August 9, 2026

Offensive Active Directory: 12 Hands-On Techniques Every Red Teamer Should Master

Ever wonder why some pentesters breeze through Active Directory environments like it’s a walk in the park, while others get stonewalled at…

By Very Lazy Tech 👾

6 min read

Ever wonder why some pentesters breeze through Active Directory environments like it's a walk in the park, while others get stonewalled at every turn? Here's a stat that might surprise you: over 90% of Fortune 1000 companies still rely on Active Directory for authentication. That makes AD one of the most targeted — and misunderstood — kingdoms in corporate security. If you want to stand out as a red teamer, you need more than surface-level knowledge. You need to know the tricks, the pitfalls, and the real-world attacks that work when defenders aren't just asleep at the wheel.

In this guide, you'll get a deep-dive into 12 powerful offensive Active Directory techniques that'll sharpen your skills — whether you're working an internal pentest, simulating advanced persistent threats, or just geeking out in your home lab. We'll hit every stage: enumeration, lateral movement, privilege escalation, persistence. Plus, I'll share bits of "here's what actually works" you won't find in the usual cheat sheets.

Let's get into it.

Cybersecurity

Enumeration: The Foundation of Offensive AD

Before you touch a single exploit, you need to map the terrain. Enumeration is the bread and butter of every AD engagement. The goal? Learn everything — users, groups, shares, policies, trust relationships, and the subtle stuff most blue teams overlook.

BloodHound: Visualizing AD Relationships

BloodHound is that tool everyone talks about for a reason. It gives you a visual map of privilege relationships — think "who can RDP to what," "who can reset which password," that sort of thing.

Step-by-step:

  1. Collect Data:
   SharpHound.exe -c all

(Run from a domain-joined workstation.)

  1. Pull Data Off:

Transfer the collected zip file back to your attack box.

  1. Analyze:

Load it into BloodHound, and start exploring shortest paths to Domain Admin.

You'd be surprised how often a lowly Helpdesk account can domino its way up to DA.

PowerView: The Swiss Army Knife

PowerView is a PowerShell toolkit for deep enumeration. Example: Find all domain admins.

Get-NetGroupMember -GroupName "Domain Admins"

Or, list all computers:

Get-NetComputer -FullData

Again, you're not looking for just raw data — you want insights. Who has local admin on what? Any service accounts with weak passwords?

LDAP Queries: Raw and Direct

Sometimes, stealth matters. LDAP queries are less noisy.

Example: Find all users with SPNs (for Kerberoasting):

ldapsearch -x -b "dc=corp,dc=domain,dc=com" "(&(objectClass=user)(servicePrincipalName=*))"

You might not always have the right tools dropped, so getting cozy with LDAP is crucial.

2. Kerberoasting: Cracking Service Account Passwords

Kerberoasting is a goldmine. You're abusing how service accounts (with SPNs) have their password hashes stored in ticket-granting service tickets.

How it works:

  • Request a service ticket for any SPN-enabled user.
  • Offline crack the extracted hash.
  • Use cracked credentials to escalate.

In practice:

  1. Find SPN Accounts:
   Get-NetUser -SPN
  1. Request Tickets:
   Invoke-Kerberoast
  1. Extract Hashes:

Pull the hashes into your favorite cracker (Hashcat, John, etc.).

   hashcat -m 13100 kerberoast_hashes.txt rockyou.txt

Pro tip: Service accounts are often set with "never expires" passwords. Admins rarely change them. I've landed DA creds in under 30 minutes thanks to this.

3. Pass-the-Hash (PtH): Authenticating Without the Password

Still relevant, still deadly. With PtH, you use NTLM hashes as credentials — no cracking needed.

What you need:

  • Compromised NTLM hash (from SAM, LSASS memory, or Kerberoasting).
  • A tool like impacket's psexec.py, wmiexec.py, or mimikatz.

