Search · Nullpath

Home Sections Attack paths Search

Knowledge base

▸ AD & Kerberos Fundamentals 20

Active Directory Structure Domain Controller & FSMO Roles LDAP / LDAPS SMB SAM Database NTDS.dit LSASS Service Accounts vs Machine Accounts Service Principal Name Kerberos Authentication TGT and TGS Kerberos Pre-Authentication Kerberos PAC Kerberos Encryption Types KRBTGT Account NTLM Authentication ccache Group Managed Service Accounts LAPS AD Tiering Model

▸ Credential Access 9

Kerberoasting AS-REP Roasting DCSync Pass the Hash Pass the Key Overpass the Hash Pass the Cert Shadow Credentials PKINIT and UnPAC the Hash

▸ Kerberos Ticket Forgery 3

Golden Ticket & Silver Ticket Diamond Ticket SID History Abuse

▸ Delegation Abuse 3

Kerberos Delegation Resource-Based Constrained Delegation S4U2Self / S4U2Proxy

▸ Coercion & NTLM Relay 5

NTLM Relay & Authentication Coercion Printer Bug mitm6 / IPv6 NTLM Relay WPAD Kerberos Relay

▸ AD CS / PKI (ESC) 1

AD CS ESC Attacks

▸ ACL & Object Control 2

ACL/ACE Abuse GPO Abuse

▸ Lateral Movement & Execution 1

Remote Execution on Windows

▸ Persistence & Domain Dominance 3

AD Domain-Dominance Persistence DCShadow Skeleton Key

▸ SCCM & Imaging 2

SCCM/MECM Abuse WDS/MDT Discovery & Abuse

▸ Forest & Trust Attacks 1

AD Trust Attacks

▸ Detection & Hardening 2

AD Tiering & Hardening Baseline Honeytokens / Honey SPNs / Canary Accounts

▸ Attack Paths 21

Attack Path: GPO Edit Rights → Code Exec on DCs → Domain Admin Attack Path: DCSync AES128 → Diamond Ticket → Durable Domain Admin Attack Path: Enrollment Rights on ESC1 Template → Domain Admin Cert Attack Path: Constrained Delegation Attack Path: DCSync → Golden Ticket → Domain Admin Attack Path: AS-REP Roasting Attack Path: Forest A Compromise → SID History Trust Pivot → Forest B Attack Path: ESC8 Attack Path: Kerberoasting → Cracked Service Account → DCSync → Domain Admin Attack Path: GenericWrite/ACL → Shadow Credentials → DCSync Attack Path: LAPS Password Read → Local Admin on a Tier-0 Box → DCSync → Domain Admin Attack Path: mitm6 Attack Path: Overpass the Hash → local admin on a target Attack Path: Pass-the-Hash Attack Path: LSASS Key → Pass the Key → DCSync → Domain Admin Attack Path: RBCD on a Domain Controller → impersonate a Domain Admin on the DC → DCSync → Domain Admin Attack Path: SCCM Client → Network Access Account → Domain Admin Attack Path: Shadow Credentials Attack Path: GenericWrite on a User → SID History → Enterprise Admin Attack Path: Silver Ticket Attack Path: Coercion → Unconstrained Delegation → DCSync → Persistence

▸ Other 16

BloodHound Collection OPSEC C2 & Pivoting in AD Certificate Mapping Certificate Templates Defense Evasion for AD Tooling ESC1 ESC2 ESC3 ESC4 ESC6 NTAuthCertificates OPSEC Tradecraft for AD Ops PKI & AD CS Architecture Red-Team AD Methodology Situational Awareness Ticket & Credential Handling

All sections ↗ Attack paths ↗ Entities ↗ Sources ↗ Changelog ↗ Search ↗

kind

/ esc

Type to filter · ↑ ↓ to move · ↵ to open