9.6.1 Active Directory Domain Mapping

← Stage index | LDAP/Kerberos baseline | AD cheatsheet | Master Notes | Strategy map | Study methods: Map Active Directory attack paths

Prerequisite: one authorized domain identity and a route to the required DC/hosts. Record the source host, exact identity, domain FQDN, DNS server, DC FQDN/IP and time state before interpreting failures.

Coverage: mapping only. SPNs, ACLs, sessions and credentials are candidate transitions; ticket requests, directory changes, credential access and remote execution belong to the later Stage 06 procedures.

Exit: produce a ranked, manually checked map in the form CONTROLLED IDENTITY → EFFECTIVE RELATIONSHIP → OBJECT/HOST → REACHABLE SERVICE → POSSIBLE NEW ACCESS.

9.6.1.1 AD capability transitions

Open scalable SVG | Open PNG

9.6.1.2 Keep four maps, not one tool output

IDENTITY MAP: USER/COMPUTER -> DIRECT + NESTED GROUPS -> DIRECTORY RIGHTS
HOST MAP:     COMPUTER -> OS/ROLE -> LOCAL/REMOTE-ACCESS RIGHTS -> SESSIONS
ROUTE MAP:    SOURCE -> DNS/KDC/DC/HOST -> REQUIRED PORT/SERVICE
LEAD MAP:     EVIDENCE -> HYPOTHESIS -> MINIMUM VALIDATION -> NEXT BLOCK

Authentication, authorization, reachability and session presence are independent. A valid LDAP bind does not prove share access; SMB administration on one host does not prove directory privilege; a session edge does not prove retrievable credentials.

9.6.1.3 Establish identity, domain, DC, DNS and time

9.6.1.3.1 Domain-joined Windows source

whoami /all
echo %USERDNSDOMAIN%
echo %USERDOMAIN%
echo %LOGONSERVER%
nltest /dsgetdc:DOMAIN
nltest /dclist:DOMAIN
w32tm /query /status

[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.DOMAIN
Resolve-DnsName -Type SRV _kerberos._tcp.DOMAIN

9.6.1.3.2 Kali/off-domain source

dig +short SRV _ldap._tcp.dc._msdcs.DOMAIN @DC_IP
dig +short SRV _kerberos._tcp.DOMAIN @DC_IP
nxc smb DC_IP -d DOMAIN -u USER -p 'PASSWORD'
ldapsearch -x -LLL -H ldap://DC_HOST:389 -s base -b '' \
  defaultNamingContext configurationNamingContext rootDomainNamingContext dnsHostName

whoami /all
klist
dir \\DC_HOST\SYSVOL

net user /domain
net user USER /domain
net group /domain
net group "Domain Admins" /domain
net group "GROUP" /domain
net accounts /domain
nltest /domain_trusts /all_trusts
net view /domain
net view \\DC_HOST

Get-Command -Module ActiveDirectory
Get-ADDomain
Get-ADForest
Get-ADDomainController -Filter *
Get-ADUser -Filter * -Properties Enabled,Description,MemberOf,ServicePrincipalName,UserPrincipalName,PasswordLastSet,LastLogonDate,AdminCount
Get-ADGroup -Filter * -Properties GroupScope,GroupCategory,Members,Description
Get-ADGroupMember -Identity 'GROUP' -Recursive
Get-ADComputer -Filter * -Properties DNSHostName,OperatingSystem,OperatingSystemVersion,ServicePrincipalName,TrustedForDelegation,LastLogonDate
Get-ADTrust -Filter *

$root = [ADSI]'LDAP://RootDSE'
$base = [ADSI]("LDAP://" + $root.defaultNamingContext)
$searcher = New-Object System.DirectoryServices.DirectorySearcher($base)
$searcher.PageSize = 1000
$searcher.PropertiesToLoad.AddRange(@('samaccountname','userprincipalname','objectsid','memberof','serviceprincipalname','description','useraccountcontrol','pwdlastset','lastlogontimestamp'))
$searcher.Filter = '(&(objectCategory=person)(objectClass=user))'
$searcher.FindAll() | ForEach-Object { $_.Properties }

# Groups
$searcher.Filter = '(objectCategory=group)'
$searcher.PropertiesToLoad.Clear()
$searcher.PropertiesToLoad.AddRange(@('samaccountname','objectsid','member','grouptype','description'))
$searcher.FindAll() | ForEach-Object { $_.Properties }

