top of page
Active Directory Attacks for Red and Blue Teams - Basic Edition (CRTP)

Active Directory Attacks for Red and Blue Teams - Basic Edition

​

This training is also available as Attacking and Defending Active Directory - Basic Edition as a bootcamp and on-demand class

Enterprises are managed using Active Directory (AD) and it often forms the backbone of the complete enterprise network. Therefore, to secure an enterprise from an adversary, it is inevitable to secure its AD environment. To secure AD, you must understand different techniques and attacks used by adversaries against it. Often burdened with maintaining backward compatibility and interoperability with a variety of products, AD environments lack ability to tackle latest threats.This training is aimed towards attacking modern AD Environment using built-in tools like PowerShell and other trusted OS resources.

​

The training is based on real world penetration tests and Red Team engagements for highly secured environments.

Some of the techniques (see the course content for details), used in the course

  • Extensive AD Enumeration

  • Active Directory trust mapping and abuse.

  • Privilege Escalation (User Hunting, Delegation issues and more)

  • Kerberos Attacks and Defense

  • Cross forest trust abuse

  • Credentials Replay Attacks (Over-PTH, Token Replay etc.)

  • Abusing trusts for MS products

  • Persistence (DCShadow, WMI, GPO, Domain and Host ACLs and more)

  • Monitoring Active Directory

  • Defenses

  • Bypassing defenses

The course is a mixture of fun, demos, exercises, hands-on and lecture. You start from compromise of a user desktop and work your way up to multiple forest pwnage. The training focuses more on methodology and techniques than tools. Attendees will get free one month access to an Active Directory environment comprising of multiple domains and forests, during and after the training. This training aims to change how you test an Active Directory Environment.

Course Content

The course is split in four modules across four weeks:

Module I: Enumeration, Offensive PowerShell and .NET Tradecraft

  • Enumerate useful information like users, groups, group memberships, computers, user properties, trusts, ACLs etc. to map attack paths​

  • Learn and practice different local privilege escalation techniques on a Windows machine​

  • Hunt for local admin privileges on machines in the target domain using multiple methods​

  • Abuse enterprise applications to execute complex attack paths that involve bypassing antivirus and pivoting to different machines​

  • Learn how PowerShell tools can still be used for enumeration.​

  • Learn to modify existing tools to bypass Windows Defender.​

  • Bypass PowerShell security controls and enhanced logging like System Wide Transcription, Anti Malware Scan Interface (AMSI), Script Blok Logging and Constrained Language Mode (CLM).​

  • Learn how to modify and use .NET tools to bypass Windows Defender and Microsoft Defender for Endpoint (MDE).​

  • Learn to use .NET Loaders that can run assemblies in-memory.

Module III: Domain Dominance and Escalation to Enterprise Admins

  • Abuse minimal rights required for attacks like DCSync by modifying ACLs of domain objects

  • Learn to modify the host security descriptors of the domain controller to persist and execute commands without needing DA privileges

  • ​Learn to elevate privileges from Domain Admin of a child domain to Enterprise Admins on the forest root by abusing Trust keys and krbtgt account

  • Execute intra-forest trust attacks to access resources across forest

  • Abuse database links to achieve code execution across forest by just using the databases

  • Learn about Active Directory Certificate Services and execute some of the most popular attacks.

  • Execute attacks across Domain trusts to escalate privileges to Enterprise Admins.

Module II: Lateral Movement, Domain Privilege Escalation and Persistence

  • Learn to find credentials and sessions of high privileges domain accounts like Domain Administrators, extracting their credentials and then using credential replay attacks to escalate privileges, all of this with just using built-in protocols for pivoting​

  • Learn to extract credentials from a restricted environment where application whitelisting is enforced. Abuse derivative local admin privileges and pivot to other machines to escalate privileges to domain level​

  • Understand the classic Kerberoast and its variants to escalate privileges​

  • Understand and exploit delegation issues​

  • Learn how to abuse privileges of Protected Groups to escalate privileges​

  • Abuse Kerberos to persist with DA privileges. Forge tickets to execute attacks like Golden ticket, Diamond ticket and Silver ticket to persist​

  • Subvert the authentication on the domain level with Skeleton key and custom SSP​

  • Abuse the DC safe mode Administrator for persistence​​

  • Abuse the protection mechanism like AdminSDHolder for persistence

Module IV: Monitoring, Architecture Changes, Bypassing MDE and MDI

  • Learn about useful events logged when the discussed attacks are executed

  • Learn briefly about architecture changes required in an organization to avoid the discussed attacks. We discuss Temporal group membership, ACL Auditing, LAPS, SID Filtering, Selective Authentication, credential guard, device guard (WDAC), Protected Users Group, PAW, Tiered Administration and ESAE or Red Forest

  • Learn how Microsoft's Advanced Threat Analytics and other similar tools detect domain attacks and the ways to avoid and bypass such tools

  • Understand how Deception can be effective deployed as a defense mechanism in AD

  • Learn about Microsoft’s EDR – Microsoft Defender for Endpoint and understand the telemetry and components used by MDE for detection.

  • Execute an entire chain of attacks across forest trust without triggering any alert by MDE.

  • Use Security 365 dashboard to verify MDE bypass.​

  • Learn about Microsoft Identity Protection (MDI) and understand how MDI relies on anomaly to spot an attack.

  • Bypass various MDI detections throughout the course.

What would the attendees gain?

  1. One month access to the online Lab, solutions to exercises and Lab manual.

  2. The attendees would learn powerful attack techniques which could be applied from day one after the training.

  3. The attendees would understand that it is not always required to use third party executables, non-native code or memory corruption exploits on the targets in AD.

Prerequisites

  1. Basic understanding of how penetration tests are done.

  2. Basic understanding of Active Directory.

  3. An open mind.

System Requirements

1. System with 4 GB RAM and ability to install OpenVPN client and RDP to Windows boxes.

bottom of page