Active Directory

Table of contents

  1. Recon
  2. Without an account
  3. Privilege escalation
  4. Lateralization
  5. Persistance
  6. Useful links

This section assumes that you have at least a network access to the Active Directory domain.

Recon

Before starting to play with following exploits, it is a good idea to recover information about the domain you are going to attack as an unauthenticated user.

Without an account

First thing you want to achieve to compromise a domain is to get an initial foothold. To do so, following attacks can be used to gain a domain joined account, either a user or computer one.

You also should take a look at Windows Initial Foothold methods.

Privilege escalation

Once you get either a low privileged domain account or an access to a domain joined computer, you can perform following attacks to escalate your privileges locally on domain computers or on the domain itself. You should perform Active Directory Enumeration to get as much information as possible before starting to exploit.

You also should take a look at Windows Privilege Escalation methods.

Lateralization

You also should take a look at Windows Lateralization methods.

Persistance

  • ODC Mind Map for the Orange Cyberdefense Active Directory mind map.