) (read, core)
- [ADCS Exploitation: ESC1, ESC4, ESC6, ESC8](https://hackindex.io/platforms/active-directory/exploitation/adcs-exploitation.md) (read, core)
- [ADCS Exploitation: ESC2, ESC3, ESC5, ESC7](https://hackindex.io/platforms/active-directory/exploitation/adcs-esc2-esc3-esc5-esc7.md) (read, core)
- [ESC8 — NTLM Relay to AD CS Web Enrollment](https://hackindex.io/platforms/active-directory/exploitation/adcs-esc8-ntlm-relay.md) (read, core)
- [ADCS Exploitation: ESC9 and ESC10](https://hackindex.io/platforms/active-directory/exploitation/adcs-esc9-esc10.md) (read, core)
- [Coercion Attacks in Active Directory](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-attacks.md) (read, core)
- [Coercer and PetitPotam — Active Directory Coercion Frameworks](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-with-coercer-and-petitpotam.md) (read, core)
- [NTLM Relay Conditions](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ntlm-relay-conditions.md) (read, core)
- [NTLM Relay in Active Directory](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay.md) (read, core)
- [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation.md) (read, core)
- [Shadow Credentials](https://hackindex.io/platforms/active-directory/exploitation/shadow-credentials-exploitation.md) (read, core)
- [NoPac: sAMAccountName Spoofing](https://hackindex.io/platforms/active-directory/exploitation/nopac-samaccountname-spoofing.md) (read, core)
- [GPO Abuse](https://hackindex.io/platforms/active-directory/exploitation/ad-gpo-abuse.md) (read, core)
- [Group Membership Exploitation](https://hackindex.io/platforms/active-directory/exploitation/ad-group-membership-exploitation.md) (read, core)
- [Privileged Group Abuse](https://hackindex.io/platforms/active-directory/privilege-escalation/ad-privileged-group-abuse.md) (read, core)
- [DNSAdmins Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/dnsadmins-privilege-escalation.md) (read, core)
- [Backup Operators and Server Operators Abuse](https://hackindex.io/platforms/active-directory/privilege-escalation/backup-operators-and-server-operators.md) (read, core)
- [DCSync and Domain Takeover](https://hackindex.io/platforms/active-directory/exploitation/active-directory-dcsync-and-domain-takeover.md) (read, core)