Guide Demonstrates AI-Driven Active Directory Pentesting and Detection in a Lab
Summary
A controlled Active Directory lab walkthrough uses Claude Desktop, HexStrike AI and NetExec for enumeration, exploitation and credential harvesting, then reviews event-log artifacts and defenses. A password spray reaches Domain Admin because account lockout is disabled.
Key points
- The guide connects Claude Desktop to HexStrike AI and NetExec to run Active Directory operations from plain-English prompts.
- Lab reconnaissance identifies roastable accounts, delegation paths, weak password practices and an unset account lockout threshold.
- A single password spray using Ignite@987 obtains Domain Admin access in the lab; the article attributes the success to the missing lockout threshold.
- The walkthrough demonstrates credential and secret collection from LSA, SAM, LAPS, WinSCP and DPAPI, followed by creating a persistent Domain Admin account.
- Zerologon and SMBGhost checks return no vulnerability findings, while the NTLM coercion check reports vulnerable interfaces in the lab.
- The event-log review highlights Event 4662 with replication-right GUIDs for DCSync detection, and Events 4720, 4728 and 4732 for account creation and privileged-group changes.
- Mitigations include enforcing lockout and stronger password policies, tightening delegation and LAPS permissions, limiting stored credentials, and monitoring privileged changes.
Article Details
- Topic
- Prompt-driven Active Directory penetration-testing lab demonstrating reconnaissance, credential attacks, post-exploitation, persistence, and event-log review using Claude Desktop, HexStrike AI, and NetExec.
MITRE ATT&CK
T1003.002 · Security Account ManagerThe lab uses NetExec to dump the local SAM database from a domain controller.T1003.004 · LSA SecretsThe lab uses NetExec to dump LSA secrets from a domain controller.T1021.001 · Remote Desktop ProtocolAfter enabling RDP on the lab domain controller, the guide connects interactively using the recovered Administrator credentials.T1069.002 · Domain GroupsThe lab enumerates Active Directory group memberships to identify privileged accounts.T1087.002 · Domain AccountThe lab uses LDAP enumeration to discover domain user accounts.T1098.007 · Additional Local or Domain GroupsThe lab adds the newly created account to the Domain Admins group.T1110.002 · Password CrackingThe guide uses hashcat to crack a captured AS-REP hash offline.T1110.003 · Password SprayingA single password-spray round against domain accounts finds the Administrator password in the lab.T1136.002 · Domain AccountThe lab creates a new domain user account as a persistence step.T1187 · Forced AuthenticationThe lab identifies RPC coercion capabilities that could force a domain controller to authenticate to a host under an operator's control; the check itself is described as read-only.T1555.003 · Credentials from Web BrowsersThe guide describes decrypting Firefox-saved logins from the Administrator profile using recovered DPAPI material.T1558.003 · KerberoastingThe lab requests Kerberos service tickets for SPN accounts and cracks the returned tickets.T1558.004 · AS-REP RoastingThe guide captures and cracks an AS-REP hash for an account without Kerberos pre-authentication.
CVE
Products
Claude Desktopguide demonstrates an end-to-end Active Directory lab engagement driven by plain-English prompts to Claude Desktop through HexStrike AI and NetExec, covering reconnaissance, exploitation, post-exploitation, andLAPSIt shows how weak passwords, roastable accounts, delegation flaws, and credential storage issues can lead from initial access to Domain Admin and durable persistence in #IGNITE.LOCALMicrosoft Active DirectoryThis guide demonstrates an end-to-end Active Directory lab engagement driven by plain-English prompts to Claude Desktop through HexStrike AI and NetExec, covering reconnaissance, exploitation, post-exploitation, andWinSCPHarvest WinSCP Saved Sessions
Tools
hashcatFeed it to hashcat mode 18200 with the rockyou wordlist.HexStrike AIend-to-end Active Directory lab engagement driven by plain-English prompts to Claude Desktop through HexStrike AI and NetExec, covering reconnaissance, exploitation, post-exploitation, and defensive log review.NetExecDirectory lab engagement driven by plain-English prompts to Claude Desktop through HexStrike AI and NetExec, covering reconnaissance, exploitation, post-exploitation, and defensive log review.