⟩ Offensive Security
AD EXPLOITATION
Active Directory Attacks
Kerberoasting, ACL abuse, ADCS attacks and domain dominance paths.
What I deliver
- BloodHound path analysis
- Constrained/unconstrained delegation abuse
- ADCS ESC1-ESC11 exploitation
⟩ real-world projects
Selected engagements
Sanitized highlights from real client work — approach, the bug we found, and the fix shipped. Names redacted under NDA.
01
ADCS ESC1 → domain admin on manufacturing client in <2 hours, template hardening shipped same week
02
Kerberoasting + RBCD chain on government tenant — full AD tier-0 compromise simulation
⟩ common vulnerabilities & how I find them
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
01
HighKerberoasting
- STEP 1Enumerate SPN-enabled accounts with GetUserSPNs.py
- STEP 2Request TGS tickets and extract hashes
- STEP 3Crack offline with Hashcat (mode 13100)
- STEP 4Fix: long random gMSA passwords, AES-only encryption, monitor 4769 events
02
CriticalADCS ESC1 (Enrollee Supplies Subject)
- STEP 1Run Certipy find to enumerate vulnerable templates
- STEP 2Request cert with arbitrary subject (UPN=Administrator)
- STEP 3Authenticate via PKINIT and obtain TGT
- STEP 4Fix: disable enrollee-supplies-subject, require manager approval, restrict enroll rights
03
CriticalNTLM Relay + LDAP Signing
- STEP 1Poison LLMNR/NBT-NS with Responder
- STEP 2Relay captured NTLM to LDAP/SMB with ntlmrelayx
- STEP 3Add machine account / shadow credentials → DCSync
- STEP 4Fix: disable LLMNR/NBT-NS, enforce LDAP signing + channel binding, SMB signing
04
CriticalShadow Credentials (msDS-KeyCredentialLink)
- STEP 1Find principals with GenericWrite/GenericAll on a target account via BloodHound
- STEP 2Add an attacker-controlled key credential with Certipy or Whisker
- STEP 3Request a TGT via PKINIT using the shadow credential — no password needed
- STEP 4Fix: monitor msDS-KeyCredentialLink writes, restrict write ACLs on Tier-0 objects
⟩ arsenal
Tools & frameworks
BloodHound
AD Attack Paths
Impacket
Network Protocols
Rubeus
Kerberos Toolkit
Certipy
ADCS Exploitation
Mimikatz
Credential Theft
PowerView
AD Recon
Kerbrute
Kerberos Brute
ADRecon
AD Enumeration
CrackMapExec
Post-Exploitation
Certify
Security Tool
Coercer
Security Tool
⟩ engage
Need active directory attacks expertise?
⟩ related