Introduction
Active Directory (AD) remains the backbone of identity and access management for most enterprise environments worldwide. Industry estimates suggest that more than 90% of Fortune 1000 organizations rely on Microsoft AD to manage users, systems, applications, and privileged access across their IT landscape.
Because AD controls authentication and authorization across the enterprise, it is often referred to as the “keys to the kingdom.” A successful compromise of AD can provide attackers with unrestricted access to critical systems, sensitive data, business applications, and administrative privileges.
Modern threat actors increasingly target AD to establish persistence, escalate privileges, move laterally within networks, and ultimately gain domain-wide control. Techniques such as Kerberoasting, AS-REP roasting, pass-the-ticket, golden ticket, and silver ticket attacks continue to be leveraged during ransomware campaigns and advanced cyber intrusions.
This article explores common AD attack techniques, their potential business impact, and the security measures organizations can implement to strengthen their defenses.
Why Active Directory is a prime target
Microsoft AD serves as the central authentication and authorization mechanism for enterprise environments. It manages user identities, group policies, service accounts, privileged access, and trust relationships across an organization’s infrastructure.
Because of its critical role, compromising AD often provides attackers with complete visibility and control over an organization’s environment. Once domain-level privileges are obtained, attackers can move laterally across systems, access sensitive information, establish persistence mechanisms, and potentially compromise the entire enterprise network.
Cybercriminal groups, ransomware operators, and advanced persistent threat (APT) actors frequently target AD as part of their attack lifecycle because a successful compromise can dramatically accelerate their objectives.
Tools commonly used during Active Directory security assessments
Security professionals and threat actors alike often leverage specialized tools to assess Kerberos security, enumerate domain information, identify weak configurations, and validate potential attack paths.
Commonly used tools include:
• Kerbrute
• Rubeus
• Impacket
• Mimikatz
• Hashcat
These tools help security professionals understand how adversaries may attempt to abuse AD weaknesses and enable organizations to identify and remediate vulnerabilities before they can be exploited proactively.
What will we understand from this article?
Generating golden and silver ticket attacks
Golden and silver ticket attacks involve abusing the trust established within a Windows domain by manipulating the Kerberos protocol. In essence, the attacker crafts a fake ticket to gain unauthorized access and impersonation rights over a domain controller or a service account. Let's explore these techniques further:
1. Golden ticket attacks:
A golden ticket attack aims to forge a long-term ticket-granting ticket (TGT), which grants the attacker complete control over the targeted domain. By obtaining the domain's cryptographic keys, the attacker can create a TGT with arbitrary privileges, enabling them to access sensitive data and execute malicious activities undetected.
2. Silver ticket attacks:
A silver ticket attack, on the other hand, involves forging a service ticket for a specific service account rather than the domain itself. The attacker can choose any service account on the domain and generate a fake ticket granting access to that particular account. This allows them to impersonate the service account and gain unauthorized access to network services.
The danger of Kerberoasting
In addition to golden and silver ticket attacks, one technique that cybercriminals frequently exploit is Kerberoasting. Kerberoasting takes advantage of a vulnerable implementation of Kerberos, the authentication protocol used in AD. The attacker targets service accounts that use a Kerberos-based service ticket to request a session key from the domain controller. With this information, they can crack the ticket offline, recover the service account's password hash, and potentially gain access to critical systems.
Mitigating Active Directory vulnerabilities:
While the techniques discussed above may sound alarming, it is essential to highlight that understanding these attacks is crucial for security professionals to defend against them. Here are a few measures to mitigate the risks associated with AD vulnerabilities:
1. Implement robust password policies:
Enforce complex, unique, and regularly updated passwords across all user accounts and service accounts.
2. Maintain proper privilege separation:
Grant users and service accounts only the necessary privileges required to perform their respective tasks.
3. Regularly monitor and audit AD events:
Be proactive in monitoring logs for any suspicious behavior or usage of privileged accounts.
4. Keep systems patched and updated:
Stay on top of security patches and updates to prevent known vulnerabilities from being exploited.
Attack scenario
For this assessment, assume an attacker has successfully established an initial foothold within the organization’s internal network through a compromised workstation or vulnerable endpoint.
Once inside the network, the attacker’s primary objective becomes identifying valid users, harvesting credentials, escalating privileges, and ultimately obtaining access to the domain controller.
This attack chain demonstrates how seemingly minor weaknesses can escalate into full AD compromise when adequate security controls are not in place.
Compromised credential:
Username: Administrator
Password: P@$$W0rd
Domain: controller.local
Attack 1: Kerberoasting:
Kerberoasting targets service accounts within AD. By exploiting weak encryption algorithms used in these accounts, attackers can retrieve password hashes and crack them offline, resulting in unauthorized access.
./kerbrute userenum --dc CONTROLLER.local -d CONTROLLER.local User.txt
Assuming we have already connected to the vulnerable AD machine, we can launch an attack using a tool called Rubeus.
