Active Directory attack paths
Almost every AD compromise runs one loop: enumerate what the directory shows you, use the access you have to obtain a credential, move to where that credential has rights, and repeat until you reach domain admin. Enumeration — users, groups, ACLs, delegation, trusts — is where the path is found, not exploitation.
Active Directory is where a growing share of these exams are won or lost, and it rewards a method rather than a bag of tricks. The chain below is the shape of almost every AD compromise; the specific technique at each step varies, the sequence rarely does.
The shape of the attack
You start with something small — an unauthenticated foothold, or one low credential — and you work toward domain or enterprise admin by repeating one loop: see what you can, use what you have, get something better, repeat.
Every step answers two questions. What does the directory let me see from here? And what does what I can see let me become?
Enumerate before you act
AD attacks turn on information, and the directory will tell you an enormous amount if you ask. Map the domain: users, groups, computers, and crucially the relationships between them — group memberships, nested groups, access-control entries, delegation settings, and trusts to other domains.
The path is usually already visible in this map. A service account with an unusual privilege, a user in a group that is in a group that has rights over a host, a trust that lets you cross into another domain — these are found by reading the directory, not by guessing.
Credential access
The recurring move is turning access into credentials:
- Credentials cached on a host you control
- Service account credentials recoverable because of how the account is configured
- Tickets you can request and crack offline
- Credentials sitting in places they should not be — share files, script comments, directory attributes
Each credential is a new starting point for the loop.
Lateral movement
With a credential, move to where it has rights. The credential you extracted on one host is frequently valid on another, and the account you compromised frequently has access somewhere more useful than where you found it. Reuse and over-privilege are the two conditions that make AD networks fall.
Escalation to the domain
The endgame is an account, a ticket, or a trust relationship that grants control over the domain. The route there is a chain of the moves above, assembled from what enumeration revealed — which is why the enumeration step is not optional and not a formality.
Document the chain as you go
For exams this is inseparable from the report: an AD compromise is a sequence of small steps, and reconstructing the order afterwards is where marks are lost. Note, at every hop, what you had, what you did, and what you got. See the report guides for how each vendor wants this presented.