--- title: "Active Directory Pentest · VORNAC Research" description: "AD attack surface end-to-end: enumeration, Kerberos, ACL abuse, GPO weaponization, the Tier-0 chase — including the internal-engagement playbook from foothold to domain dominance." url: https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/active-directory-pentest --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Active Directory Pentest Featured · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Active Directory Pentest. AD attack surface end-to-end: enumeration, Kerberos, ACL abuse, GPO weaponization, the Tier-0 chase — including the internal-engagement playbook from foothold to domain dominance. ## Enumeration (any authenticated user) - **BloodHound collection.** `SharpHound -c All,GPOLocalGroup` from a domain-joined host; or `bloodhound-python -c All -u user -p pass -d domain.local -ns DC_IP` from Linux. Always run with `--ldapfilter` to scope under heavy environments. - **User and computer enum.** `ldapsearch -x -h DC -b "dc=domain,dc=local" "(objectClass=user)"`. Look for description fields containing passwords — still the single most common AD finding. - **SPN inventory.** `setspn -Q */*` or `GetUserSPNs.py`. Service accounts here are kerberoast candidates. - **GPO inspection.** `Get-GPO -All`, walk `\\domain\SYSVOL\domain\Policies\` for `cpassword` in Groups.xml (GPP creds, decryptable). ## Kerberos abuse 1. **Kerberoasting.** `Rubeus.exe kerberoast /outfile:hashes.txt` or `GetUserSPNs.py -request`. Crack hashcat mode 13100 with `rockyou + best64.rule`. Service accounts with passwords < 14 chars typically fall. 2. **ASREP-roasting.** `Rubeus.exe asreproast` or `GetNPUsers.py -no-pass -usersfile users.txt` for accounts with `DONT_REQUIRE_PREAUTH`. Hashcat mode 18200. 3. **Unconstrained delegation abuse.** Computer accounts with TRUSTED\_FOR\_DELEGATION → coerce DC auth via `PetitPotam` or printer bug → captured TGT. 4. **Constrained delegation (S4U2Self/Proxy).** Computer/user with `msDS-AllowedToDelegateTo` → request TGS as any user to the configured SPN → `Rubeus.exe s4u /user:WEB$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/dc01`. 5. **Resource-based constrained delegation.** Write access to `msDS-AllowedToActOnBehalfOfOtherIdentity` on a target computer → add attacker-controlled machine account → impersonate any user to that target. ## ACL abuse — dangerous rights - **GenericAll on user.** Reset password or set SPN → kerberoast. - **WriteDACL on object.** Grant self GenericAll → all of the above. - **WriteOwner.** Take ownership → WriteDACL → GenericAll. - **ForceChangePassword on user.** `Set-DomainUserPassword` (PowerView). Loud but fast. - **AddMember on group.** Especially Domain Admins, Enterprise Admins, Schema Admins, and any tier-0 group. - **GenericWrite on computer.** Set RBCD on target → impersonate any user via S4U. ## Defenses - **gMSAs for service accounts.** 240-byte rotated passwords defeat kerberoasting categorically. - **PRE\_AUTH required on every account.** Audit `(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))` regularly. - **Tier-0 isolation.** Domain Admins log in only from PAWs. No Tier-0 secret ever cached on a Tier-1 host. - **LDAP signing + channel binding.** Defeats relay attacks against DCs. - **SMB signing required.** Defeats NTLM relay across the file-server fleet. - **Disable spooler service on every DC.** Removes the printer-bug delegation primitive. **Rule of thumb**Path to DA is almost always shorter in BloodHound than you'd expect. Run it on day one of any internal engagement, before any other tooling. The graph tells you which 3–4 of the next 50 things to try. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Featured Engagement phases ReconAuthenticationFingerprintingBusiness Logic Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) - [Featured Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) - [Featured Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) - [Featured Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) - [Reference Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) - [Reference Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) - [Background Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Previous note Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) From reference to evidence ## Run this against your own environment.