Active Directory Penetration Testing Lab

Overview

This repository documents a hands-on Active Directory attack lab simulating a real-world enterprise compromise scenario. The focus is on enumeration, attack path discovery, credential attacks, privilege escalation, and domain compromise analysis.

Objective

• Enumerate an Active Directory environment
• Identify privilege escalation paths
• Perform Kerberos-based attacks
• Analyze group and permission abuse
• Understand how misconfigurations can lead to Domain Admin compromise

Lab Environment

Component	Details
Domain Controller	Windows Server 2019
Client Machine	Windows 10
Attacker Machine	Kali Linux
Domain	corp.local

Methodology

1. Initial Enumeration
2. BloodHound Attack Path Analysis
3. SMB / LDAP / User Enumeration
4. Kerberoasting / Credential Attacks
5. Privilege Escalation
6. Domain Admin Path Analysis
7. Reporting & Remediation

Tools Used

• BloodHound / SharpHound
• CrackMapExec
• Impacket
• Rubeus
• Mimikatz
• smbclient / enum tools
• Hashcat

Key Attack Flow

Initial Access → Enumeration → Kerberoasting → Privilege Escalation → Lateral Movement → Domain Admin

Key Findings

• Misconfigured group permissions can create direct privilege escalation paths
• Kerberoastable service accounts expose password cracking opportunities
• Excessive delegation and weak access control increase blast radius
• Active Directory misconfigurations can lead to full domain compromise

Remediation Themes

• Enforce least privilege
• Audit delegated permissions
• Restrict service account privileges
• Rotate passwords and use strong service account controls
• Monitor Kerberos abuse indicators
• Review BloodHound attack paths regularly

Repository Sections

• lab-setup/ → environment overview
• enumeration/ → discovery and mapping
• attacks/ → attack techniques
• privilege-escalation/ → escalation path analysis
• report/ → final pentest report
• resources/ → tools and references

Disclaimer

This repository is for educational use in isolated lab environments only.