9.6.0 Stage 06: Active Directory and Lateral Movement
← Main index | AD cheatsheet | Master Notes | Strategy map | Study methods: Recover and use authentication material; Map Active Directory attack paths; Gain a more useful domain identity; Check which other hosts your current identity can access
Reasoning chain: Identity → Group → Rights → Host Access → Session/Credential → New Identity → Higher Privilege. Validate each edge and route; BloodHound proposes paths but does not prove them.
Focused AD investigation guide — where to look, expected behavior, annotated synthetic observations and the next prerequisite to validate. Investigation command chooser.
| Task | Open |
|---|---|
| Identify the domain, objects, rights, shares, sessions and candidate paths | Domain mapping |
| Recover credentials/tickets from an already controlled host when privileges permit | Select accessible credential material for the next identity transition |
| AS-REP roast, Kerberoast, password validation and ticket transitions | Kerberos and identity transitions |
| Convert validated user/group/SPN/DACL rights and domain-replication rights; branch to AD CS/GPO/delegation only when evidence selects them | Object control and domain compromise |
| Match password/hash/ticket to a reachable remote service | Check which other hosts your current identity can access |
9.6.0.1 Generic worked chain
- A supplied low-privilege domain identity authenticates to LDAP and SMB.
- Native/LDAP/PowerView collection identifies computers, groups, SPNs, shares and ACL candidates.
- BloodHound suggests that the identity can control a group whose members administer an application server; manual checks validate both the directory right and host authorization.
- A remote session exposes an application configuration credential. Its identity/context is validated before reuse.
- The new identity has a roastable service account or a validated remote-management path to another host.
- A higher-privileged session produces a new credential/ticket or reveals replication rights.
- Every identity/host/route transition triggers re-enumeration and evidence capture.
This is a reasoning example, not a target solution or claim of practical completion.
Exit condition: the chosen relationship has been validated through compatible authentication and authorization, the new host/identity is verified, and the environment is re-enumerated from the new state.
-
Conditional infrastructure and trusts: DNSAdmins, WSUS, SCCM and trust-boundary checks.
-
Diagrams: AD capability transitions before mapping; credential routing before credential classification.