Common AD Attacks

The core moves that turn one credential into domain-wide control, and how to stop them.

22 minactive-directorylateral-movementdefense

What you will learn

-Perform pass-the-hash and AS-REP roasting attacks
-Move laterally across a domain with harvested credentials
-Name the defenses that break each attack

You have a foothold and a map. Now you convert access into . Real AD compromise is rarely one . It is a chain: grab a , use it to reach the next box, harvest a better credential, repeat until you hit Admin. These are the moves that make up almost every chain.

Pass-the-Hash

Windows can authenticate over using a hash directly, no needed. So if you dump an NTLM hash from one machine, you can authenticate as that user elsewhere without ever cracking it.

attacker@kali

# spray one local admin hash across the subnet

$netexec smb 10.10.10.0/24 -u Administrator -H 3f2a...c91 --local-auth

# get a SYSTEM shell using the hash alone

$impacket-psexec -hashes :3f2a...c91 Administrator@10.10.10.20

When a whole fleet one local password, a single dumped hash opens every machine. That is why spreads so fast.

AS-REP Roasting

Some accounts have pre- disabled. For those, the KDC will hand you an AS-REP encrypted with the user's before you have proven anything. Request it, then crack it offline, just like but without needing any credentials at all.

attacker@kali

# find and roast accounts with no pre-auth

$impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass -dc-ip 10.10.10.5

# crack the AS-REP hashes offline

$hashcat -m 18200 asrep.txt rockyou.txt

Lateral movement

Every new box is a chance to harvest more credentials: cached hashes, , tickets in memory. You loop: dump on this , use what you find to reach the next, dump again. Tools like netexec, psexec, wmiexec, and evil-winrm each execute code on a remote host once you hold a working credential.

The pattern to internalize

Foothold, then enumerate, then harvest a credential, then move, then harvest again. You are climbing the graph one edge at a time. The goal is almost always the same : an account that can dump the .

Defenses that actually work

You are also here to help the defender. Each attack has a concrete counter:

Pass-the-hash: unique local admin passwords per machine (Microsoft LAPS), and keep privileged accounts off low-trust workstations.
AS-REP roasting: never disable Kerberos pre-authentication, and enforce long passwords so any leaked hash is uncrackable in practice.
Kerberoasting: use Group Managed with long random passwords, and monitor for bulk service-ticket requests.
Lateral movement: tiered administration so a helpdesk credential can never reach a Domain Controller.

Why does pass-the-hash work without cracking the password?

Exercise

Name the single control that most directly stops one dumped local admin hash from opening every machine on the subnet.

The attack relies on password reuse across the fleet. Break the reuse and the one hash only opens one box.

Kerberos and Kerberoasting

Pass-the-Hash

Windows can authenticate over using a hash directly, no needed. So if you dump an NTLM hash from one machine, you can authenticate as that user elsewhere without ever cracking it.

attacker@kali

# spray one local admin hash across the subnet

$netexec smb 10.10.10.0/24 -u Administrator -H 3f2a...c91 --local-auth

# get a SYSTEM shell using the hash alone

$impacket-psexec -hashes :3f2a...c91 Administrator@10.10.10.20

When a whole fleet one local password, a single dumped hash opens every machine. That is why spreads so fast.

AS-REP Roasting

attacker@kali

# find and roast accounts with no pre-auth

$impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass -dc-ip 10.10.10.5

# crack the AS-REP hashes offline

$hashcat -m 18200 asrep.txt rockyou.txt

Lateral movement

The pattern to internalize

Foothold, then enumerate, then harvest a credential, then move, then harvest again. You are climbing the graph one edge at a time. The goal is almost always the same : an account that can dump the .

Defenses that actually work

You are also here to help the defender. Each attack has a concrete counter:

Pass-the-hash: unique local admin passwords per machine (Microsoft LAPS), and keep privileged accounts off low-trust workstations.

AS-REP roasting: never disable Kerberos pre-authentication, and enforce long passwords so any leaked hash is uncrackable in practice.

Kerberoasting: use Group Managed with long random passwords, and monitor for bulk service-ticket requests.

Lateral movement: tiered administration so a helpdesk credential can never reach a Domain Controller.

Why does pass-the-hash work without cracking the password?

Exercise

Name the single control that most directly stops one dumped local admin hash from opening every machine on the subnet.

The attack relies on password reuse across the fleet. Break the reuse and the one hash only opens one box.