Active Directory Pentesting

---
name: active-directory-pentesting
description: "Use when testing Active Directory security."
version: 1.0.0
author: Hermes Agent
license: MIT
metadata:
  hermes:
    tags: [Active-Directory, AD-pentest, Kerberos, LDAP, domain-escalation, BloodHound]
    related_skills: [kerberos-attacks-forge, privilege-escalation-techniques, lateral-movement-pivoting, identity-access-management]
---

# Active Directory Penetration Testing

Testing Active Directory security — from enumeration (BloodHound) through Kerberos attacks, ACL abuse, domain privilege escalation, and forest trust attacks.

## When to Use

- Assessing Active Directory security posture
- Identifying privilege escalation paths in AD
- Testing Kerberos delegation and trust relationships
- Simulating domain compromise scenarios
- Auditing AD ACLs and group memberships

## AD Attack Techniques

```python
AD_TECHNIQUES = {
    'kerberoasting': 'Request TGS tickets for service accounts, crack offline',
    'asrep_roasting': 'Request AS-REP for users without pre-authentication, crack offline',
    'golden_ticket': 'Forge Kerberos TGT with KRBTGT hash — domain admin persistence',
    'silver_ticket': 'Forge TGS for specific service — access without domain admin',
    'dcom_exec': 'Execute commands via DCOM (MMC20.Application, ShellWindows)',
    'wmi_exec': 'Execute commands remotely via WMI',
    'sccm_pwn': 'Abuse System Center Configuration Manager for lateral movement',
    'acl_abuse': 'Abuse WriteOwner, WriteDACL, ForceChangePassword, GenericAll ACEs',
}

BLOODHOUND_QUERIES = [
    "Find all Domain Admins",
    "Shortest path to Domain Admin from owned principals",
    "Kerberoastable users",
    "AS-REP roastable users",
    "Users with admin count = 0 (shadow admin)",
    "Computers with unconstrained delegation",
]

def kerberoast_demo(target_domain: str, username: str, password: str):
    """Request TGS tickets for kerberoasting (authorized testing only)."""
    pass
```

## Verification Checklist

- [ ] AD enumeration completed (BloodHound, LDAP queries)
- [ ] Kerberoasting attempted for service accounts
- [ ] AS-REP roasting attempted for users without pre-auth
- [ ] ACL analysis (Abusable ACEs: WriteOwner, WriteDACL, GenericAll, ForceChangePassword)
- [ ] Kerberos delegation abuse (unconstrained, constrained, resource-based)
- [ ] Domain trust relationships enumerated and attacked
- [ ] Golden/silver ticket attacks demonstrated
- [ ] DCSync attempt (DRS protocol replication)
- [ ] Findings documented with remediation guidance
- [ ] All testing on authorized domains only