Active Directory Attacks

Active Directory compromise almost never comes from an exploit. It comes from configuration: a service account with a weak password and an SPN, a user with pre-authentication disabled, an over-permissioned group, or a delegation setting nobody reviewed. Enumerate first, map the path, then take it.

Most Indian internal engagements end in domain admin, and they get there through the same handful of paths every time.

Enumerate before you touch anything

The single biggest difference between a junior and a senior on an internal test is how long they spend enumerating before acting. Map the domain first: users, groups, computers, group policy, trusts, ACLs and session data.

Graph the result. The path to domain admin is usually already visible in that graph before you send a single attack.

The attack paths that actually work

Kerberoasting

Any domain user can request a service ticket for an account with a service principal name. That ticket is encrypted with a key derived from the service account's password, so you crack it offline with no further contact with the domain.

Service accounts are the target because they often have old, human chosen passwords and excessive privileges. Full walkthrough in Kerberoasting explained.

AS-REP roasting

Accounts with Kerberos pre-authentication disabled hand out crackable material to anyone who asks, with no credentials required at all. Rarer than Kerberoasting and higher value when present, because you only need a valid username.

Password spraying

One common password against every account, slowly, rather than many passwords against one. Stays under lockout thresholds. Seasonal and company name based passwords still work at a depressing rate.

ACL abuse

The path people miss. Permissions on objects accumulate over years of helpdesk changes. A group with write rights over another group, or reset rights over a privileged user, is a full escalation path with no exploit involved.

Unconstrained and constrained delegation

A machine trusted for delegation caches tickets. Compromise it, wait for or coerce a privileged authentication, and you hold that identity. Constrained variants narrow the scope but rarely close it.

DCSync

With directory replication rights you ask a domain controller for password data as though you were another controller. Effectively game over, and worth auditing specifically because those rights get granted to service accounts by accident.

Credential harvesting and reuse

Local administrator password reuse across machines remains extremely common. One local admin hash often moves across a large part of the estate.

Order of operations on a real engagement

Work top to bottom. Starting noisy wastes the quiet options you still had.

What the defenders see

Worth knowing, because it makes you better on both sides and it belongs in your report.

• Kerberoasting: a burst of service ticket requests, especially with weak encryption types
• AS-REP roasting: authentication requests for pre-auth disabled accounts
• Password spraying: many failed logons across many accounts from one source
• DCSync: replication requests from a host that is not a domain controller

Detection engineering for exactly these is covered in the SOC analyst syllabus, and the two sides together in red team vs blue team.

Remediation worth writing in the report

1. Group managed service accounts, so service account passwords are long, random and rotated
2. Enable Kerberos pre-authentication everywhere
3. Audit and remove unnecessary delegation settings
4. Review who holds directory replication rights
5. Unique local administrator passwords per machine
6. Tiered administration so domain admin credentials never land on workstations

Write these as specific changes, not as generic advice. Structure in how to write a VAPT report.

Practise this

Build a small domain in your home lab with two machines and deliberately introduce each misconfiguration above, then find it. Doing that once teaches more than reading ten writeups.