Course Preview

Active Directory Attack Paths

An attack path is a chain of misconfigurations and stolen credentials that takes an attacker from one compromised account to control of an Active Directory domain. This course covers how those chains are found, the Kerberos and NTLM abuses that make them work, and how to map them with graph tooling.

itOffensive security and application security | OpenSkills.info

Course pathWalk it in order

Look it upDip in anytime

Go furtherLeaves this page

Don't Panic: Active Directory Attack Paths

An attack path is the route an attacker walks from one boring account to the keys of a whole Windows domain. Not a hole. Not a missing patch. A chain of perfectly reasonable decisions, each of which hands the walker one more edge of the map. That is the annoying part: the domain is not broken. It is helpfully connected.

The load-bearing idea is the graph. Users, computers, and groups are nodes; memberships, local admin rights, sessions, and delegated permissions are edges. Attackers run pathfinding on this graph, most famously with BloodHound. Defenders, slightly later, run the same tooling, which tells you something about the graph's honesty.

Three abuses carry most of the weight. Kerberoasting: any user can request a service ticket for any account with a service principal name, and a weak service password makes that ticket crackable offline, quietly, with no failed logons anywhere. Pass the hash: NTLM needs the hash, not the password, so one shared local admin password means one compromised laptop means every laptop. Golden ticket: the krbtgt account signs every ticket-granting ticket in the domain, and whoever holds its key, usually via DCSync, can forge membership in anything, for anyone, until that key is rotated twice.

Here is the surprise: direct membership in Domain Admins barely matters. What matters is everything that connects an ordinary account to that privilege. A help desk worker's password-reset right. A writable attribute on one computer, which since 2019 converts a single relayed machine logon into full host takeover. Ten free computer accounts per user, courtesy of MachineAccountQuota, waiting to become delegation stepping stones. The CISA red team walked an entire domain, undetected for three months, without ever doing anything exotic.

The Cheatsheet is the map of which edge feeds which attack, and the Practice reference walks the whole chain in a lab you own. GOAD, in the Exercise, is deliberately vulnerable on purpose. The Field Notes tab carries what teams get wrong at a cost nobody states out loud.

One honest warning before you go further: these techniques are a crime outside an authorized engagement, and the scope document, not your curiosity, decides what authorized means. The techniques also assume a classic on-premises Kerberos world; cloud-synced estates shift the path surface toward tokens, which play by different rules entirely.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Penetration Testercore

Sources