Active Directory Lateral Movement

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

• Mark Pass-the-Hash and Pass-the-Ticket as done
  Guide 5 min read

  Pass-the-Hash and Pass-the-Ticket

  Focus on #Pass-the-Hash with nxc #Pass-the-Hash with impacket #Pass-the-Hash with evil-winrm #Pass-the-Ticket: inject a ccache ticket #Over-Pass-the-Hash
• Mark Pass-the-Ticket and Overpass-the-Hash as done
  Guide 4 min read

  Pass-the-Ticket and Overpass-the-Hash

  Focus on #Stealing Tickets from a Compromised Host #Converting Tickets Between Formats #Using a Ticket on Linux #Injecting a Ticket on Windows with Rubeus #Overpass-the-Hash #Extract a Usable TGT from the Current Session (tgtdeleg)
• Mark Remote Execution in Active Directory as done
  Guide 4 min read

  Remote Execution in Active Directory

  Focus on #WMI execution #PSExec #SMBExec #WinRM execution #nxc command execution #AD remote execution method comparison
• Mark DCOM Lateral Movement as done
  Guide 3 min read

  DCOM Lateral Movement

  Focus on #Semi-interactive shell via DCOM #Pass-the-Hash #Single command execution
• Mark Pass-the-Certificate as done
  Guide 4 min read

  Pass-the-Certificate

  Focus on #Authenticate via PKINIT: get TGT or NT hash #Lateral movement with the obtained TGT #NTLM-restricted environments
• Mark Pass-the-Hash and Pass-the-Ticket as done
  Guide 4 min read

  Pass-the-Hash and Pass-the-Ticket

  Focus on #Pass-the-Hash with impacket #Pass-the-Hash with native Windows tools #Pass-the-Ticket with Kerberos TGTs
• Mark Overpass-the-Hash and Token Impersonation as done
  Guide 4 min read

  Overpass-the-Hash and Token Impersonation

  Focus on #Overpass-the-Hash #Token impersonation for lateral movement #Finding tokens worth stealing #Make-Token: creating tokens from credentials
• Mark PsExec and SMB Lateral Movement as done
  Guide 4 min read

  PsExec and SMB Lateral Movement

  Focus on #Impacket psexec #Impacket smbexec and wmiexec #Sysinternals PsExec #SMB file access and share operations #Spraying credentials across multiple hosts
• Mark WMI Remote Execution for Lateral Movement as done
  Guide 4 min read

  WMI Remote Execution for Lateral Movement

  Focus on #wmic: built-in command line #PowerShell WMI remoting #Impacket wmiexec: interactive shell #WMI event subscription for execution
• Mark WinRM and PowerShell Remoting Lateral Movement as done
  Guide 5 min read

  WinRM and PowerShell Remoting Lateral Movement

  Focus on #Evil-WinRM: interactive shell from Linux #PowerShell Remoting from Windows #Checking WinRM access before connecting #Impacket WinRM
• Mark RDP Hijacking and Credential Reuse as done
  Guide 2 min read

  RDP Hijacking and Credential Reuse

  Focus on #RDP access with credentials #RDP session hijacking #Enabling RDP remotely #RDP port forwarding when 3389 is not directly reachable
• Mark Golden Ticket and Silver Ticket Attacks as done
  Guide 4 min read

  Golden Ticket and Silver Ticket Attacks

  Focus on #Golden Ticket: What You Need #Getting the krbtgt Hash and Domain SID #Forging a Golden Ticket with Mimikatz #Silver Ticket: What You Need #Service Name Substitution (AnySPN)
• Mark Golden and Silver Ticket Persistence as done
  Guide 4 min read

  Golden and Silver Ticket Persistence

  Focus on #Golden Ticket: domain-wide persistence #Silver Ticket: service-specific persistence #Diamond Ticket: harder to detect than Golden
• Mark Credential Harvesting as done
  Guide 6 min read

  Credential Harvesting

  Focus on #LAPS passwords #gMSA passwords #NTDS.dit: full domain hash dump #LSASS: local credentials from memory #Credential search across the domain
• Mark Situational Awareness as done
  Guide 4 min read

  Situational Awareness

  Focus on #Confirm current access level #Domain and forest trusts #Active sessions and logged-in users #Domain controller discovery
• Mark Domain Trust Abuse as done
  Guide 4 min read

  Domain Trust Abuse

  Focus on #Enumerate trusts #Collect required material from child domain #Forge inter-realm ticket with SID history injection #SID filtering
• Mark Cross-Forest Trust Abuse as done
  Guide 6 min read

  Cross-Forest Trust Abuse

  Focus on #Enumerate cross-forest trusts and target forest structure #Kerberoasting across the trust #Authenticate to trusted forest with cracked credentials #Trust account hash: inter-realm ticket forging
• Mark Account and ACL Persistence as done
  Guide 4 min read

  Account and ACL Persistence

  Focus on #Backdoor domain account #DCSync rights as persistent backdoor #GenericAll on AdminSDHolder #Shadow Credentials as persistence
• Mark ADCS Certificate Persistence as done
  Guide 5 min read

  ADCS Certificate Persistence

  Focus on #Obtain certificate for privileged account #Steal CA private key: forge any certificate #Certificate persistence via ESC3 (enrollment agent)
• Mark DSRM and Skeleton Key as done
  Guide 4 min read

  DSRM and Skeleton Key

  Focus on #DSRM: Directory Services Restore Mode backdoor #Skeleton Key
• Mark Mimikatz Active Directory Reference as done
  Guide 13 min read

  Mimikatz Active Directory Reference

  Focus on #Credential Extraction from LSASS (sekurlsa) #DCSync #Golden Ticket #Silver Ticket #Pass-the-Hash #Token Manipulation #DPAPI Credential Decryption #Skeleton Key #Common Workflows
• Mark Rubeus Active Directory Reference as done
  Guide 15 min read

  Rubeus Active Directory Reference

  Focus on #Ticket Triage, Listing and Extraction #Kerberoasting #AS-REP Roasting #Constrained Delegation Abuse (S4U) #Ticket Forgery #Pass-the-Ticket #Kerberos Password Spraying #Common Attack Chains
• Mark Certipy ADCS Exploitation Reference as done
  Guide 17 min read

  Certipy ADCS Exploitation Reference

  Focus on #Enumeration (find) #Certificate Authentication (auth) #ESC1: Enrollee Supplies Subject #ESC2: Any Purpose EKU #ESC3: Enrollment Agent #ESC4: Template ACL Abuse #ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2 #ESC7: CA Permission Abuse #ESC8: NTLM Relay to Web Enrollment #ESC9: No Security Extension on Template #ESC11: NTLM Relay to RPC Enrollment #ESC13: Issuance Policy Linked to Group #ESC15: Schema Version 1 Enrollee Subject (CVE-2024-49019) #ESC16: Security Extension Disabled on CA #ESC17: Server Authentication Enrollee Subject #Golden Certificate (forge) #Shadow Credentials #Common Attack Chains
• Mark bloodyAD Active Directory Attack Reference as done
  Guide 18 min read

  bloodyAD Active Directory Attack Reference

  Focus on #Enumeration and Target Selection #Password Reset and Account Takeover #Shadow Credentials (native) #Resource-Based Constrained Delegation (RBCD) #Granting DCSync Rights #BadSuccessor (dMSA abuse) #Certificate Mapping (altSecurityIdentities)

Practice

Apply the module hands-on.