windows-ad

Windows / Active Directory Security

ACTION REQUIRED (execute immediately after reading)

1. NOW: Read ../field-journal/precedent-pentest.md
2. NOW: Domain/AD testing must have an explicitly authorized scope(including DCs, whether poisoning/relaying is allowed)
3. NOW: case-init; write network_profile and prohibited actions clearly
4. NEXT: tool-index (impacket/certipy/bloodhound etc. are often manual)
5. ACT: Start with identity enumeration and the BloodHound graph, do not go straight to destructive exploitation

Applicable Scenarios

• Domain penetration, Kerberoasting, AS-REP, delegation
• AD CS (ESC1–ESC8 etc.) certificate attacks
• BloodHound / SharpHound attack paths
• NTLM Relay / Coercer forced authentication
• Local privilege escalation to domain paths (Potato etc. as a pivot)

Relationship with attack-chain

• Multi-stage from external network to domain controller → PRIMARY may still be attack-chain/, this skill is AD specialty
• Already inside the domain, focus on identity → PRIMARY = this skill

Workflow

1. Enumeration

# 示例 Impacket / 内置（需凭据与授权）
nxc smb <range> -u user -p pass
bloodhound-python -d domain.local -u user -p pass -c All -ns <DC>

2. Common paths (graph first, then guns)

□ Kerberoast / AS-REP → 离线破解
□ ACL 滥用（GenericAll/WriteDacl）
□ 委派（非约束/约束/基于资源）
□ AD CS 模板错误 → Certipy
□ 中继：LLMNR/NBT-NS + ntlmrelayx（确认授权）

3. Credentials and lateral movement

□ secretsdump / lsassy / mimikatz（严格授权与清理）
□ PtH / PtT / 黄金票仅在授权红队范围
□ 每步写 Evidence；高危等用户确认

Toolchain

Tool	Purpose
BloodHound / SharpHound	Path graph
Certipy	AD CS
Impacket / NetExec	Lateral movement and enumeration
Rubeus / Mimikatz	Tickets and credentials (authorized)
Coercer / Responder	Forced authentication / poisoning

Reference

• references/ad-attack-paths.md
• ../pentest-tools/references/network-attack-defense.md
• ../attack-chain/
• seeds: field-journal/seed-005_ad-certipy-esc1.md seed-007_ntlm-relay-coercer.md seed-013_kerberoasting-spn.md

Routing Context

Upstream: MASTER R24
Downstream: Report docs-generator; requires EDR research edr-bypass-re
MUST NOT: Unauthorized DCSync / golden ticket against production

Task Completion Self-Check

• Is there a graph/enumeration before exploitation?
• Are reproducible commands recorded and redacted?
• Is the scope's prohibited items list followed?
• Checklist？