AD Attack Path Automation

Overview

Active Directory environments contain complex attack paths that can be difficult to identify manually. This research covers automating the entire attack lifecycle.

Enumeration Phase

# BloodHound collection
bloodhound-python -u user -p pass -d corp.local -ns 10.10.10.1 -c all

# Certificate enumeration
certipy find -u user@corp.local -p Pass123 -dc-ip 10.10.10.1

Attack Techniques

• Kerberoasting - Request TGS tickets for offline cracking
• AS-REP Roasting - Target accounts with pre-auth disabled
• Certificate Abuse - Exploit misconfigured ADCS templates
• Delegation Attacks - Abuse unconstrained/constrained delegation

Automation

Using Impacket for scripted attacks:

from impacket.krb5.kerberosv5 import getTGT
from impacket.smbconnection import SMBConnection