Example:

psexec.py CORP/user:'aad3b435b51404eeaad3b435b51404ee:cc36cf7a8514893efccd332446158b1a'@target

You're logged in as that user, without ever seeing their password.

Watch for… SMB signing. If it's enforced, you're out of luck (unless you downgrade or find another vector).

4. Pass-the-Ticket (PtT): Living in Memory

Passwords and hashes aren't the only credentials in play. Kerberos tickets (TGTs, TGSs) are fair game. With PtT, you inject a ticket into your session and slide right in.

Common tools: mimikatz, Rubeus.

Quick Guide:

  1. Dump a ticket:
   sekurlsa::tickets /export
  1. Inject a ticket:
   kerberos::ptt ticket.kirbi
  1. Access resources: If your injected ticket is valid for, say, CIFS or RDP, you're in.

The cool part? Tickets are valid for hours (sometimes days). And most blue teams don't watch for golden/silver ticket use — unless they're really on their toes.

5. Lateral Movement with WMI and SMB

Lateral movement is where offensive AD work gets creative.

WMI (Windows Management Instrumentation):

Allows remote command execution if you have valid creds.

Example:

wmiexec.py CORP/user:Password123@target

Or with PowerShell:

Invoke-WmiMethod -Path win32_process -Name create -ArgumentList "cmd.exe /c whoami"

Great for stealth, since WMI traffic is less obvious than RDP.

SMB/PSExec:

  • psexec.py gets you a SYSTEM shell.
  • smbexec.py drops a semi-interactive shell over SMB.

Again, if SMB signing is enforced, you'll hit a wall. But on internal networks? Plenty of shops leave this wide open.

6. Abuse of Unconstrained Delegation

Here's where it gets spicy. Unconstrained delegation lets a server impersonate users who authenticate to it. If you compromise such a server, you can capture TGTs for any user who connects — including domain admins.

How to find targets:

Get-ADComputer -Filter {TrustedForDelegation -eq $true}

Or in PowerView:

Get-NetComputer -Unconstrained

Attack Flow:

  1. Compromise the server (via RCE, weak creds, whatever).
  2. Wait for a high-privileged user to log in.
  3. Capture their TGT via mimikatz:
   sekurlsa::tickets /export
  1. Pass-the-Ticket to escalate privileges.

I've seen this in the wild — an overlooked print server can be your golden ticket.

7. Exploiting ACLs/Delegated Permissions for Privilege Escalation

Most red teamers focus on group memberships. But Access Control Lists (ACLs) hide a treasure trove of misconfigurations.

The trick:

If you have write privileges over a user, group, or computer object, you can often reset passwords, add users, or otherwise escalate.

Find vulnerable ACLs with:

Invoke-ACLScanner

Or BloodHound's "Shortest Path to Domain Admin" (it'll flag "GenericWrite", "GenericAll", "ResetPassword" rights).

Exploit Example: Resetting a user's password you have control over:

Set-ADAccountPassword -Identity victimuser -NewPassword (ConvertTo-SecureString "Winter2023!" -AsPlainText -Force)

Suddenly, you own that account.

Real talk: Most defenders don't audit delegated permissions. It's a stealthy move.

8. AS-REP Roasting: Cracking Passwords Without Pre-Authentication

Some user accounts have "Do not require Kerberos pre-authentication" enabled. Rare, but still out there, especially for service accounts or legacy systems.

Why does this matter? You can request an encrypted ticket for these users and brute-force their password offline.

Hunting with PowerView:

Get-ASREPHash

Or manually, with impacket:

GetNPUsers.py -dc-ip 10.10.10.2 corp.local/ -usersfile users.txt -format hashcat

Crack the hashes as you would with Kerberoasting — they're often weak or reused.

9. Silver Ticket Attack: Targeted Kerberos Forgery

Everyone talks about golden tickets, but silver tickets fly under the radar. Here, you forge a Kerberos ticket for a service on a specific computer (like CIFS or HTTP), not the whole domain.

