Advanced Offensive Security
Active Directory Attacks
Kerberoasting, AS-REP roasting, Pass-the-Hash, and BloodHound.
Most corporate networks run on Microsoft Active Directory (AD). Once you have any domain foothold, AD attacks let you escalate from a normal user to Domain Admin — total control of the organisation. This is the core skill of internal network pentesting.
Key attack techniques
- Kerberoasting — request service tickets (SPNs) and crack them offline to recover service-account passwords.
- AS-REP Roasting — for accounts with pre-auth disabled, grab a crackable hash without any credentials.
- Pass-the-Hash (PtH) — authenticate using an NTLM hash directly, no plaintext password needed.
- Pass-the-Ticket / Golden Ticket — forge Kerberos tickets after compromising the krbtgt account.
- BloodHound — graphs AD relationships to reveal the shortest path to Domain Admin.
# Enumerate the domain and find attack paths
bloodhound-python -u user -p pass -d corp.local -c all
# Kerberoast SPN accounts (Impacket)
GetUserSPNs.py corp.local/user:pass -request
# Crack the ticket offline
hashcat -m 13100 tickets.txt rockyou.txt
# Pass-the-Hash with the recovered NTLM hash
crackmapexec smb 10.0.0.0/24 -u admin -H <NTLM_HASH>