Radioactive Directory

History

Active Directory History

Trace AD from its Windows NT Domain origins through Windows 2000's launch to modern hybrid environments. Understanding its evolution from simple directory service to complex identity infrastructure reveals why many attack techniques exploit decades-old design decisions. Key milestones include major security vulnerabilities, the rise of public attack research (2014-present), and the shift toward Azure AD/Entra ID integration.

Foundation

AD Fundamentals

Master the core architecture: forests, domains, organizational units, domain controllers, and FSMO roles. Understand security principals, SIDs, Group Policy Objects, trust relationships, LDAP structure, and directory schema. Essential foundation before tackling offensive or defensive techniques.

Authentication

Authentication Protocols

Deep dive into Kerberos (TGT, TGS, service tickets, PAC validation), NTLM (v1 vs v2), LDAP/LDAPS authentication, PKINIT certificate-based auth, and modern authentication integrations like SAML. Understanding these protocols is critical for both attack and defense.

Basic Attacks

Foundational Attacks

Essential techniques every security professional must master: Kerberoasting and AS-REP Roasting for credential extraction, Pass-the-Hash and Pass-the-Ticket for lateral movement, DCSync for domain replication abuse, and Golden/Silver Ticket attacks for persistence. These are the building blocks of AD exploitation.

Coercion

Coercion & Relay Attacks

Force authentication from high-value targets using PrinterBug, PetitPotam, and DFSCoerce, then relay captured authentication to ADCS web endpoints or LDAP/LDAPS for privilege escalation. Includes WebClient coercion techniques and WebDAV abuse for optimal attack chains.

Delegation

Delegation Abuse

Exploit delegation configurations (Unconstrained, Constrained, and Resource-Based Constrained Delegation) for privilege escalation. Covers Shadow Credentials attacks via Key Trust abuse, S4U2Self/S4U2Proxy mechanics, and cross-domain delegation exploitation for lateral movement.

Certificates

AD Certificate Services (ADCS)

Exploit ADCS misconfigurations for domain takeover. Covers ESC1-ESC16 techniques including misconfigured certificate templates, enrollment agent abuse, vulnerable access controls, NTLM relay to HTTP endpoints, and the September 2025 strong certificate binding enforcement deadline.

Permissions & Policy

ACL & Group Policy Abuse

Leverage ACL misconfigurations (GenericAll, GenericWrite, WriteDACL, ForceChangePassword) and Group Policy exploitation (GPO modification, scheduled tasks, SYSVOL credential mining) for privilege escalation and persistence. Includes AdminSDHolder backdoor techniques and DACL-based persistence mechanisms.

Defense

Defense & Detection

Build resilient AD infrastructure through tiered administration models, Privileged Access Workstations (PAWs), LAPS deployment, just-in-time access controls, Protected Users group configuration, detection engineering strategies, and BloodHound-informed defensive hardening.