CCNA Active Directory Attacks Questions

The LocalAdmin collection method queries each computer's local Administrators group via SAM-R, harvesting local admin mappings without needing Domain Admin rights. This directly satisfies the stem's constraint of gathering local admin rights non-privileged, since SAM-R reads rely on standard remote access rather than elevated directory permissions.

`klist` queries the local Kerberos credential cache and lists tickets currently held in the logon session, including the initial TGT and any service tickets. This directly satisfies the stem's requirement to view cached Kerberos tickets natively, without external tooling or elevated privileges.

AD CS certificate mapping lets an attacker with CA access issue a certificate tied to a domain account, enabling persistent PKINIT authentication. This survives password resets and evades traditional account-based detection, satisfying the requirement for stealthy persistence beyond standard user accounts or scheduled tasks.

LDAP signing, when disabled or set to 'Not Required', lets attackers relay NTLM authentication to the domain controller over unsigned LDAP, enabling rogue directory operations. Checking this setting on domain controllers directly identifies a primary NTLM relay exposure during an Active Directory audit.

A Silver Ticket is forged with the target service account's NTLM hash, which encrypts the service ticket's PAC and signature. The KRBTGT hash is only needed for Golden Tickets, so the service account hash satisfies the stem's substitution.

Pass-the-Hash exploits NTLM's design, where the password hash itself authenticates without needing the plaintext. CrackMapExec submits the captured NTLM hash directly to SMB or other services, granting access to remote workstations, which matches the described post-exploitation behaviour.

Without LDAP signing enforced, the server accepts unsigned LDAP binds, so an attacker who captures or coerces NTLM authentication can relay those credentials to the domain controller over LDAP and perform directory operations as the victim. Signing would reject the relayed session.

getST.py exploits the S4U2Self and S4U2Proxy extensions to request a service ticket impersonating a privileged user, satisfying the Constrained Delegation scenario. It requires the delegated account's credentials or hash plus the SPN of the target service, returning a usable TGS for that service.

Impacket's secretsdump.py authenticates as a privileged account and invokes the DRSUAPI DsGetNCChanges RPC call, impersonating a domain controller's replication request. This extracts password hashes remotely over the network, satisfying the constraint of harvesting credentials without executing any code on the domain controller itself.

PetitPotam abuses MS-EFSRPC to trigger the DC's machine account authentication. Relaying that NTLM authentication to AD CS, which lacks NTLM relay protections by default, lets the attacker obtain a certificate for the DC machine account and then impersonate the domain controller via Kerberos.

A Golden Ticket is a forged TGT signed with the KRBTGT account's NTLM hash. With domain admin credentials, the operator can extract the KRBTGT hash and forge tickets that grant access to any resource. This backdoor remains valid even if the domain admin password is changed, as long as the KRBTGT hash is not reset. It provides long-term persistence.

Writing msDS-AllowedToActOnBehalfOfOtherIdentity on the target computer object grants a controlled account resource-based constrained delegation, letting it impersonate any user to that host's service. Combined with GenericAll's write access, the operator obtains a service ticket as a privileged user, then executes code via SMB or WinRM on the target.

With GenericAll on a computer object, the operator can modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute to set up Resource-Based Constrained Delegation. This allows the operator to impersonate any user to that computer, achieving administrative access. This is a direct abuse of the permission granted.

RC4 is the weakest encryption type for Kerberos tickets and is easier to crack because it uses the NT hash of the service account as the key. Requesting RC4 tickets increases the likelihood of successful offline cracking, especially if the service account password is weak. This is why attackers often downgrade to RC4 when possible.

The `-upn` flag injects an arbitrary subjectAltName during enrolment, exploiting the ENROLLEE_SUPPLIES_SUBJECT flag on a Client Authentication template. Certipy's `req` command submits the CSR to the CA, returning a certificate bearing administrator's UPN, which is then usable for Kerberos PKINIT authentication as that high-privileged account.

LSASS (Local Security Authority Subsystem Service) caches credential material, including NTLM hashes and Kerberos tickets, for users who have logged on interactively or via RDP. If a domain administrator has logged into the workstation, their credentials may reside in LSASS memory. Tools like Mimikatz or ProcDump can extract these, making it the most likely location for the domain admin hash.

ticketConverter.py is a script from the Impacket suite that converts between .kirbi and .ccache formats. It is the standard tool for this purpose in AD penetration testing, allowing an operator to take a TGT extracted from Windows (often in .kirbi format) and convert it for use with Impacket tools like psexec.py or wmiexec.py that expect a .ccache credential cache.

Pass-the-Hash exploits NTLM's challenge-response authentication, where the hash itself serves as the credential, so no plaintext is needed. Impacket's psexec.py injects that hash via SMB to create a service on the remote host, spawning a shell. This directly satisfies the stem's constraint: lateral movement using only the captured local administrator NTLM hash.

KRB5CCNAME tells Kerberos client libraries which credential cache file to use. Exporting it to point at the stolen .ccache lets Impacket tools such as psexec.py authenticate with the TGT for lateral movement, satisfying the stem's requirement.

ESC1 requires a template flag permitting the requester to specify subjectAltName plus enrolment rights for low-privileged users, combined with a client authentication EKU. That combination lets any enrolled user request a certificate impersonating a domain administrator.

AddMember edges represent the specific access right to add principals to a group, which directly satisfies the stem's requirement for modifying group membership. BloodHound draws this edge when a user holds WriteMembers or GenericWrite over the target group, enabling privilege escalation through group population.

