Credentials are the currency of an Active Directory attack. This section covers the three ways to acquire them: dumping secrets already present on a host or in the directory, cracking the recovered hashes offline into usable passwords, and guessing them against the domain through spraying. Everything else in the authentication and credentials section either consumes these secrets or produces more of them.
Where secrets live#
A compromised Windows host and the directory itself hold several credential stores:
- LSASS memory: the plaintext, NTLM hashes, and Kerberos tickets of every principal with a session on the host.
- The SAM and LSA secrets: local account hashes and cached service-account and machine-account secrets in the registry.
- DPAPI-protected stores: saved browser and application passwords, and credentials in the Windows vault.
- The NTDS database: on a domain controller (or via DCSync from any host with the replication right), the NTLM hashes of every account in the domain, including
krbtgt. - The directory: passwords in attributes, LAPS and gMSA managed passwords (covered under credentials in attributes).
Pages#
- Token impersonation: SeImpersonate to SYSTEM from a service-account foothold (the potato family).
- LSASS dumping: extracting live credentials and tickets from LSASS memory.
- SAM and LSA secrets: local hashes and cached machine and service secrets.
- DPAPI secrets: browser, vault, and application credentials.
- NTDS and DCSync: the whole domain's hashes from the DC or by replication.
- ZeroLogon: resetting the DC machine account over Netlogon for unauthenticated domain takeover.
- RODC: cached-credential extraction and the scoped golden ticket from a Read-Only Domain Controller.
- Cracking: turning recovered hashes into passwords offline.
- Host and domain discovery: finding domain controllers, naming contexts, and the lay of the domain.
- LDAP enumeration: querying the directory for objects, attributes, and abusable flags.
- User and group enumeration: building the account list to target.
- Session enumeration: locating logged-on users to target for credential theft and lateral movement.
- Null sessions: anonymous SMB/LDAP enumeration and RID cycling, before any credential.
- Password policy: reading the policy that bounds safe spraying.
- Password spraying: guessing valid credentials without lockout.
- Pre-created computers: taking over pre-staged computer objects with their default name-as-password.
Once you hold the directory's secrets, the same access supports domain persistence:
- DCShadow: push arbitrary changes through a rogue domain controller.
- DSRM: the domain controller's local backdoor account.
- Skeleton Key: a master password patched into LSASS.
- Custom SSP: logging cleartext credentials on the host.