Active Directory
Named by 76 kept items in this workspace.
39 items name it under classification.technologies, 36 under affected products and 1 under technologies.
Search every workspace for Active Directory. It matches the name as written, so it can find other things that share it.
The items that name it 76
synthetic multi-forest engagement modeled on GOAD
domain credentials and metadata stolen from environment
Target of the ADStrike pentest run in the author's lab using a regular unprivileged domain account
Sensitive data extracted using DC.ex tool
Windows-based environment component noted as touching everything; vulnerable to an adversary pushing a malicious group policy object (GPO) to every joined device.
lab domain lab.local, NetBIOS LAB, subnet 192.168.100.0/24
Domain Controllers vulnerable to anonymous (null session) SAMR/LSARPC enumeration when RestrictAnonymous settings and Pre-Windows 2000 Compatible Access group are misconfigured
Targeted for reconnaissance, credential theft (ntds.dit/SAM/SYSTEM extraction), lateral movement, and GPO-based wiper/ransomware deployment by The Gentlemen and Qilin.
NTDS.dit database targeted for credential extraction via shadow copies
On-premises Active Directory domain environments, including hardened domains with NTLM disabled, AES-only Kerberos, LDAP channel binding, Protected Users, LAPS, gMSA, and MachineAccountQuota controls
Domain enumerated via Get-ADUser and Get-ADComputer PowerShell commands, dumping full user and computer properties to C:\ProgramData\AdUsers.txt and AdComp.txt.
Example target for assessment via DarkMoon (./darkmoon.sh "TARGET: 192.168.1.10")
AD-integrated DNS, Certificate Services, SCCM/MECM and SCOM infrastructure discoverable via LDAP
Enumerated by the attacker's vibe-coded PowerShell script to map users, computers, groups, OUs, subnets, and trusts.
on-premises
Description, info, and adminComment attributes found storing cleartext passwords.
internal AD attacks (BloodHound, Kerberoasting, ASREProast, DCSync, Pass-the-Hash, AD CS abuse, ntlmrelayx, Responder, PetitPotam) explicitly out of scope for this bundle; future bundle territory
LDAP query filter processing/optimization on Domain Controllers causes non-existent attribute queries to be transformed to (! (FALSE)) before logging in Event ID 1644, and deviates from RFC 4511 by evaluating undefined filter conditions as FALSE instead of Undefined
LDAP Directory Service logging (Event ID 1644); nTSecurityDescriptor attribute and SDFlags control (LDAP_SERVER_SD_FLAGS_OID, per MS-ADTS Section 3.1.1.3.4.1.11) exploited for attack path enumeration
LDAP Service Layer transforms OID syntax to bitwise operations before logging in Event 1644, resulting in inconsistent whitespace formatting
LDAP service used for authentication and directory queries, subject to reconnaissance via LDAP filters
Computer and user objects affected by WriteAccountRestrictions (WAR) property set misconfigurations, including domain controller accounts
Central subject of analysis; misconfigurations found across 250 PingCastle reports from IR cases and Compromise Assessments
msDS-KeyCredentialLink attribute abuse (Shadow Credential attacks) via Key Trust in Hybrid joined environments
Core subject of the course labs; small but full AD domains used for compromise exercises
Domain 'LAB.LOCAL' created as the lab's directory service
domain crawled via SMB auto-discovery and LDAP by Sift
All technologies in this workspace.