Active Directory Attack Chain and Defenses Using BloodyAD
Summary
A lab walkthrough uses BloodyAD and Impacket to demonstrate Active Directory enumeration, privilege escalation, credential attacks and persistence, then outlines monitoring and hardening measures for the misconfigurations exploited.
Key points
- The walkthrough demonstrates an attack chain against the ignite.local lab using BloodyAD over LDAP(S) and MS-SAMR, alongside Impacket tools.
- Examples show how cleartext passwords in LDAP attributes, excessive ACL permissions and default machine-account quota settings can enable privilege escalation.
- Demonstrated techniques include Kerberoasting, AS-REP roasting, DCSync credential extraction and ACL abuse.
- The walkthrough also covers resource-based constrained delegation, Shadow Credentials and reading LAPS-managed passwords.
- Defensive guidance includes auditing AD ACLs, monitoring LDAP and replication events, enforcing Kerberos pre-authentication, reducing machine-account quota and using tiered administration.
Article Details
- Topic
- Active Directory attack techniques and defensive recommendations demonstrated in a lab
MITRE ATT&CK
T1003.006 · DCSyncThe walkthrough grants replication permissions and uses secretsdump to retrieve domain credentials through DCSync.T1021.002 · SMB/Windows Admin SharesThe walkthrough uses psexec with Kerberos credentials to execute commands remotely on the domain controller.T1098.005 · Device RegistrationThe walkthrough adds a public key credential to the DC$ account’s msDS-KeyCredentialLink attribute to enable certificate-based authentication.T1098.007 · Additional Local or Domain GroupsThe walkthrough grants control over the Domain Admins group and adds an account to that group.T1136.002 · Domain AccountThe walkthrough creates a computer account that is then used in the RBCD attack chain.T1550.003 · Pass the TicketThe walkthrough obtains a Kerberos service ticket through RBCD, exports its credential cache, and uses it for access to the domain controller.T1558.003 · KerberoastingThe walkthrough assigns an SPN to an account and describes requesting and cracking its Kerberos service ticket (Kerberoasting).T1558.004 · AS-REP RoastingThe walkthrough disables Kerberos pre-authentication for an account and uses GetNPUsers to obtain a crackable hash.
Vendors
Products
LAPSRecommended defenses include auditing AD ACLs, monitoring LDAP and replication events, enforcing strong SPN passwords and pre-authentication, deploying LAPS, and adopting a tiered administration model.Microsoft Active DirectoryThis walkthrough demonstrates a complete Active Directory attack chain against the ignite.local lab using BloodyAD and Impacket, covering enumeration, privilege escalation, Kerberos attacks, credential dumping, RBCD,Windows Hello for BusinessThis attribute stores public key credentials used for Windows Hello for Business (WHfB) and certificate-based authentication.
Tools
BloodHound CERegularly audit AD ACLs using tools like BloodHound CE or PingCastlebloodyadThis walkthrough demonstrates a complete Active Directory attack chain against the ignite.local lab using BloodyAD and Impacket, covering enumeration, privilege escalation, Kerberos attacks, credential dumping, RBCD,GetNPUsersImpacket tools (secretsdump, GetNPUsers, psexec) are used for credential dumping, ticket attacks, and remote execution to achieve full control.Impacketdemonstrates a complete Active Directory attack chain against the ignite.local lab using BloodyAD and Impacket, covering enumeration, privilege escalation, Kerberos attacks, credential dumping, RBCD, and persistenceNetExecNetExec confirms valid credentials: ‘[+] ignite.localhulk:Ironman@123’. The account is now fully compromised.PingCastleRegularly audit AD ACLs using tools like BloodHound CE or PingCastlePKINITtoolsBloodyAD also outputs the exact PKINITtools command needed to obtain a TGT:PsExecImpacket tools (secretsdump, GetNPUsers, psexec) are used for credential dumping, ticket attacks, and remote execution to achieve full control.secretsdumpImpacket tools (secretsdump, GetNPUsers, psexec) are used for credential dumping, ticket attacks, and remote execution to achieve full control.