Active Directory red teaming

Meant for after the OSCP or alongside CRTP, CRTO or CPTS. Each stage adds a family of attacks and practises it on boxes where it is the main path.

Level
You can already escalate on Windows and have seen Kerberos
Rough duration
8-10 weeks at about 10 h a week
By the end you will
Read a BloodHound graph and chain ACLs, certificates and delegation to Domain Admin without relying on a single trick.
Your progress 0 of 57 steps

Continue with the next step →

  1. Stage 1 Basics: enumerate the domain 0/8

    Have a fixed routine with and without credentials, and know what to look for in BloodHound.

    1. Checklist Active Directory
    2. Guide Active Directory enumeration: users, LDAP, BloodHound and password spraying

      No credentials, password spraying and BloodHound step by step.

    3. Guide SMB and NFS enumeration: shares, null sessions and files full of passwords
    4. Cheat sheet Active Directory in depth › BloodHound
    5. Technique Domain LDAP/RPC enumeration

      Pick one or two machines from this technique's list.

    6. Machine Forest easy windows
    7. Machine Active easy windows
    8. Machine Sauna easy windows

  2. Stage 2 Credentials and Kerberos 0/9

    Obtain and reuse credentials: roasting, spraying, LDAP attributes and secrets in files.

    1. Guide Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory
    2. Technique Kerberoasting

      Pick one or two machines from this technique's list.

    3. Technique AS-REP roasting

      Pick one or two machines from this technique's list.

    4. Technique Password spraying and valid users

      Pick one or two machines from this technique's list.

    5. Guide Hash cracking with hashcat and John the Ripper: modes, rules, masks and protected files
    6. Machine Cascade medium windows

      A password in an LDAP attribute and the AD Recycle Bin.

    7. Machine Resolute medium windows

      Spraying a leaked password and the DnsAdmins group.

    8. Machine Monteverde medium windows
    9. Machine Timelapse easy windows

  3. Stage 3 ACLs, delegation and shadow credentials 0/11

    Abuse object permissions and Kerberos delegation (RBCD included).

    1. Guide Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync

      What to do with each BloodHound edge.

    2. Guide Kerberos delegation: unconstrained, constrained and RBCD explained and exploited
    3. Cheat sheet Active Directory in depth › Delegation
    4. Technique ACL abuse (BloodHound)

      Pick one or two machines from this technique's list.

    5. Technique Kerberos delegation (RBCD)

      Pick one or two machines from this technique's list.

    6. Technique Shadow Credentials

      Pick one or two machines from this technique's list.

    7. Machine Administrator medium windows

      A textbook ACL chain to DCSync.

    8. Machine Support easy windows

      RBCD from a group with GenericAll over the DC.

    9. Machine Intelligence medium windows

      gMSA and constrained delegation.

    10. Machine Outdated medium windows
    11. Machine Certified medium windows

  4. Stage 4 Certificates (ADCS) 0/7

    Spot and exploit vulnerable ADCS templates and settings with Certipy.

    1. Cheat sheet Active Directory in depth › ADCS (ESC1–16)
    2. Guide ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)

      From ESC1 to ESC16 with Certipy 5.

    3. Technique ADCS (certificates)

      Pick one or two machines from this technique's list.

    4. Machine Escape medium windows

      ESC1 after capturing a hash from MSSQL.

    5. Machine Authority medium windows
    6. Machine EscapeTwo easy windows
    7. Machine Fluffy easy windows

  5. Stage 5 Relay and coercion 0/6

    Understand when NTLM can be relayed and how to coerce authentications.

    1. Cheat sheet Active Directory in depth › NTLM relay
    2. Guide NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam
    3. Guide MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft
    4. Technique NTLM capture and relay

      Pick one or two machines from this technique's list.

    5. Technique MSSQL abuse

      Pick one or two machines from this technique's list.

    6. Machine Querier medium windows

      Force an authentication to your box from MSSQL.

  6. Stage 6 Lateral movement, C2 and evasion 0/11

    Move between hosts, dump credentials and understand what detects you and why.

    1. Guide Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI
    2. Guide Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit
    3. Cheat sheet Impacket / NetExec builder
    4. Cheat sheet C2 and post-exploitation
    5. Cheat sheet Evasion explained: AMSI, ETW and AppLocker
    6. Guide How antivirus and EDR detect you on Windows: AMSI, ETW, hooks, AppLocker and CLM explained

      How detection works (AMSI, ETW, hooks, AppLocker) before you try to get around it.

    7. Technique SAM/LSA/LSASS dumping

      Pick one or two machines from this technique's list.

    8. Technique AV and EDR evasion

      Pick one or two machines from this technique's list.

    9. Technique AppLocker and Constrained Language Mode

      Pick one or two machines from this technique's list.

    10. Machine Blackfield hard windows

      LSASS dump and SeBackupPrivilege to read NTDS.dit.

    11. Machine Scrambled medium windows

      Kerberos only (no NTLM) and a silver ticket.

  7. Stage 7 Full domains and trusts 0/5

    Long boxes mixing everything above, like a real red team exercise.

    1. Technique Domain and forest trusts

      Pick one or two machines from this technique's list.

    2. Technique DCSync

      Pick one or two machines from this technique's list.

    3. Machine Vintage hard windows
    4. Machine Mantis hard windows
    5. Machine Sizzle insane windows