# Computers
$searcher.Filter = '(objectCategory=computer)'
$searcher.PropertiesToLoad.Clear()
$searcher.PropertiesToLoad.AddRange(@('dnshostname','operatingsystem','operatingsystemversion','serviceprincipalname','useraccountcontrol','lastlogontimestamp'))
$searcher.FindAll() | ForEach-Object { $_.Properties }

ldapsearch -x -LLL -H ldap://DC_HOST:389 -s base -b '' \
  defaultNamingContext configurationNamingContext rootDomainNamingContext dnsHostName

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user))' \
  sAMAccountName userPrincipalName objectSid userAccountControl memberOf description servicePrincipalName pwdLastSet lastLogonTimestamp adminCount

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(objectCategory=group)' sAMAccountName objectSid member groupType description

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(objectCategory=computer)' dNSHostName operatingSystem operatingSystemVersion servicePrincipalName userAccountControl lastLogonTimestamp

# SPN-bearing accounts: mapping only; do not request tickets in this block.
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))' \
  sAMAccountName servicePrincipalName memberOf userAccountControl pwdLastSet

# Trusted-domain objects
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -b 'DC=DOMAIN,DC=TLD' '(objectClass=trustedDomain)' \
  cn securityIdentifier trustDirection trustType trustAttributes

# OUs and GPO containers; correlate links before inferring host effect.
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(|(objectClass=organizationalUnit)(objectClass=groupPolicyContainer))' \
  distinguishedName displayName name gPLink gPOptions

Import-Module .\PowerView.ps1
Get-Command -Module PowerView
Get-Domain
Get-DomainController
Get-DomainTrust
Get-DomainUser | Select-Object samaccountname,userprincipalname,description,memberof,serviceprincipalname
Get-DomainGroup
Get-DomainGroupMember -Identity 'GROUP' -Recurse
Get-DomainComputer | Select-Object dnshostname,operatingsystem,operatingsystemversion
Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname,memberof

9.6.1.8 Find readable domain files and configuration leads Shares, SYSVOL and NETLOGON

9.6.1.8.1 Inventory, then test the object

net view \\DC_HOST
dir \\DC_HOST\SYSVOL
dir \\DC_HOST\NETLOGON

nxc smb DC_IP -d DOMAIN -u USER -p 'PASSWORD' --shares
smbclient -L //DC_IP -U 'DOMAIN/USER'
smbclient //DC_IP/SYSVOL -U 'DOMAIN/USER' -c 'recurse ON; ls'
smbclient //DC_IP/SHARE -U 'DOMAIN/USER'

Inside smbclient, use ls, cd, get FILE and a harmless approved put only when write validation is needed. Share listing, share connection, file read and file write are separate permissions.

Inspect authorized readable policy/logon/deployment paths for scripts, configurations, backups, connection strings and legacy Group Policy Preferences XML containing cpassword. Selectively retrieve relevant files; do not bulk-copy a share merely because it is readable. A discovered secret returns to the credential-classification procedure.

9.6.1.9 Find service identities worth investigating Service accounts and SPNs

setspn -Q */*
setspn -L ACCOUNT

Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname,memberof,useraccountcontrol,pwdlastset

Record account → service class/host/port → groups → password age/encryption/delegation clues → reachable service. An SPN means the account represents a Kerberos service identity; it does not mean the password is weak, the service is reachable or the account is privileged. Ticket acquisition/cracking is Block 11.

9.6.1.10 Identify directory objects you can control Directory ACLs and effective control

Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs |
  Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|ExtendedRight|WriteProperty|Self' } |
  Select-Object ObjectDN,SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType,IsInherited,InheritanceType

PowerView normally exposes the trustee as SecurityIdentifier. Resolve that SID and trace controlled direct/nested membership. -ResolveGUIDs resolves operation GUIDs; it does not make every trustee a friendly account name. A blank projected column can mean the selected property is absent, not that an ACE has no trustee.

Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs |
  Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|ExtendedRight|WriteProperty|Self' } |
  Select-Object ObjectDN,IdentityReference,ActiveDirectoryRights,ObjectAceType,AceType,IsInherited,InheritanceType

An ACE is one rule. Effective access depends on trustee/group nesting, allow/deny semantics, inheritance, object-specific GUIDs and security descriptor scope. Do not perform the modification in this mapping block.

9.6.1.11 Find hosts where your identity may have useful rights Host-access candidates

Find-LocalAdminAccess

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares

Find-LocalAdminAccess is a broad candidate generator and can be noisy or blocked by firewall/RPC controls. Validate a selected host with the service you may actually use. NetExec's (Pwn3d!) indicates administrative SMB context according to that tool; it does not establish RDP, WinRM, WMI/DCOM or directory rights. RDP, WinRM, SMB/service control and WMI/DCOM each have different ports, services, policies and authorization.

