# Setting the Stage

# AD Basics

Active directory arrived in 2000 with release of Windows Server 2000
relies heavily on two of its predecessors
- x.500
- LDAP
provides three key functions:
- authentication
- accounting
- authorization
43% market share for enterprise IAM, and almost all of fortune 100
some good skills for an AD tester:
- living off the land - make use of built in Windows tools whenever possible. It might be all thats avaialble.
- Working from Linux or Windows. You wont always have a Kali drop box. Most techniques can run on either OS.

Scenario 1 - Waiting on an Admin

compromised 1 host and local privesc to SYSTEM
host was domain-joined, so could be used to enumerate the domain (via the hosts computer account)
Got a few TGS through kerberoasting but couldnt crack
tried a larger wordlist and better rule and got 1 hit
the account was not admin but had some SMB share write access
wrote SCF files on the shares and waiting for a callback to responder
got a NetNTLMv2 of a domain admin

Scenario 2 - Spraying the Night Away

found an SMB NULL sesion with enum4linux and retrieved user list and domain password policy
Got a hit via password spray
user had local admin on several hosts
one had an active session from a DA - used rubeus to grab the TGT
pass the ticket to login as the DA

Scenario 3 - Fighting in the Dark

wasnt having any luck. used kerbrute to try enumerating usernames
got 516 valid users by pulling names off linkedin
had to spray carefully - did 1 spray and got a hit
had RDP to one host - logged in to get the policy and full userlist than sprayed from there
got several hits, one had GenericAll over Enterprise Key Admins
added an owned account EKA then did shadow credential to get DC NT hash
used DC hash to DCSYNC