Skip to content
HackIndex.io

PT2 · Module 7

Active Directory Fundamentals

Breach initial AD access through unauthenticated enumeration and spraying, map the domain with LDAP and BloodHound, then move laterally via PtH, PtT, and remote execution.

~12 h 10 resources Last updated October 4, 2026

Every modern internal network runs on Active Directory. PT2 assumes you can land initial access, map the domain, and move laterally end to end. This module covers the foundation: discovery before credentials, enumeration once you have them, the quickest ways to get credentials, and the lateral-movement primitives you use once you do.

Discovery Before Credentials

A reachable network already leaks everything you need to find the DCs: SRV records in DNS, SMB on 445, LDAP on 389/636, Kerberos on 88. Anonymous LDAP binds and null SMB sessions still work in many environments and surface domain name, forest root, and the computer account list.

Unauthenticated User Enumeration

Kerbrute validates usernames against the AS-REQ response without triggering lockouts. RID brute via lookupsid enumerates every account by SID when a null session is allowed. These lists feed every subsequent credential attack.

Initial Credentials

Password spraying (one common password across many users, slow enough to stay under per-account thresholds) is the primary breach primitive against modern AD. Responder on the local segment catches NTLM authentications from mistyped share names and LLMNR/NBT-NS lookups; captured NetNTLMv2 cracks offline or feeds the relay chain in Module 10.

Enumeration With Credentials

LDAP enumeration maps every object, group membership, and privilege. ACL enumeration finds objects you can write (one weak ACE often shortcuts to Domain Admin). GPO enumeration surfaces modifiable policies and credentials embedded in SYSVOL scripts.

Lateral Movement

Pass-the-Hash reuses NTLM hashes directly, no cracking needed. Pass-the-Ticket injects a Kerberos ccache. Over-the-Hash converts NTLM into a TGT when the environment blocks pure NTLM. For execution, choose by protocol posture: PsExec on SMB, WMIExec via DCOM, WinRM over 5985/5986. Each leaves different artifacts; pick what the target is least likely to monitor.

Chaining To The Next Module

This module gets you from zero to lateral movement with a user credential. The next (AD Exploitation & Persistence) covers escalating to Domain Admin, dumping NTDS, and persisting.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Practice

Apply the module hands-on.

All PT2 practice machines