Active Directory Penetration Testing: Kerberos, BloodHound, and Privilege Escalation
A primer on assessing enterprise Windows domains, mapping attack paths, and defending against Kerberoasting and Pass-the-Hash.
1. The Kerberos Protocol Architecture
Windows Active Directory relies on Kerberos for mutual authentication. When a user logs in, the Domain Controller's Authentication Service issues an encrypted Ticket Granting Ticket (TGT).
When the user needs access to a network resource (such as a SQL server), they present their TGT to request a Ticket Granting Service (TGS) ticket. Understanding this cryptographic ticket exchange is essential for enterprise security assessments.
2. Executing and Mitigating Kerberoasting
Any valid domain user can request a Kerberos service ticket for any service account registered with a Service Principal Name (SPN).
Because the ticket is encrypted using the target service account's NTLM password hash, the attacker can extract the ticket from memory and run offline brute-force attacks without alerting network firewalls.
# Requesting Kerberos service tickets for SPNs in PowerShell
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/sql01.corp.cyberlium.local:1433"
# Exporting tickets with Mimikatz:
# sekurlsa::tickets /export3. Mapping Domain Attack Paths with BloodHound
Active Directory environments develop decades of technical debt: nested groups, forgotten permissions, and service accounts logged into unpatched workstations.
BloodHound uses SharpHound collectors to ingest domain metadata into a Neo4j graph database, highlighting paths where an unprivileged helpdesk user can execute code on a machine where a Domain Admin's credentials reside in LSASS memory.
4. Architectural Defenses: The Tiering Model
To neutralize lateral movement, enterprises implement Microsoft's Enterprise Access Model (Tiering):
Tier 0: Domain Controllers, PKI, and identity infrastructure. Tier 0 credentials never log into lower-tier workstations.
Tier 1: Enterprise servers, cloud management planes, and databases.
Tier 2: User workstations and endpoints.