This tool allows us to perform user enumeration, revealing which user accounts exist on the target domain and which could potentially be used to access the network.
As shown below, we extracted details for around 10 users present in the domain “CONTROLLER.local”.
These usernames can later be used to launch a brute-force attack.
Attack 2: Harvesting and brute-forcing tickets w/Rubeus
Here, using Rubeus, we can both brute-force passwords and password-spray user accounts. This attack takes a given Kerberos-based password, sprays it against all found users, and generates a .kirbi ticket. This ticket is a TGT that can be used to get service tickets from the KDC, as well as to be used in attacks like the pass-the-ticket attack.
Below we can see that we have extracted some hash values of users called CONTROLLER-1$ and
Administrator.
Attack 3: Cracking the Hash Using Hashcat
After extracting the hash value on our local attacking machine, now it’s time to launch hashcat to crack the hash obtained. Below, we can see that we have successfully cracked the passwords for users HTTPService:Summer2020 and SQLService:MYpassword123#.
Command: hashcat -m 13100 -a 0 hash.txt Pass.txt
Next: Dumping KRBASREP5 Hashes w/Rubeus
Very similar to Kerberoasting, AS-REP Roasting dumps the krbasrep5 hashes of user accounts that have Kerberos pre-authentication disabled. Unlike Kerberoasting, these users do not have to be service accounts; the only requirement to AS-REP roast a user is that pre-authentication must be disabled.
We'll continue using Rubeus the same as we have with Kerberoasting and harvesting, since Rubeus has a very simple, easy-to-understand command to AS-REP roast and attack users with Kerberos pre-authentication disabled. After dumping the hash from Rubeus, we'll use hashcat in order to crack the krbasrep5 hash.
Rubeus is easier to use because it automatically finds AS-REP Roastable users. In contrast, with GetNPUsers you must enumerate the users beforehand and know which ones may be AS-REP Roastable.
Cracked passwords for user 3 and admin2
User3:
Admin2:
Attack 4: Pass the ticket w/Mimikatz
sekurlsa::tickets /export
This will export all of the .kirbi tickets into the directory that we are currently in
Below are the .kirbi files that we can see.
When looking for which ticket to impersonate, I would recommend looking for an administrator ticket from the krbtgt, just like the one outlined in red below.
klist - Here we're just verifying that we successfully impersonated the ticket by listing our cached tickets.
Now we have impersonated the ticket by giving the same rights as the admin. To verify this, we can look at the admin share.
Attack 5: Golden/Silver Ticket Attack
The command below creates a golden ticket.
command: kerberos::golden /user:Administrator /domain:controller.local /sid:S-1-5-21-432953485-3795405108-1502158860 /krbtgt:2777b7fec870e04dda00cd7260f7bee6 /id:500
Golden Ticket Created below
After creating a golden ticket, we can access whichever machines we want. What we can access depends on the privileges of the user we chose to forge the ticket from. If we took the ticket from krbtgt, we gain access to the ENTIRE network, hence the name “golden ticket.” Silver tickets, by contrast, only grant access to the services the targeted user can reach; if that user is a domain admin, a silver ticket can reach almost the entire network, though it remains slightly less privileged than a golden ticket.
Conclusion:
We've gone through everything from the initial enumeration of Kerberos, dumping tickets, pass-the-ticket attacks, kerberoasting, AS-REP roasting, and golden/silver ticket attacks. Golden and silver ticket attacks, along with Kerberoasting, highlight the critical need for organizations to implement strong security measures. Safeguarding domain controller KRBTGT account password hashes, monitoring privileged service accounts, and securing SPNs are just a few crucial steps in mitigating these vulnerabilities. Shining a light on the dark corners of AD security is the key to staying ahead of attackers. By understanding the techniques adversaries use to breach AD environments, organizations can fortify their defenses and protect their valuable digital assets.
How Zensar helps secure AD environments
At Zensar, our Active Directory Vulnerability Assessment and Penetration Testing (VAPT) engagements replicate the same attack path demonstrated throughout this article, from user enumeration and Kerberoasting, through privilege escalation, to full domain dominance. Rather than stopping at vulnerability identification, we validate whether an attacker can realistically chain these weaknesses together to compromise your most critical business assets.
Our assessments include:
AD security reviews
Kerberos security assessments
Attack path analysis
Privilege escalation testing
Service Account Reviews
Pass-the-Hash/pass-the-ticket exposure validation
Domain controller security assessments
Remediation validation
This approach helps organizations understand not only what vulnerabilities exist, but also how they could be exploited in a real-world breach, so remediation efforts can be prioritized where they matter most. If your organization relies on Active Directory, as most enterprises do, it is worth knowing how it would hold up against a determined attacker. Connect with Zensar’s cybersecurity team to scope an Active Directory VAPT engagement and validate your defenses against the techniques described above.