Modern Active Directory Attack Paths: Mapping & Exploiting Misconfigurations

# Modern Active Directory Attack Paths: Mapping & Exploiting Misconfigurations

In enterprise cybersecurity, Active Directory (AD) remains the primary identity and access management backbone for over 90% of Fortune 1000 companies. Consequently, AD penetration testing and vulnerability analysis form a core pillar of internal security assessments.

When conducting an assumed-breach assessment, security researchers start from a low-privilege domain account or a single compromised workstation. The goal is to identify and validate attack paths that lead to directory takeover (Domain Admin / Enterprise Admin).

---

## 1. Attack Path Discovery with BloodHound & SharpHound

Before attempting any direct exploitation, effective red teams and pentesters perform comprehensive AD structure enumeration.

### Collecting Telemetry
Using modern iterations of SharpHound or Python-based BloodHound tools, we collect Directory JSON payloads:

```bash
# Python collection over LDAP/LDAPS
bloodhound-python -c All -u 'lowpriv_user' -p 'Password123!' -d enterprise.local -dc dc01.enterprise.local --zip
```

### Analyzing High-Value Targets
Once imported into BloodHound, key queries focus on:
- **Shortest Paths to Domain Admins**
- **Principals with ACL Control over OU / Users** (`WriteDACL`, `GenericAll`, `WriteOwner`)
- **Unconstrained and Constrained Kerberos Delegation**
- **AS-REP Roastable & Kerberoastable Service Accounts**

---

## 2. Exploiting Kerberos Authentication Flaws

### AS-REP Roasting (No Pre-Authentication)
Accounts configured with `DONT_REQ_PREAUTH` allow any unauthenticated domain user to request an AS-REP ticket for that user, containing an encrypted portion signed with the user's password hash.

```bash
# Querying AS-REP roastable accounts via Impacket
impacket-GetNPUsers enterprise.local/ -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt -dc-ip 10.10.10.10
```

### Kerberoasting
Any domain user can request a Kerberos service ticket (TGS) for any service principal name (SPN) registered in the domain. The ticket is encrypted using the service account's NTLM hash.

```bash
# Extracting SPN TGS tickets for offline cracking
impacket-GetUserSPNs enterprise.local/lowpriv_user:Password123! -request -dc-ip 10.10.10.10 -outputfile kerberoast_hashes.txt
```

---

## 3. Abuse of Abuseable Access Control Lists (ACLs)

When directory permissions are delegated without strict oversight, low-privilege accounts frequently receive dangerous rights:

1. **`GenericAll` over a Group**: Allows adding arbitrary domain accounts into privilege groups (e.g., `Domain Admins` or `Backup Operators`).
2. **`WriteDACL` over a User**: Allows modifying the Security Descriptor of a high-privilege account to grant `GenericAll` or reset passwords directly.
3. **`ForceChangePassword`**: Grants the ability to change a user's password without knowing the current password.

---

## 4. Defensive Remediation & Hardening Roadmap

To break these attack chains, organizations must enforce directory hardening:

- **Enforce AES Encryption for Kerberos**: Disable weak RC4-HMAC encryption.
- **Implement Tiered Administration Model**: Strictly enforce Tier 0, Tier 1, and Tier 2 boundary separations.
- **Audit Domain ACLs Regularly**: Run automated audits using BloodHound/PrivescCheck to flag anomalous ACL delegations.
- **Set Long, Complex Passwords for SPNs**: Ensure SPN passwords exceed 25+ characters or leverage Group Managed Service Accounts (gMSAs).

---
*Published by Syed Zada Abrar — Lead Cybersecurity Researcher, Andrax Pentester.*