Back to Details

active-directory-attack-paths

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Active Directory Attack Paths

Active Directory 攻击路径

Identify and demonstrate Active Directory misconfigurations during authorized internal assessments.
在获得授权的内部评估中识别并演示 Active Directory 配置错误。

When to Use

使用场景

  • You have a foothold (or credentials) inside an authorized internal network
  • You need to map privilege-escalation paths to Domain Admin or Enterprise Admin
  • 你已在获得授权的内部网络中取得初始立足点（或凭据）
  • 你需要梳理通往 Domain Admin 或 Enterprise Admin 的权限提升路径

Methodology

方法

1. Initial Enumeration

1. 初始枚举

  • whoami /all
    , domain trusts, nested groups
  • BloodHound / SharpHound collection (small collection first: 
    --collectionmethod All --exclude-dc
    if stealth matters)
  • Look for: Kerberoastable SPNs, AS-REP roastable accounts (no preauth), unconstrained delegation, DCSync rights, GPO abuse
  • whoami /all
    、域信任关系、嵌套组
  • 使用 BloodHound / SharpHound 收集数据（先进行小范围收集；若需保持隐蔽性，使用 
    --collectionmethod All --exclude-dc
    ）
  • 查找：可进行 Kerberoasting 的 SPN、可进行 AS-REP Roasting 的账户（无需预认证）、无约束委派、DCSync 权限、GPO 滥用

2. Credential Attacks

2. 凭据攻击

  • Kerberoasting: request TGS for SPN accounts, crack offline (
    hashcat -m 13100
    )
  • AS-REP Roasting: accounts with 
    DONT_REQ_PREAUTH
    , crack offline (
    hashcat -m 18200
    )
  • Password spraying only within RoE — respect lockout policies
  • Kerberoasting：针对 SPN 账户请求 TGS，离线破解（
    hashcat -m 13100
    ）
  • AS-REP Roasting：针对设置了 
    DONT_REQ_PREAUTH
    的账户，离线破解（
    hashcat -m 18200
    ）
  • Password spraying 只能在 RoE 范围内进行——遵守账户锁定策略

3. Delegation Abuse

3. 委派滥用

  • Unconstrained delegation: capture TGTs via printer bug (SpoolSample) with Rubeus
  • Constrained delegation: S4U2Proxy abuse to impersonate users
  • Resource-based constrained delegation (RBCD): requires write rights over 
    msDS-AllowedToActOnBehalfOfOtherIdentity
  • 无约束委派：使用 Rubeus，通过 printer bug（SpoolSample）捕获 TGT
  • 受限委派：滥用 S4U2Proxy 冒充用户
  • 基于资源的受限委派（RBCD）：需要对 
    msDS-AllowedToActOnBehalfOfOtherIdentity
    具有写入权限

4. ACL Attacks

4. ACL 攻击

  • GenericAll / GenericWrite / WriteDacl / WriteOwner on users, groups, or GPOs
  • Force a password reset or ACL change, then re-run collection to confirm the new path
  • 对用户、组或 GPO 拥有 GenericAll / GenericWrite / WriteDacl / WriteOwner 权限
  • 强制重置密码或更改 ACL，然后重新运行收集以确认新的攻击路径

5. Domain Dominance

5. 域控制

  • DCSync (
    mimikatz lsadump::dcsync
    or secretsdump.py) — only with explicit authorization
  • AD CS abuse: ESC1–ESC8 templates (Certipy), Golden/Silver certificates
  • DCSync（
    mimikatz lsadump::dcsync
    或 
    secretsdump.py
    ）——仅在获得明确授权时执行
  • 滥用 AD CS：ESC1–ESC8 模板（Certipy）、Golden/Silver 证书

Evidence to Capture

需要收集的证据

For each step: the command run, the output showing the escalation, and the accounts affected.
对于每个步骤：记录运行的命令、显示权限提升的输出以及受影响的账户。

Cleanup

清理

Remove created accounts, changed ACLs, and dropped tools; note every modification in the cleanup log.
移除所创建的账户、撤销 ACL 更改并删除已投放的工具；在清理日志中记录每项修改。