Rubeus with the `asreproast` action queries LDAP for user objects whose userAccountControl attribute has the DONT_REQ_PREAUTH bit (0x400000) set, then requests AS-REPs for them. It runs under the invoking unprivileged domain user's own token, satisfying the stem's no-elevated-rights constraint.

A Silver Ticket is forged with the service account's NTLM hash and encrypted directly with that key, so the KDC is never contacted. This satisfies the scenario's advantage: no TGT request reaches the Domain Controller, avoiding that associated detection.

ticketer.py forges Kerberos tickets offline from a supplied key or hash, including Golden Tickets built from the KRBTGT hash, then writes the ticket to a ccache file for injection. It requires no live domain controller interaction.

Shadow Credentials abuse requires the ability to write the msDS-KeyCredentialLink attribute on the target account. WriteProperty scoped to that attribute, GenericAll, or GenericWrite all grant this, letting the attacker inject a rogue key credential and later authenticate via PKINIT as the victim.

Delegation lets a service impersonate users to downstream resources. Unconstrained delegation caches TGTs in memory, harvestable via credential theft, while constrained delegation can be abused through protocol transition to reach services the attacker otherwise could not, enabling lateral movement across the domain.

Writing a startup script or service configuration into the GPO's SYSVOL share lets the compromised account push code execution to every machine or user the GPO applies to, including domain controllers, converting GenericAll over the GPO into domain-wide escalation.

Unconstrained Delegation lets a host cache any authenticating user's TGT in memory. An attacker who compromises that computer can extract those tickets and replay them, impersonating privileged users across the domain — far broader than constrained variants, which limit impersonation to specified services.

Tiered administration limits where credential material can be exposed, preventing attackers from acquiring KRBTGT hashes.

The Enterprise Admins group in the forest root domain holds forest-wide administrative rights, so compromising it grants control over every domain in the forest. Subordinate-domain Domain Admin rights alone do not confer Enterprise Admin privileges.

GenericAll or WriteDACL over the Domain object grants full control or the ability to modify the domain's ACLs, letting an attacker grant themselves DCSync rights or escalate directly to Domain Admin, marking it as an immediate high-value path in BloodHound.

ESC8 abuses NTLM relay against AD CS HTTP enrolment interfaces — the certsrv/ web enrolment pages or the Certificate Enrollment Web Service — letting an attacker request a certificate as the relayed machine or user.

With EDITF_ATTRIBUTESUBJECTALTNAME2 enabled, the requester can embed an arbitrary SAN in the CSR, and the CA copies it into the issued certificate. Because the template permits client authentication, the resulting certificate authenticates via PKINIT as the impersonated account, such as Domain Admin.

Disabling HTTP web enrolment or enforcing HTTPS with Extended Protection for Authentication blocks NTLM relay to the CA web interface, directly mitigating ESC8. EPA binds the authentication exchange to the TLS channel, so a relayed credential cannot be reused against the enrolment endpoint.

SharpHound is the official BloodHound collector, gathering ACLs, sessions and object relationships via LDAP and SMB into JSON for ingestion. It satisfies the reconnaissance requirement by automating collection that would otherwise need manual enumeration, mapping attack paths across the Active Directory domain.

dsacls is a built-in Windows command-line tool that allows viewing and modifying ACLs on Active Directory objects, including OUs. With WriteDACL permission, you can use dsacls to grant yourself Full Control on the OU, then further compromise objects within it. It is part of the AD DS tools and is available on domain controllers and administrative workstations.

Pass-the-Hash uses the NTLM hash directly in the authentication process, bypassing the need for the plaintext password. In this scenario, you have extracted the hash from LSASS, and since the domain user has an active logon session, the hash is valid for NTLM authentication. Tools like Mimikatz or Impacket's psexec.py can perform PtH to access remote resources.

DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights permit a principal to invoke directory replication, letting it pull password hashes and other secrets directly from a domain controller without touching its filesystem. Granting both satisfies the replication requirement that makes DCSync possible, unlike ordinary read or logon rights.

Pass-the-Hash allows an attacker to authenticate using the NTLM hash directly, without needing the plaintext password. This works because NTLM authentication can use the hash as proof of identity. Tools like Mimikatz or Impacket's psexec can leverage the hash to access remote systems where the user has administrative privileges.

ticketer.py is specifically designed to create Golden and Silver tickets. It takes the KRBTGT hash and domain SID as input to forge a TGT that can be used for authentication. This tool allows the tester to generate a ticket file that can be injected into the session, enabling lateral movement with domain admin privileges.

Mimikatz's `kerberos::ptt` passes the ticket into the current logon session by injecting it into LSASS, satisfying the requirement to import a captured TGT without re-authentication. The `.kirbi` file holds the Kerberos ticket; `ptt` (pass-the-ticket) loads it so the session presents it for network resource access.

ProcDump.exe captures a full memory dump of a running process, and targeting lsass.exe yields credential material such as NTLM hashes and Kerberos tickets for offline extraction. It satisfies the scenario's requirement for a Sysinternals utility usable post-exploitation, since it runs natively on Windows without installing additional agents.

Unconstrained Delegation lets the host cache any authenticating user's TGT in LSASS. Coercing a Domain Administrator to authenticate deposits their TGT there, which the operator extracts and injects to impersonate them domain-wide — satisfying the scenario's requirement to abuse the delegation flag for full-domain privilege escalation.