Active Directory

• BloodHound
  • Graph out AD relationships
  • For testing and a Python script w/ queries (!), see: BloodHound-Tools
• Active Directory Integrated DNS dump tool
  • Also see this article
• Kerberoasting
  • Explainer that looks decent: Kerberoasting Attacks Explained
• ADRecon
  • Does what you think
• ADSearch
  • Tool written for Cobalt Strike <command> to make things more efficient
• windapsearch
  • Enumerate Windows domain
• Grouper
  • AD group policy checks
• generate-ad-username
  • Also see: Username Anarchy
• Script for spraying empty password
• Active Directory Integrated DNS dump tool
  • Export all DNS records in the domain or forest DNS zones
• adPEAS
  • Wraps multiple common tools
• PingCastle
  • AD audit tool
• AD Explorer (Sysinternals)
  • GUI-based tools for exploring a domain
• AD-control-paths
  • Similar to BloodHound
• bloodyAD
  • AD privilege escalation framework
• ASREPRoast
  • For users without attribute requiring Kerberos pre-auth
• Shadow Credentials
  • Requirement: editable msDS-KeyCredentialLink
• kerbrute
  • Kerberos pre-auth bruteforcing
• Powermad
  • MachineAccountQuota and DNS exploit tools
• Adalanche
  • AD ACL visualization/explorer
• Group3r
  • Find vulns in AD Group Policy
• Roast in the Middle
  • Original article: New Attack Paths? AS Requested Service Tickets
  • Python implementation
• AD_delegation_hunting
  • Tool by NotSoSecure that automates hunting for AD delegation access
• ADACLScanner
  • Scan AD ACLs + profit
• certsync
  • Dump NTDS with golden certificates and UnPAC the hash
• ADExplorter on Engagements
• certify
  • ADCS enum + abuse
• certipy
  • ADCS enum + abuse
• DCShadow: detecting a rogue domain controller replicating malicious changes to your Active Directory
  • dcshadow.com

Resources/Articles

• AD Resources
• Exploring Users With Multiple Accounts In BloodHound
• MachineAccountQuota is USEFUL Sometimes: Exploiting One of Active Directory's Oddest Settings
  • Written by the same person that wrote PowerMad
• AD cheatsheet
• AD methodology
• Active Directory Security
• Getting in the Zone: dumping Active Directory DNS using adidnsdump
• AS-REP Roasting
  • Note the extra reference at the bottom: Kerberos AD Attacks - More Roasting with AS-REP

ADCS

• Certified Pre-Owned Abusing Active Directory Certificate Services
  • Shorter article on Medium: https://posts.specterops.io/certified-pre-owned-d95910965cd2
• Active Directory Certificate Services: Risky Settings and How to Remediate Them
• ADCS + PetitPotam NTLM Relay: Obtaining krbtgt Hash with Domain Controller Machine Certificate