Steps:

  1. Dump the service account's NTLM hash (often via Kerberoasting or credential access).
  2. Craft a silver ticket with mimikatz:
   kerberos::golden /user:user /domain:corp.local /sid:S-1-5-21-xxxx... /rc4:<NTLM> /service:cifs /target:targetserver
  1. Inject with kerberos::ptt, then access the service (shared folder, web app, etc.).

Because you're only forging tickets for a single service, most SOCs won't spot this unless they're hunting for it.

10. Ticket Harvesting: Living Off the Land

If you get access to a workstation or server, pull all the Kerberos tickets in memory. They sometimes belong to admins who logged in for a quick fix.

Use mimikatz:

sekurlsa::tickets /export

Or with Rubeus:

Rubeus.exe dump

You'll find tickets for services, users, even TGTs. Replay them elsewhere to escalate or pivot.

True story: On a recent engagement, I found a domain admin's TGT sitting on a developer's laptop. That was game over.

11. Group Policy Abuse: Weaponizing GPOs

If you have edit rights on a Group Policy Object, congratulations: you can push arbitrary code to hundreds of computers in a single stroke.

Steps:

  1. Find GPOs you control:
   Get-NetGPO | Get-NetGPOGroup
  1. Edit the GPO to add a startup script or scheduled task.

Example: Add a malicious PowerShell script as a startup policy.

   Set-GPPrefRegistryValue -Name "EvilGPO" -Key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" -ValueName "Backdoor" -Value "powershell.exe -nop -w hidden -enc <payload>"
  1. Wait for systems to update group policy (gpupdate /force).

The reach of GPO abuse is massive — and most IT teams never suspect an insider would weaponize it.

12. Persistence: Skeleton Keys, DSRM, and SIDHistory

Getting DA is sweet. Staying DA is better. Here are a few persistence tricks that stick around:

Skeleton Key (with mimikatz):

Install a patch that lets you log in as any user with a master password ("skeleton key"). It's noisy, but effective on unmonitored DCs.

privilege::debug
misc::skeleton

Now, "mimikatz" works as a password for any account — until reboot.

DSRM (Directory Services Restore Mode):

Set the DSRM password, then use it locally on a DC.

ntdsutil "set dsrm password" "reset password on server DC01" "q" "q"

SIDHistory Injection:

Add your SID to another account's SIDHistory. Now, you inherit their privileges.

Fun fact: SIDHistory is rarely audited, yet it's a stealthy way to persist high-level access.

Wrapping Up: Bringing It All Together

Active Directory's attack surface is wild — layered, quirky, and constantly evolving. The techniques above aren't just for checklists. They're meant to be chained, blended, adapted. In real red team ops, it's almost never one magic trick; it's a chain of "boring" misconfigs that, together, open the castle gates.

Here's where it gets interesting: most blue teams are still catching up to the basics. If you walk in with these 12 techniques dialed in, you'll run circles around the average defender — and help raise the bar for everyone.

And remember, nothing beats hands-on lab time. Spin up a test domain. Try these out. Break things (and fix them, if you can). The more you play, the more you'll spot out in the wild.

Happy hacking!

🚀 Become a VeryLazyTech Member — Get Instant Access

What you get today:

✅ 70GB Google Drive packed with cybersecurity content

✅ 3 full courses to level up fast

👉 Join the Membership → https://shop.verylazytech.com

📚 Need Specific Resources?

✅ Instantly download the best hacking guides, OSCP prep kits, cheat sheets, and scripts used by real security pros.

👉 Visit the Shop → https://shop.verylazytech.com

💬 Stay in the Loop

Want quick tips, free tools, and sneak peeks?

✖ https://x.com/verylazytech/

| 👾 https://github.com/verylazytech/

| 📺 https://youtube.com/@verylazytech/

| 📩 https://t.me/+mSGyb008VL40MmVk/

| 🕵️‍♂️ https://www.verylazytech.com/