Key takeaways
Why AD is still the primary enterprise target
Active Directory controls authentication, authorization, and group policy for most enterprise environments. A domain admin account is effectively a master key to every Windows system in the organization. That is why AD compromise is the goal of most internal penetration tests and red team engagements.
In 2026, hybrid environments (on-prem AD + Azure AD / Entra ID) have expanded the attack surface. Techniques that work on-prem often have cloud equivalents, and trust relationships between the two environments create new lateral movement paths.
Kerberoasting: extracting service account hashes
Kerberoasting exploits the Kerberos protocol to extract password hashes for service accounts. Any authenticated domain user can request a Kerberos service ticket (TGS) for any service principal name (SPN). The ticket is encrypted with the service account's NTLM hash, which can be cracked offline.
The attack is silent from a network perspective — requesting service tickets is normal Kerberos behavior. Detection requires monitoring for unusual TGS requests, particularly for accounts with weak passwords.
Kerberoasting with Impacket
# Get all kerberoastable accounts
python3 GetUserSPNs.py DOMAIN/user:password -dc-ip 10.10.10.1 -request
# Output: hashes in $krb5tgs$23$* format
# Crack with hashcat
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt --forceAS-REP Roasting: no credentials needed
AS-REP Roasting targets accounts with Kerberos pre-authentication disabled. Without pre-auth, an attacker can request an AS-REP for any username and receive a response encrypted with the user's password hash — no credentials required.
This is particularly dangerous for service accounts and legacy accounts where pre-auth was disabled for compatibility reasons.
AS-REP Roasting without credentials
# Enumerate accounts without pre-auth
python3 GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip 10.10.10.1 -no-pass
# Crack the AS-REP hash
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txtBloodHound: mapping attack paths
BloodHound uses graph theory to map relationships between AD objects and identify attack paths to high-value targets. It ingests data from SharpHound (Windows) or BloodHound.py (Linux) and visualizes paths like: compromised user → group membership → ACL → domain admin.
The most valuable BloodHound queries find shortest paths to Domain Admins, accounts with DCSync rights, and Kerberos delegation misconfigurations.
BloodHound data collection
# Collect from Linux (no agent needed)
python3 bloodhound.py -u user -p password -d DOMAIN -dc 10.10.10.1 -c All
# Import JSON files into BloodHound
# Then run: Find Shortest Paths to Domain AdminsDCSync: dumping the entire domain
DCSync abuses the Directory Replication Service (DRS) protocol to request password hashes for any account, including krbtgt and all domain admins. It requires the Replicating Directory Changes All privilege, which is held by Domain Admins and can be granted via ACL abuse.
A successful DCSync gives you the NTLM hash of every account in the domain, enabling Pass-the-Hash attacks against any system.
DCSync with Impacket secretsdump
# Dump all hashes via DCSync
python3 secretsdump.py DOMAIN/admin:password@10.10.10.1
# Or with just the krbtgt hash (for Golden Ticket)
python3 secretsdump.py DOMAIN/admin:password@10.10.10.1 -just-dc-user krbtgtFAQ
What is the difference between Pass-the-Hash and Pass-the-Ticket?
Pass-the-Hash uses an NTLM hash to authenticate to services that accept NTLM. Pass-the-Ticket uses a Kerberos ticket (TGT or TGS) to authenticate to Kerberos-enabled services. Both allow lateral movement without knowing the plaintext password.
