OPSECTLAS you are here: Active Directory
Active Directory

Decision Tree: Low-Priv Domain Creds → What First?

reference

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

start Low-priv domain user creds in hand

  1. 1
    Enumerate domain (BloodHound ingest, net commands)
  2. 2
    Check for easy wins:
    • AS-REP Roasting (users with PreAuth disabled?)
    • Kerberoasting (SPNs registered on service accounts?)
    • Password spraying (others using same/simple passwords?)
  3. 3
    Check your own permissions
    • BloodHound: "Shortest Paths to DA from Owned Principals"
    • GenericAll/GenericWrite/WriteDACL on any objects?
  4. 4
    SMB access
    • CrackMapExec: can you read any shares?
    • Any passwords/configs in shares?
  5. 5
    Lateral movement targets
    • Where can you WinRM/PSExec/RDP?
    • Reuse creds across machines
  6. 6
    DCSync (if DA or with replication rights)