Mythical blue lake

If an organisation’s grove uses Microsoft Windows, you are almost guaranteed to find AD. Microsoft AD is the dominant suite used to manage Windows domain networks. And because AD is used for Identity and Access Management of the entire grove, it holds the keys to the kingdom, making it a very likely target for attackers.

---

Breaching

• Introduction
• NTLM authenticated services
• LDAP bind credentials
• Authentication relays
• Microsoft Deployment Toolkit
• Configuration files

Enumerating

• Introduction
• Setup for THM AD
• Credential injection
• Through Microsoft Management Console
• Through Command Prompt
• Through PowerShell
• Through Bloodhound
• Cleanup

Lateral movement and pivoting

• Introduction
• Setup for THM AD
• Moving through the network
• Spawning processes remotely
• Moving laterally using wmi
• Use of alternate authentication material
• Abusing user behaviour
• Port forwarding
• Cleanup

Exploiting

• Introduction
• Setup for THM AD
• Exploiting permission delegation
• Exploiting kerberos delegation
• Exploiting automated relays
• Exploiting AD users
• Exploiting GPOs
• Exploiting certificates
• Exploiting domain trusts

Persisting

• Introduction
• Setup for THM AD
• Persistence through credentials
• Persistence through tickets
• Persistence through certificates
• Persistence through SID history
• Persistence through group membership
• Persistence through ACLs
• Persistence through GPOs

Credentials harvesting

• Introduction
• Credential access
• Local Windows credentials
• Local Security Authority Subsystem Service
• Windows Credential Manager
• Domain Controller
• Local Administrator Password Solution
• Hashes and tickets