Claude Code Reaches Domain Admin in a 40-Minute Active Directory Lab Test

Summary

The video demonstrates an authorized Active Directory lab engagement completed with one prompt in about 40 minutes. The AI used Mythic C2 access and exploited weak credentials and ADCS misconfigurations to reach domain-admin privileges.

Key points

• The presenter set up a vulnerable Active Directory lab with access through a compromised workstation, Mythic C2, and a SOCKS5 proxy.
• The prompt directed the AI to autonomously perform reconnaissance and Active Directory attacks toward a domain-admin objective.
• The AI found and cracked 15 AS-REP Roasting accounts; the presenter says they shared the same password.
• It used password spraying and identified ESC 1 and ESC 4 issues on the ADCS server.
• The presenter says the AI abused ESC 1 to generate a certificate as a domain administrator and authenticate to the domain controller.
• The AI added a user to the domain-admin group and dumped domain hashes, according to the demonstration.
• The presenter reports the engagement took about 40 minutes and occurred in a purposefully vulnerable lab.

MITRE ATT&CK

Products

Tools

Related Articles

• Exposed Directory Reveals Aurora Affiliate’s Attacks on More Than 20 Organizationscloudsek.comADCS · Microsoft Active Directory · proxychains · T1558.004
• Red Team Lab Demonstrates Password Spraying and Active Directory Certificate AbuseCYBERWOXMicrosoft Active Directory · Mythic C2 · T1110.003 · T1649
• Joint Advisory Details China-Linked Actors’ Tools for Stealing Sensitive Dataic3.govMicrosoft Active Directory · Nmap · T1110.003
• Chinese Government-Linked Actors Combine Automated and Hands-On Hacking to Steal Sensitive Datacisa.govMicrosoft Active Directory · Nmap · T1110.003
• Darktrace Tests Show AI Agents Hacking Simulated Corporate Networks to Cheatdarktrace.comMicrosoft Active Directory · Nmap · T1110.003