INTRO TO ACTIVE
DIRECTORY PENTESTING
Abdur Rahman Maheer
Security Engineer, Trustaira Limited
Basics About AD Pentesting Offensive Security Researcher
Abdur Rahman Maheer
Security Engineer , Trustaira Limited
Offensive Operational Security Researcher
Founder of System00 Security
2
Introduction to Active Directory
What is Active Directory &
Why It’s Used?
3
What is Active Directory & Why It’s Used?
Active Directory (AD) is Microsoft’s system for managing users, computers, and resources in a network.
Think of it as a "phonebook" for your organization:
• It stores information about users, devices, and permissions.
• It helps control who can access what.
4
What is Active Directory & Why It’s Used?
Active Directory Structure
5
What is Active Directory & Why It’s Used?
Active Directory Objects
6
What is Active Directory & Why It’s Used?
Kerberos Authentication
• Users authenticate to a Key Distribution Center (KDC) , which issues a Ticket-Granting Ticket (TGT) .
• The TGT allows the user to request service tickets for accessing specific resources.
• Service tickets are then presented to the resource server for access.
7
What is Active Directory & Why It’s Used?
NTLM Authentication
• NTLM uses a challenge-response mechanism where the client proves its knowledge of the password
without sending it over the network.
• It involves three steps: negotiate, challenge, and response.
8
What is Active Directory & Why It’s Used?
NTLM
8
What is Active Directory & Why It’s Used?
Certificate Based Authentication
9
What is Active Directory & Why It’s Used?
NTLM VS Kerberos
9
What is Active Directory & Why It’s Used?
NTLM Common Attack Surface
NTLM Relay Attacks
• Attacker intercepts authentication messages and relays them to a legitimate server.
• Exploits lack of mutual authentication in NTLM.
Pass The Hash Attack
• Attacker steals NTLM hash and uses it to authenticate without needing the plaintext password.
Downgrade Attack
• Attackers force the system to use NTLMv1, which is weak and easier to crack.
9
What is Active Directory & Why It’s Used?
Kerberos Common Attack Surface
Pass-the-Ticket (PtT) Attack
• An attacker steals Kerberos tickets (TGT or TGS) and reuses them to access services.
Golden Ticket Attack
• Attacker compromises the Kerberos Key Distribution Center (KDC) and forges TGTs for any user.
Silver Ticket Attack
• Exploits a Kerberos service ticket to impersonate a user for a specific service.
Kerberoasting Attack
• Attacker requests encrypted Kerberos service tickets and brute-forces the hash to extract service account passwords.
AS-REP Roasting Attack
• Exploits accounts with pre-authentication disabled to extract crackable password hashes.
9
What is Active Directory & Why It’s Used?
Certificate Based Auth Common Attack Surface
Stolen Certificates & Private Keys
• If an attacker steals a private key, they can authenticate as the legitimate user.
Certificate Forgery & Misuse
• Weak Public Key Infrastructure (PKI) allows attackers to issue fake certificates.
Man-in-the-Middle (MITM) Attack
• Attackers intercept authentication by presenting a fake TLS certificate.
Expired or Revoked Certificates
• Users might authenticate with an expired or revoked certificate if the system doesn’t check.
PKI Infrastructure Compromise
• If the Certificate Authority (CA) is compromised, all certificates issued by it become untrusted.
9
Introduction to Active Directory Attacks
Demonstrating Common
Attacks through Sauna
Sauna - HTB
Workflow
Sauna - HTB
AS-REP Roasting
What is AS-REP Roasting?
• An attack that exploits accounts with "Do not require Kerberos pre-authentication" enabled to retrieve encrypted AS-REP tickets for
offline cracking.
How It Works:
• Attackers request AS-REP tickets from the Domain Controller (KDC) for vulnerable accounts and extract password hashes without
needing credentials.
Why It’s Dangerous:
• No initial login required; weak passwords can be cracked offline, leading to unauthorized access.
Sauna - HTB
DCSync Attack
A DCSync attack occurs when an attacker gains unauthorized access to Active Directory by pretending to be a domain controller. They exploit
misconfigured permissions (like Replicating Directory Changes) to extract password hashes from the domain, which can then be used to escalate privileges
or compromise accounts.
Sauna - HTB
Learning Resources & Cheat sheet
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]