AD Attack Path Automation

2024-06-20

Overview

Active Directory environments contain complex attack paths that can be difficult to identify manually. This writeup covers automating the entire attack lifecycle.

## Enumeration Phase

``bash
# BloodHound collection
bloodhound-python -u user -p pass -d corp.local -ns 10.10.10.1 -c all

# Certificate enumeration
certipy find -u user@corp.local -p Pass123 -dc-ip 10.10.10.1
`

## Attack Techniques

1. **Kerberoasting** - Request TGS tickets for offline cracking
2. **AS-REP Roasting** - Target accounts with pre-auth disabled
3. **Certificate Abuse** - Exploit misconfigured ADCS templates
4. **Delegation Attacks** - Abuse unconstrained/constrained delegation

## Automation

Using Impacket for scripted attacks:
`python
from impacket.krb5.kerberosv5 import getTGT
from impacket.smbconnection import SMBConnection
``