# Exploitation

> AD exploitation guides covering Kerberos attacks, NTLM relay, ADCS, and DCS

- **URL:** https://hackindex.io/platforms/active-directory/exploitation
- **Platform:** [Active Directory](https://hackindex.io/platforms/active-directory.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

AD exploitation turns confirmed misconfigurations into domain access. ACL abuse chains, delegation attacks, ADCS certificate abuse, and DCSync are the high-impact paths covered here.

WriteDACL, GenericAll, and ForceChangePassword on the right objects let you escalate without touching a single exploit. ADCS ESC1 through ESC8 abuse misconfigured certificate templates and enrollment services to obtain certificates as any user. Resource-based constrained delegation lets you impersonate privileged accounts when you control a machine account.

DCSync extracts password hashes directly from the domain controller through replication, bypassing the need to touch NTDS.dit on disk.

## Guides

- [DCSync and Domain Takeover](https://hackindex.io/platforms/active-directory/exploitation/active-directory-dcsync-and-domain-takeover.md): Exploits DCSync attack via replication privileges to extract password hashes from AD, enabling credential theft and full domain compromise.
- [Coercion Attacks in Active Directory](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-attacks.md): Exploiting Windows authentication coercion techniques to capture or relay NTLM credentials via protocols like MS-RPRN, MS-EFSRPC, and PetitPotam.
- [Coercer and PetitPotam — Active Directory Coercion Frameworks](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-with-coercer-and-petitpotam.md): Exploits Windows authentication coercion via MS-EFSRPC and other RPC protocols to force machine account credential relay attacks in AD environments.
- [Credential Capture with Responder](https://hackindex.io/platforms/active-directory/exploitation/ad-credential-capture-with-responder.md): Capture NTLM hashes by poisoning LLMNR/NBT-NS/mDNS traffic using Responder, enabling offline cracking or relay attacks against AD environments.
- [GPO Abuse](https://hackindex.io/platforms/active-directory/exploitation/ad-gpo-abuse.md): Exploiting misconfigured Group Policy Objects in AD to push malicious settings, execute code, or escalate privileges across domain-joined systems.
- [Group Membership Exploitation](https://hackindex.io/platforms/active-directory/exploitation/ad-group-membership-exploitation.md): Exploits misconfigured AD group memberships to escalate privileges, move laterally, or gain unauthorized access to resources within a domain environment.
- [NTLM Relay in Active Directory](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay.md): Exploit NTLM authentication weaknesses to relay captured credentials against AD services, bypassing direct password cracking to gain unauthorised access.
- [Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying.md): Covers low-and-slow authentication attacks against AD accounts using common passwords to evade lockout policies and gain initial domain access.
- [ADCS Exploitation: ESC2, ESC3, ESC5, ESC7](https://hackindex.io/platforms/active-directory/exploitation/adcs-esc2-esc3-esc5-esc7.md): Exploiting misconfigured ADCS certificate templates and CA permissions (ESC2, ESC3, ESC5, ESC7) to escalate privileges or impersonate users in Active Directory.
- [ESC8 — NTLM Relay to AD CS Web Enrollment](https://hackindex.io/platforms/active-directory/exploitation/adcs-esc8-ntlm-relay.md): Exploit NTLM relay attacks targeting AD CS HTTP enrollment endpoints to obtain certificates for arbitrary principals and achieve privilege escalation.
- [ADCS Exploitation: ESC9 and ESC10](https://hackindex.io/platforms/active-directory/exploitation/adcs-esc9-esc10.md): Exploits ADCS misconfigurations ESC9 (no-security-extension) & ESC10 (weak mapping) to abuse certificate templates for privilege escalation in AD environments.
- [ADCS Exploitation: ESC1, ESC4, ESC6, ESC8](https://hackindex.io/platforms/active-directory/exploitation/adcs-exploitation.md): Exploiting Active Directory Certificate Services misconfigurations (ESC1-ESC8) to escalate privileges or achieve domain compromise via certificate abuse.
- [AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting.md): Exploit accounts with Kerberos pre-authentication disabled to capture AS-REP hashes offline for password cracking without domain credentials.
- [bloodyAD Active Directory Attack Reference](https://hackindex.io/platforms/active-directory/exploitation/bloodyad-active-directory-reference.md): Exploits Active Directory misconfigurations using bloodyAD; covers privilege escalation, ACL abuse, object manipulation, and lateral movement techniques.
- [Certipy ADCS Exploitation Reference](https://hackindex.io/platforms/active-directory/exploitation/certipy-adcs-exploitation-reference.md): Exploit Active Directory Certificate Services misconfigurations using Certipy; covers ESC1-ESC8 attack paths, certificate theft, and credential extraction.
- [Constrained Delegation Abuse – S4U Impersonation](https://hackindex.io/platforms/active-directory/exploitation/constrained-delegation-abuse.md): Exploit Kerberos S4U2Proxy/S4U2Self extensions to impersonate privileged users via misconfigured constrained delegation, enabling lateral movement within Active Directory environments.
- [Golden Ticket and Silver Ticket Attacks](https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket.md): Forge Kerberos TGTs (Golden) or service tickets (Silver) using stolen KRBTGT or service account hashes to achieve persistent, stealthy AD access.
- [Kerberoasting](https://hackindex.io/platforms/active-directory/exploitation/kerberoasting.md): Exploits Kerberos TGS ticket encryption to extract and offline brute-force service account password hashes in Active Directory environments.
- [Mimikatz Active Directory Reference](https://hackindex.io/platforms/active-directory/exploitation/mimikatz-active-directory-reference.md): Comprehensive Mimikatz commands for AD exploitation including credential dumping, pass-the-hash, Kerberos ticket attacks, and DCSync techniques.
- [NoPac: sAMAccountName Spoofing](https://hackindex.io/platforms/active-directory/exploitation/nopac-samaccountname-spoofing.md): Exploits CVE-2021-42278/42287 to spoof sAMAccountName, impersonate a DC, and obtain a TGT for privilege escalation in Active Directory.
- [RBCD – Resource-Based Constrained Delegation Abuse](https://hackindex.io/platforms/active-directory/exploitation/rbcd-resource-based-constrained-delegation.md): Abuses msDS-AllowedToActOnBehalfOfOtherIdentity to gain delegated access, enabling impersonation of privileged users against target AD computer objects.
- [Rubeus Active Directory Reference](https://hackindex.io/platforms/active-directory/exploitation/rubeus-active-directory-reference.md): Comprehensive Rubeus toolkit reference for AD exploitation: Kerberos attacks including AS-REP roasting, Kerberoasting, ticket harvesting, Pass-the-Ticket, and delegation abuse.
- [Shadow Credentials](https://hackindex.io/platforms/active-directory/exploitation/shadow-credentials-exploitation.md): Abuse msDS-KeyCredentialLink attribute to forge certificate-based authentication, enabling stealthy privilege escalation and persistence within Active Directory environments.
- [Unconstrained Delegation Abuse – TGT Capture](https://hackindex.io/platforms/active-directory/exploitation/unconstrained-delegation-abuse.md): Exploit unconstrained Kerberos delegation to capture TGTs from authenticating hosts, enabling lateral movement and privilege escalation within Active Directory environments.