9.6.1.12 Identify useful logged-on identities and verify the session evidence Sessions are volatile hints

Get-NetSession -ComputerName COMPUTER -Verbose
Get-NetLoggedon -ComputerName COMPUTER

PsLoggedOn.exe \\COMPUTER

Get-NetSession relies on workstation/session enumeration APIs that modern Windows may restrict. PsLoggedOn combines Registry profile evidence with NetSessionEnum; remote Registry access and sufficient rights are relevant, and querying can itself create a network-session entry. Therefore:

• empty/denied is inconclusive, not proof of no users;
• a session is a time-sensitive observation, not a durable ACL;
• a session matters only if the current identity can reach/control that host and a later credential/ticket technique applies;
• session presence does not prove credentials are resident, accessible or reusable.

9.6.1.13 Find and validate a useful domain attack path BloodHound: collect narrowly, rank, then validate

9.6.1.13.1 Current SharpHound CE

Low-noise directory baseline that avoids contacting every workstation:

.\SharpHound.exe --CollectionMethods DCOnly --OutputDirectory .\bh --ZipFileName domain-dconly.zip

Add host facts only when they can answer the next question:

.\SharpHound.exe --CollectionMethods LocalGroup --ComputerFile .\candidate-hosts.txt --OutputDirectory .\bh --ZipFileName candidate-localgroups.zip
.\SharpHound.exe --CollectionMethods Session --ComputerFile .\candidate-hosts.txt --Loop --LoopDuration 00:10:00 --OutputDirectory .\bh --ZipFileName candidate-sessions.zip

SharpHound with no collection flag uses its broader default, including directory data plus local-group/session attempts. All performs every supported method; it is not the first response to an unanswered narrow question. Import the output ZIP into a compatible BloodHound CE deployment and verify node/edge counts and ingestion errors.

# Inspect the actual collector before using copied syntax.
.\SharpHound.exe --help

# Legacy/course PowerShell collector; use only with a compatible legacy deployment.
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory .\bh -ZipFileName legacy.zip

9.6.1.13.2 Noninteractive Kali first pass

Use one valid domain identity and scoped DC/SMB connectivity. Start in a fresh private directory so graph output and reports do not mix identities. DOMAIN is the DNS domain; DOMAIN_NETBIOS is its short name, DC_HOST the DC FQDN, and TARGET one approved SMB host. No menu input is required.

mkdir -p ~/oscp/work/TARGET/evidence/ad-first-pass
cd ~/oscp/work/TARGET/evidence/ad-first-pass
bloodhound-ce-python -d DOMAIN -u USER -p 'PASSWORD' -dc DC_HOST -ns DC_IP -c DCOnly --disable-autogc --zip
ldapdomaindump -u 'DOMAIN_NETBIOS\USER' -p 'PASSWORD' -o ldap-inventory ldap://DC_IP
bloodyAD --host DC_HOST --dc-ip DC_IP -d DOMAIN -u USER -p 'PASSWORD' get writable --detail --partition DOMAIN > writable.txt
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares --no-admin-check --log shares.log

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares --no-write-check --log shares.log

Do not use linWinPwn --auto as a substitute for this selection: its automatic chain has additional attack behavior. Its menu-based all,LoggedOn collector adds host RPC and remote-registry access that can trigger RemoteRegistry startup. The direct baseline also removes the wrapper's startup Nmap scan and conditional password-repair prompts. Authentication-method fallback can cause multiple authentication exchanges; stop and diagnose a failed credential rather than repeatedly running all collectors.

Sources: BloodHound.py CE, ldapdomaindump, bloodyAD writable query, NetExec share enumeration. A future tool/dependency version needs renewed behavior checks; these commands are reference material, not a claim of target execution or explicit OffSec tool endorsement.

9.6.1.13.3 Analyze in this order

1. Mark only identities/hosts actually controlled. A low-privilege session on a host does not make the host itself fully owned.
2. Inspect the controlled principal's direct and nested group memberships and outbound object-control edges.
3. Inspect reachable computers where it has local admin, RDP, WinRM/DCOM or other applicable rights.
4. Inspect high-value goals and shortest paths only as hypothesis generation.
5. Classify each selected edge:
   • directory/static-ish: group, ACL, GPO, OU, trust;
   • host-derived: local group or user right;
   • volatile: session;
   • route-dependent: the required host/service must be reachable now.
6. Reproduce the minimum important relationship manually before handing it to Block 11 or 12.

