Skip to main content

Blog-0xahmetcan

Open to Work
RESEARCH
Network Forensics Detection Engineering SOC Analysis Incident Response Threat Hunting
CONTENT
Investigations Write-ups
CTF LABS
Hack The Box TryHackMe PortSwigger VulnHub Hackviser
ABOUT
Portfolio Contact
Open to Work
Active Directory Privilege Escalation | 0xAHMETCAN
ACTIVE DIRECTORY

Active Directory Privilege Escalation
From Enumeration to Domain Admin

Learn practical Active Directory enumeration, BloodHound analysis, Kerberoasting, privilege escalation techniques, and defensive recommendations through a realistic laboratory environment.

June 2026 15 min read Ahmet Can Aytekin

Overview

Active Directory is one of the most common identity management solutions used in enterprise environments. Understanding how attackers enumerate, identify privilege escalation opportunities, and eventually compromise a domain is essential for both penetration testers and blue team defenders.

Lab Environment

  • Windows Server 2022
  • Windows 11 Client
  • Kali Linux
  • BloodHound
  • Neo4j
  • Impacket
  • NetExec

Initial Enumeration

Always begin by identifying available hosts, services, SMB shares, and domain information.

Nmap Scan 

nmap -Pn -sC -sV 10.10.10.161

SMB Enumeration

Use NetExec to enumerate SMB shares, users, sessions, and domain information.

NetExec 

netexec smb 10.10.10.161

LDAP Enumeration

LDAP provides valuable information about users, groups, computers, and domain structure.

ldapsearch 

ldapsearch -x

BloodHound Analysis

Collect Active Directory data using SharpHound and import the results into BloodHound to visualize attack paths.

BloodHound Graph Screenshot

Kerberoasting

Identify Service Principal Names (SPNs) and request service tickets for offline password cracking.

GetUserSPNs.py 

GetUserSPNs.py DOMAIN/user:password

Privilege Escalation

After obtaining valid credentials, enumerate ACLs, misconfigurations, delegation settings, and administrative privileges.

secretsdump.py 

secretsdump.py administrator@dc

Mitigation

  • Apply Least Privilege.
  • Disable unnecessary SPNs.
  • Enable SMB Signing.
  • Monitor Kerberos abuse.
  • Regularly audit Active Directory permissions.

Conclusion

Active Directory remains one of the most valuable targets for attackers. Understanding the attack chain allows defenders to strengthen their environments while helping penetration testers perform realistic security assessments.

© 2026 0xAHMETCAN