9.6.1.14 Rank candidate paths by evidence and missing prerequisites Candidate ledger and path ranking

ID | CONTROLLED PRINCIPAL | RELATIONSHIP | TARGET | SOURCE EVIDENCE
   | EFFECTIVE? | ROUTE/SERVICE | VOLATILITY | EXPECTED TRANSITION
   | MINIMUM VALIDATION | STATUS | NEXT BLOCK

Rank candidates by:

1. confidence that the relationship is effective;
2. deterministic value of the resulting identity/access;
3. route and service availability;
4. stability versus volatile session timing;
5. reversibility and impact;
6. number of unsupported assumptions.

Prefer a validated readable share/credential clue or direct object right over a multi-edge path built from stale sessions and unreachable hosts.

9.6.1.15 Choose the next check from the failure you observed Failure routing

9.6.1.16 Continue with the capability your result enables Handoffs

• SPN, roastable/no-preauth candidate, useful ACL/GPO right, readable secret or privileged-host credential opportunity → identity transitions and object control, credential access, or object control.
• Password/hash/ticket plus validated host authorization → lateral movement.
• Required internal host/service unreachable → pivoting and tunneling.
• Any new identity, host, route, subnet or domain → repeat the relevant mapping branches.

9.6.1.17 Tooling for this section

9.6.1.18 Kerbrute — confirm candidate names before password testing

Use with the real domain and reachable KDC. Names generated from emails/wordlists remain candidates until verified.

9.6.1.18.1 kerbrute userenum -d DOMAIN --dc DC_IP --delay 1000 -o valid-users.txt users.txt

kerbrute userenum -d DOMAIN --dc DC_IP --delay 1000 -o valid-users.txt users.txt

9.6.1.18.2 A separate password test, only after reading lockout policy and attempt history

# A separate password test, only after reading lockout policy and attempt history
kerbrute passwordspray -d DOMAIN --dc DC_IP --delay 1000 --safe \
  users.txt 'PASSWORD'

Read: a valid principal is not a valid password or host access. Password pre-auth failures can count toward lockout; --safe stops on a reported lock but does not guarantee that no lockout occurs. Confirm a reported login with the relevant SMB/WinRM/LDAP client and keep the account scope explicit. DNS, time and a correct realm remain prerequisites.

Sources: upstream 1.

rusthound-ce -d DOMAIN -u 'USER@DOMAIN' -p 'PASSWORD' -f DC_HOST -z

# When the directory requires LDAPS and the TLS/name prerequisites are met
rusthound-ce -d DOMAIN -u 'USER@DOMAIN' -p 'PASSWORD' -f DC_HOST --ldaps -z

9.6.1.20 GPP cpassword — recover a candidate from readable SYSVOL XML

Use when an accessible preference XML contains a cpassword attribute. Search the SYSVOL files actually read/downloaded with the accepted account.

grep -Rni 'cpassword' ./sysvol
gpp-decrypt 'C_PASSWORD'

Read: keep the XML's username, host/policy scope and path beside the recovered value. Old preference files can contain stale credentials. Validate the matching account on a relevant service; a decrypted string is not proof of current domain or local-admin access. A modern domain need not contain these older preference secrets.

Sources: upstream 1.

9.6.1.21 Kerberos clock skew — compare UTC and use a working time source

Use when tickets fail with a skew error or the DC/workstation clock comparison is inconsistent. A timezone label is not the UTC clock value.

9.6.1.21.1 date -u

date -u
nmap -Pn -p 445 --script smb2-time DC_IP

9.6.1.21.2 If this DC is a confirmed reachable NTP source, correct the attack workstation

# If this DC is a confirmed reachable NTP source, correct the attack workstation
sudo ntpdate -u DC_IP
date -u

Read: retry the same ticket/service request after verifying the actual UTC difference. If the clock jumps back, identify the competing host/VM/time-sync source instead of repeatedly changing timezone settings. NTP silence can be filtering or an unavailable time service; it is not evidence that the KDC's displayed time was wrong.

Sources: upstream 1 · upstream 2.

9.6.1.22 Sources

• Supplied PEN-200, Chapter 22, pp705–757.
• OffSec OSCP+ Body of Knowledge
• OffSec OSCP Exam FAQ
• SpecterOps SharpHound CE and collection flags
• Microsoft RootDSE and DirectorySearcher
• Microsoft PsLoggedOn
• NetExec share enumeration and LDAP query
• OpenLDAP Administrator's Guide
• PowerSploit PowerView (archived)
• getSH Active Directory route, source snapshot e1f62dd
• Hexdump Active Directory module and consolidated cheatsheet. The live AD module was still a TODO when checked; its minimal legacy collection cues were independently updated against current SharpHound documentation.